Symantec PR bunnies score Slammer own goal

[InfoSec News <isn () c4i org>]

http://www.theregister.co.uk/content/56/29340.html

By John Leyden
Posted: 14/02/2003 at 20:40 GMT

Symantec says it discovered the prolific Slammer worm "hours before it
began rapidly propagating".

The claim, contained in a press release extolling the company's
DeepSight Threat Management System, suggests that Symantec notified
its own customers of a serious threat hours before the wider Internet
community knew anything was amiss.

Wired takes Symantec to task for this apparent lapse in ethics.  
Symantec spokesman Yunsun Wee told Wired that it issued an alert about
Slammer to its early warning list subscribers "at approximately 9pm
PST on Friday, January 24."

News of the worm began to filter onto security mailing lists at 10pm
PST, the magazine reports.

Well-established practices among AV vendors call for virus samples to
be rapidly exchanged between rival vendors, so that users can be
protected as soon as possible.

But did Symantec really sit on the problem? The company's claims are
inconsistent: a Silicon Defence analysis shows that Slammer infected
more than 90 per cent of vulnerable hosts within 10 minutes. This
analysis is supported by first-person accounts of telecom security
experts contacted by us, as well as security consultant Robert
Graham's excellent review of the spread of the worm.

So we think this is more a case of Symantec shooting itself in the
foot with inflated marketing claims for its early warning service
rather than anything more sinister. If it knew about Slammer before
everyone else (which is questionable) then we doubt it knew it was
anything like as vicious as it turned out to be.

At least we hope so, but without been able to discuss the sequence of
events or Symantec's wider alerting policy with anyone from the
company its hard to know for sure.

Despite numerous calls to Symantec today the best its UK staffers
could do was to point us towards its press release.

Pathetic.

Promises that its US team would be in touch came to nothing, but once
they get in touch we'll be sure to update this story with what the
company has to say.



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.