Symantec antivirus bug allows utter exploitation of memory

British white hat hacker and Google Project Zero chap Tavis Ormandy is making life miserable for Symantec again: the bug-hunter has turned up an exploitable overflow in “the core Symantec Antivirus Engine used in most Symantec and Norton branded Antivirus products”. Described here, the problem is in how the antivirus products …

[Stevie]

Bah!

Blast! My Gibson is haxxored again!

[Tom Chiverton 1]

Re: Bah!

Hack the planet !

[Andrew Jones 2]

Well that seems like a bit of an unfortunate cock up doesn't it.... so this is akin to decontaminating someone who may or may not be carrying anything that requires decontamination - but doing so on the wrong side of the decontamination room door?

[JeffyPoooh]

Friends assist friends to remove all Symantec crapware

Life gets noticeably better post-Symantec.

[el_oscuro]

Antivirus

Please see: http://www.theregister.co.uk/2016/01/11/trend_micro_antivirus/

[Infernoz]

Symantec is Toxic Waste

I'd never ever run Symantec or McAfee anything on my own hardware, because they are bloated and stagnant junkware, from personal experience with their enterprise products. Security needs to be in depth, not bloated and brittle layers. McAfee is also crap because it only supports obsolete fat32 for virtual disk encryption on Windows and can't even do file encryption properly to ensure that virtual disk and backup software is usable.

Security software must implement the highest defensive programming standards, including against value range or buffer overflow exploits.

Running anything risky with the highest security permissions is a complete security fail and insanely negligent 'design', /all/ security testing must be in a lower permissions sandbox, and only when really necessary so as not to cripple performance.

[Destroy All Monsters]

A-HAH!

So, a product that is clearly not fit for purpose and ... what's that? a Buffy Overflow in 2016? ... not being developed according to current best practices and state of the industry?

What's the number of the Tort Lawyers....

[Tchou]

Filter driver to intercept I/O?

Kernel space process?

Sounds like the main purpose of this software is spying upon users for intelligence (economic, defense, depend where it is run)

[theblackhand]

Re: main purpose of Symantec

The main purpose is extracting money from end users.

There might be an accidental side effect of providing some security primarily by making your computer so slow that you stop using it.

The chances of Symantec being used by intelligence agencies to gather information when the software turns your machine into an unusable piece of crap which severely limits intelligence gathering.

[patrickstar]

Back in the XP days (before Patchguard), Symantec/Norton antivirus hooked some of the same shadow SSDT entries (syscalls) as you'd expect a keylogger to do. I actually showed the hooks to a guy at MS security and he was totally convinced the computer had a keylogger...

Really makes you wonder.

[King Jack]

" I actually showed the hooks to a guy at MS security and he was totally convinced the computer had a keylogger..." So you are the one who gave Window 10 that idea!

[Anonymous Coward]

....is making life miserable for Symantec again

...well they now know how we feel.

[Tom 64]

Re: ....is making life miserable for Symantec again

Well, lets just hope this does enough rep damage to make them irrelevant.

You get what you deserve when you're a fear-mongering shit-peddaling charlatan.

[hotdamn]

I always thought Norton was a virus itself.

[Anonymous Coward]

Norton antivirus hasn't been any good since Peter Norton sold it to Symantec.

[Cuddles]

"about as bad as it can possibly get"

Isn't that Symantec's company motto?

[Anonymous Coward]

Fools let Fools run Symantec products

I wonder if some of their other products, which use similar AV engine technology are also affected?

[Robert Helpmann??]

Hey! No editorializing!

I got to the description of how the exploit plays out in the Windows world and... thanks for that! Now I have to share the article with everyone in the office by way of explanation.

[Anonymous Coward]

Don't miss the advisory

RUH ROH ADVISORY

And also:

Comment 7 by [e-mail], Today (2 hours ago)

> a remote ring0 memory corruption vulnerability

...with no user interaction!

After reading this, I'm conflicted:

When the Pwnie Awards come around, should I nominate this bug for "Pwnie for Epic Ownage" or nominate Tavis for "Pwnie for Lifetime Achievement"?

Because, just... damn.

Anti-virus software should be considered harmful.

[Anonymous Coward]

Who in his right mind

would run Symantec on Unix/Linux ? I wouldn't trust that guy with anything IT related. He should still be allowed to water plastic plants decorating the office.

[Mpeler]

Good pic

Lead pic would do well on the LinkedIn article...