Quantcast
PCWorld.com is upgrading some back-end systems. Some site features, such as user registration, may be temporarily unavailable.

Hackers Allege Flaw in Symantec's Antivirus Line

German group warns that LiveUpdate can be easily rerouted and customer PCs invaded.

Sam Costello, IDG News Service

  • 0 Yes
  • 0 No

The tool used to update the virus definitions in Symantec's antivirus products has a security hole that can allow hostile code to be downloaded to PCs, according to the German hacking group Phenoelit.

LiveUpdate, the software used by Symantec's antivirus software to automatically update virus protections when updates become available, has flaws in both the 1.4 and 1.6 versions that allow for the attacks, Phenoelit says. When LiveUpdate 1.4 looks for updates, it attempts to connect to a specific server at Symantec, the group said. That connection, however, can be hijacked using a number of Domain Name Server attacks and rerouted to the server of the attacker's choice, Phenoelit says. If an attacker recreates the proper directory structure on the server the connection is sent to, any code can be downloaded to the user's machine and executed, the group says.

Version 1.6 doesn't have a vulnerability that is quite as extensive, but can fall victim to a network performance degradation attack, the group adds. The use of a special Symantec data format for the updates and cryptographically signed update files prevents the same kind of attacks that LiveUpdate 1.4 can be hit with, according to Phenoelit. Version 1.6 can also be prevented from receiving any updates, even if they are available, by using the connection to launch a hijacking attack and manipulating some files on the destination server, the group says.

Symantec Silent

Phenoelit says it notified Symantec of the flaw on September 22. Symantec did not immediately return calls seeking comment.

The practice of posting details about a vulnerability has raised discussion in the security community. Some advocate giving vendors time to respond before publicizing a software flaw--although the amount of time that is sufficient and fair is also up for debate. Others question the motivation of hackers and others who trumpet software flaws that can be exploited as security holes.

The group advised users to upgrade to LiveUpdate 1.6, though it noted that LiveUpdate 1.6 is still vulnerable to the network degradation attack. It also urged Symantec to use new cryptographic signing methods and to tell its customers about the security flaws in LiveUpdate 1.4.

  • Recommend this story?
  • 0 Yes
    0 No
  • Great year-end deals
    for small business!
  • Get 24/7 live remote AT&T Tech Support 360* service along with select Lenovo* PCs (with Intel® Core™ 2 Duo processors) and save up to 200!

    Learn more

  • HP EliteBook* 6930p Notebook with Intel® vPro™ technology and a free HP Basic Docking Station - $641 instant savings!

    Learn more

Dell End of Year Deals

People who read this also read:

  • Perfect Printing Solutions Find just the right All-in-One printer for you from HP. Visit the HP Resource Center.
  • Lenovo Laptop Showcase Find out how Lenovo IdeaPads and Thinkpads balance performance and portability. Visit the Lenovo Resource Center for more info...

Sponsored Links