* subscribe at http://techPolice.com

Security software: blind lead blind
 2001 SecurityFocus.com, all rights reserved.
By Elias Levy
Posted: 31/08/2001 at 10:41 GMT


It's incredible that in this day and age some of the most popular security products, 
products that are marketed as protecting you from the evils of computers, are so badly 
designed.

Case in point: The many antivirus products that failed to detect and stop the highly 
effective SirCam worm, even when updated with the latest signatures and when 
configured correctly.

Symantec's Norton Antivirus for Gateways v2.x, Norton Antivirus POP email scanner, and 
TrendMicro's InterScan VirusWall Standard and CVP editions version 3.51 build 1321 for 
Windows NT all failed to block SirCam. Why? Because all products "failed open," i.e., 
when they encountered email messages they couldn't handle properly, they sent them 
through by default.

SirCam spread via email as an infected attachment, and, unlike most other worms, 
included its own code to send out the infected messages. The email messages generated 
by the worm were slightly malformed, and while many email clients are lax enough in 
their parsing of messages to display the message and its attachment correctly (IETF's 
motto: "be strict in what you produce and tolerant to what you receive"), the flaw in 
the headers stopped those antivirus products from detecting the attachment and the 
worm.

Instead of quarantining malformed messages, the security products happily forwarded 
them to their destination.

Symantec corrected NAV for Gateways in version 2.5.1 by adding a new option named 
"Messages that can't be processed" which allows the administrator to configure it to 
either drop, bounce, or deliver malformed message. Notice the lack of a "quarantine" 
option. TrendMicro fixed InterScan VirusWall by being more permissive in its parsing 
of messages so that the attachment can be successfully decoded for scanning.

It seems security problems are common in antivirus products.

Look at the poor folks at TrendMicro. This year alone there have been fourteen 
different vulnerabilities reported in their InterScan product line. Last year, at 
least four vulnerabilities were reported in a number of their products. Many of these 
vulnerabilities allow remote command execution on the host where the product is 
installed. Several of them are buffer overflows. Two new vulnerabilities were just 
discovered in their AppletTrap product.

Other types of security products are not far behind.

CheckPoint's FireWall-1, the leading firewall by market share, had at least four 
vulnerabilities reported this year, and at least eleven reported last year.

My intention is not to berate or point the finger at these companies. But one has to 
wonder, if vendors that specialize in security can't produce a secure product, what 
chance does any other software vendor have? And before you mention open source as a 
solution, consider its track record. With some exceptions, it's not much better..

Writing secure code is hard; designing a security product harder. They both require a 
lot of time, effort, and money. Complexity only makes things more difficult. All these 
factors are working against security.

Complexity is increased in each revision of the software by adding more features. Time 
to market is essential to the commercial success of the products, and is shrinking all 
the time. Each product is made with as little money as possible, so as to increase its 
return, and allow the vendor to price it at a level customers will buy. Customers are 
always asking for more features, as soon as possible, and for a cheaper product.

Until we master the art of building a security product that deserves the label, the 
outlook is grim. I suggest you buy insurance. Lots of it.

 2001 SecurityFocus.com, all rights reserved.

------------------------------------------------------------
 $  Earn Extra Income As A Mystery Shopper $
 http://www.topica.com/lists/Mysteryshopper/
$ 100's Of National Assignments Posted Daily $

--via http://techPolice.com
archive: http://theMezz.com/cybercrime/archive
subscribe: [EMAIL PROTECTED]
--via http://theMezz.com

==^================================================================
EASY UNSUBSCRIBE click here: http://topica.com/u/?b1dhr0.b2EDp2
Or send an email To: [EMAIL PROTECTED]
This email was sent to: archive@jab.org

T O P I C A -- Register now to manage your mail!
http://www.topica.com/partner/tag02/register
==^================================================================



Reply via email to