THE TOOL USED to update the virus definitions in Symantec's anti-virus products has a security hole that can allow hostile code to be downloaded to PCs, according to the German hacking group Phenoelit.

   ADVERTISEMENT
  

Free IT resource

Virtualization Insights from Top Experts - Learn how virtualization gets real!

Sponsored by Dell

Free IT resource

TechNet: More ways to know it, share it, and keep it running.

Sponsored by Microsoft

RELATED LINKS
»  IE 7 bug reopens debate over patch responsibilities
»  Woman ordered to pay for file-sharing will appeal
»  McAfee to buy SafeBoot for $350M
»  Security RSS feed 

IDG ENTERPRISE NETWORK
• Research Reports  (CIO)
• Ask the Expert  (CIO)

TOP NEWS 


IT SOLUTION SEARCH
LiveUpdate, the software used by Symantec's anti-virus software to automatically update virus protections when updates become available, has flaws in both the 1.4 and 1.6 versions that allow for the attacks, Phenoelit said. When LiveUpdate 1.4 looks for updates, it attempts to connect to a specific server at Symantec, the group said. That connection, however, can be hijacked using a number of DNS attacks and rerouted to the server of the attacker's choice, Phenoelit said. If an attacker re-creates the proper directory structure on the server the connection is sent to, any code can be downloaded to the user's machine and executed, the group said.

Version 1.6 doesn't have as extensive a vulnerability, but can fall victim to a network performance degradation attack, the group said. The use of a special Symantec data format for the updates and cryptographically signed update files prevents the same kind of attacks that LiveUpdate 1.4 can be hit with, Phenoelit said. Version 1.6 can also be prevented from receiving any updates, even if they are available, by using the connection hijacking attack and manipulating some files on the destination server, the group said.

Phenoelit notified Symantec of the flaw on Sept. 22, according to documents on the group's Web site. Symantec, in Cupertino, Calif., did not immediately return calls seeking comment.

The group advised users to upgrade to LiveUpdate 1.6, although it noted that LiveUpdate 1.6 is still vulnerable to the network degradation attack. It also urged Symantec to use new cryptographic signing methods and to tell its customer about the security flaws in LiveUpdate 1.4.

Phenoelit's full advisory can be found on the group's Web site at www.phenoelit.de/stuff/LiveUpdate.txt.