January 11, 2006 5:20 PM PST

Symantec closes off hiding place for hackers

Symantec has released an update to its popular Norton SystemWorks to fix a security problem that could be abused by cybercriminals to hide malicious software.

In the PC-tuning application, a feature called the Norton Protected Recycle Bin creates a hidden directory on Windows systems. The feature is meant to help people restore modified or deleted files, but the hidden folder might not be scanned during scheduled or manual virus scans, Symantec said in an advisory released Tuesday.

"This could potentially provide a location for an attacker to hide a malicious file on a computer," Symantec said. The Cupertino, Calif., security provider is not aware of any attempts by hackers to conceal malicious code in the folder. "This update is provided proactively to eliminate the possibility of that type of activity," it said.

Symantec's alert has echoes of Sony BMG Music Entertainment's recent PC security fiasco. The record label was found to be shipping copy-protected compact discs that planted so-called rootkit software on the computers that played them. The rootkit technology also offered a hiding place for malicious software.

When the recovery feature was first introduced, hiding the directory helped ensure that a user would not accidentally delete the files in it, Symantec said.

"In light of current techniques used by malicious attackers, Symantec has re-evaluated the value of hiding this directory," the company said in its advisory.

Security monitoring company Secunia rates the issue "not critical." Symantec itself deems the risk impact "low."

Symantec credits Mark Russinovich, the Sysinternals researcher who also investigated the Sony rootkit, and F-Secure, a Finnish security company that has a rootkit detection product, for helping it address the SystemWorks issue.

The Norton update will display the previously hidden "NProtect" directory in the Windows interface, which will allow it to be scanned by antivirus products, Symantec said. The new version is available through the Symantec LiveUpdate service. Installing the software will require a system reboot.

20 comments

Join the conversation!
Add your comment
This is getting to be hilarious.
Remember the good old days when those poor Windows users
could go more than a day or two without some new security issue?
Posted by Macsaresafer (802 comments )
Reply Link Flag
Apple Users are Not Smart Either
If Mac is so secure, why does Apple has to release security patch for OSX?
Posted by kubasic (18 comments )
Link Flag
Depends where you watch
I watch Bugtraq where I see security bugs on all sorts of systems being noted daily. Don't be so smug, your system may be compromised too if you aren't careful.
Posted by aabcdefghij987654321 (1721 comments )
Link Flag
you know it's BS
to say, imply, or otherwise mislead as if ONLY windows has issues. C/net just had an article about security updates for Linux... and no...I'm not providing a link cause I dont have it and not spending the time to find it for you. You're obviously a smart little PC user so I'm sure you know how to google for an article...
Posted by The user with no name (259 comments )
Link Flag
This is getting to be hilarious.
Remember the good old days when those poor Windows users
could go more than a day or two without some new security issue?
Posted by Macsaresafer (802 comments )
Reply Link Flag
Apple Users are Not Smart Either
If Mac is so secure, why does Apple has to release security patch for OSX?
Posted by kubasic (18 comments )
Link Flag
Depends where you watch
I watch Bugtraq where I see security bugs on all sorts of systems being noted daily. Don't be so smug, your system may be compromised too if you aren't careful.
Posted by aabcdefghij987654321 (1721 comments )
Link Flag
you know it's BS
to say, imply, or otherwise mislead as if ONLY windows has issues. C/net just had an article about security updates for Linux... and no...I'm not providing a link cause I dont have it and not spending the time to find it for you. You're obviously a smart little PC user so I'm sure you know how to google for an article...
Posted by The user with no name (259 comments )
Link Flag
this is a symantec issue
As I will not use their products I do not have this issue.

Besides, Symantec's security and such have been getting worse and worse since 2000.

Long live Avast and AVG.
Posted by techguy83 (295 comments )
Reply Link Flag
Peter Norton
Maybe they should employ Peter Norton. Maybe he could improve these software.

I have completely abandon Norton Antivirus. It has turned into such piece of crap. Talk about a resources hog.
Posted by (7 comments )
Link Flag
this is a symantec issue
As I will not use their products I do not have this issue.

Besides, Symantec's security and such have been getting worse and worse since 2000.

Long live Avast and AVG.
Posted by techguy83 (295 comments )
Reply Link Flag
Peter Norton
Maybe they should employ Peter Norton. Maybe he could improve these software.

I have completely abandon Norton Antivirus. It has turned into such piece of crap. Talk about a resources hog.
Posted by (7 comments )
Link Flag
Norton UN-Protected Recycle Bin
Norton UN-Protected Recycle Bin sounds like a more appropriate name.
Posted by sadchild (280 comments )
Reply Link Flag
Norton UN-Protected Recycle Bin
Norton UN-Protected Recycle Bin sounds like a more appropriate name.
Posted by sadchild (280 comments )
Reply Link Flag
Need help? Pay money!
What I have not seen mentioned in any of the news items on this issue, and that I think deserves broader play, is the fact that Symantec's fix is only for the 2004 through 2006 versions of their utility suite. 2003 and earlier suffers from the same problem but if you want to fix that, you are out of luck. First you have to pay for an upgrade and then apply the patch. But I have a better idea. Out of curiosity, I downloaded Zone Alarm's antivirus suite and scanned with it. I found 8 infections that Norton had let past, 6 of them hiding in the NPROTECT folder. This is curious since I have never used Norton Protection for my recycle bin. Apparently, it is installed whether you want it or not and all you can do is toggle whether or not it is actually used. So let's see the score: Norton is slipshod about preventing infections, it provides a cozy hiding place for them that they are now using, and if you want to destroy that hiding place, you have to pay money to Symantec for the priviledge. I think uninstalling is a far better idea.
Posted by pjcamp (369 comments )
Reply Link Flag
Need help? Pay money!
What I have not seen mentioned in any of the news items on this issue, and that I think deserves broader play, is the fact that Symantec's fix is only for the 2004 through 2006 versions of their utility suite. 2003 and earlier suffers from the same problem but if you want to fix that, you are out of luck. First you have to pay for an upgrade and then apply the patch. But I have a better idea. Out of curiosity, I downloaded Zone Alarm's antivirus suite and scanned with it. I found 8 infections that Norton had let past, 6 of them hiding in the NPROTECT folder. This is curious since I have never used Norton Protection for my recycle bin. Apparently, it is installed whether you want it or not and all you can do is toggle whether or not it is actually used. So let's see the score: Norton is slipshod about preventing infections, it provides a cozy hiding place for them that they are now using, and if you want to destroy that hiding place, you have to pay money to Symantec for the priviledge. I think uninstalling is a far better idea.
Posted by pjcamp (369 comments )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.