[IP] Symantec announces Norton Public Relations Nightmare 2006
http://blogs.siliconvalley.com/gmsv/2006/01/
_after_the_sony.html#comments
Symantec announces Norton Public Relations Nightmare 2006
By JOHN PACZKOWSKI
After the Sony rootkit debacle, you'd think we would have heard the
last of reputable software companies creating hidden directories in
Windows systems (see "Sony reconsiders policy on hiring 'reformed'
hackers," "Sony DRM: You can look but you can't touch," "Sorry about
those secret files; what we meant to install were these secret
files," "Quoted," "Find out who programmed the rootkit DRM and send
Qrio to kill him," "Rootkits -- serves those Windows losers ri ...
hey, what the ...?," "And we would have gotten away with it if it
weren't for you meddling kids" and "Sony inducted into FUBAR Hall of
Fame," "Sorry, we thought "rootkit" was Finnish for 'congratulations
on your DRM scheme'," and "Sony BMG's new corporate anthem: Benny
Hill Theme").
But no. Symantec just admitted that the "Norton Protected Recycle
Bin," or "NProtect" feature of Norton SystemWorks, deliberately
conceals a directory from Windows APIs to protect the files from
accidental deletion. A commercial security vendor using rootkit
technology? Unbelievable. Symantec explained its thinking in a
security bulletin. "When NProtect was first released, hiding its
contents helped ensure that a user would not accidentally delete the
files in the directory. In light of current techniques used by
malicious attackers, Symantec has re-evaluated the value of hiding
this directory. We have released an update that will make the
NProtect directory visible inside the Windows Recycler directory.
With this update, files within the NProtect directory will be scanned
by scheduled and manual scans as well as by on-access scanners like
Auto-Protect."
An embarrassing turn of events for Symantec, more so because the
company -- which bills itself as "a world leader in providing
solutions to help individuals and enterprises assure the security,
availability, and integrity of their information" -- didn't realize
its misstep until Mark Russinovich, the Sysinternals researcher who
discovered Sony's controversial DRM rootkit, alerted them to it.
"It's a bad, bad, bad idea to start hiding things in places where it
presents a danger. I'm seeing it more and more with commercial
vendors," Russinovich said in an interview with eWEEK. "When you use
rootkit-type techniques, even if your intentions are good, the user
no longer has full control of the machine. It's impossible to manage
the security and health of that system if the owner is not in control."
Comment on this post
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/