Incident: Security Vulnerabilities in Symantec's Antivirus Products Detected by Google Researcher

Published Date: 2016-06-30

Postmortem Analysis
Timeline 1. The software failure incident involving critical vulnerabilities in Symantec's anti-virus products was announced by Google security researcher Tavis Ormandy in an article published on 2016-06-30 [44658]. Therefore, the software failure incident happened in June 2016.
System 1. Symantec's entire suite of anti-virus products, including 17 enterprise products and eight Norton consumer and small-business products [44658].
Responsible Organization 1. Symantec [44658]
Impacted Organization 1. Symantec's entire suite of anti-virus products, including 17 enterprise products and eight Norton consumer and small-business products, was impacted by the software failure incident [44658].
Software Causes 1. Critical vulnerabilities in Symantec's suite of anti-virus products, including flaws in the unpacker used to examine compressed executable files, allowing attackers to gain remote-code execution on a machine [44658].
Non-software Causes 1. Lack of security professionals examining security software for vulnerabilities [44658] 2. Developers at security software companies not specially trained in writing secure code [44658] 3. Use of programming languages prone to vulnerabilities like buffer overflows and integer overflows [44658] 4. Inadequate testing and code review processes in security software development [44658]
Impacts 1. The software failure incident in Symantec's suite of anti-virus products, as reported by Google security researcher Tavis Ormandy, exposed critical vulnerabilities that could allow attackers to gain remote-code execution on a machine, potentially compromising an entire enterprise fleet [44658]. 2. The flaw in Symantec's unpacker used to examine compressed executable files could be exploited by attackers to take control of a victim's machine, turning a core component meant to detect malware into an attack vector [44658]. 3. The incident highlighted the inherent risks associated with security software, as attackers target trusted code with high levels of privilege, making it a prime target for exploitation [44658]. 4. The security software industry, including Symantec, faced criticism for failing to secure their own software and not opening their code to security professionals for vulnerability audits, raising concerns about the overall security of critical systems and data [44658]. 5. The incident underscored the need for security vendors to adopt better coding practices, undergo rigorous testing, and implement modern techniques like fuzzing to uncover vulnerabilities in their software [44658]. 6. Despite Symantec promptly fixing the vulnerabilities and providing automated patches, the incident highlighted the ongoing challenges in ensuring the security and trustworthiness of security software, necessitating a commitment to operational changes to regain customer trust [44658].
Preventions 1. Implementing secure coding practices during the development phase, including thorough code reviews and testing to catch basic flaws early on [44658]. 2. Conducting regular security audits by independent security professionals to identify vulnerabilities in the software [44658]. 3. Utilizing automated techniques like fuzzing to uncover potential vulnerabilities in the code [44658]. 4. Adopting the principle of least privilege in designing security software to limit privilege to high-risk portions of functionality, reducing the impact of potential compromises [44658]. 5. Committing to a proactive approach to security by continuously reviewing and updating security processes and practices, even for legacy code bases [44658].
Fixes 1. Implementing the principle of least privilege to limit privilege to the highest-risk portions of software functionality [44658]. 2. Conducting thorough code reviews and audits by security professionals to identify and address vulnerabilities [44658]. 3. Using modern techniques like fuzzing to uncover vulnerabilities in software [44658]. 4. Hiring developers with special training in writing secure code and ensuring they have expertise in preventing common vulnerabilities like buffer overflows and integer overflows [44658]. 5. Committing to changing the way security software companies operate, beyond just releasing patches, to regain the trust of customers [44658].
References 1. Google security researcher Tavis Ormandy [44658]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to critical vulnerabilities in security software, specifically in Symantec's suite of anti-virus products, has happened before within the same organization. The article mentions that Symantec's flaws were just the latest in a long string of serious vulnerabilities uncovered in security software, and Google security researcher Tavis Ormandy has previously discovered serious flaws in products belonging to other high-profile security shops like FireEye, Kaspersky Lab, McAfee, Sophos, and Trend Micro [44658]. (b) The software failure incident related to critical vulnerabilities in security software has also happened at multiple organizations. The article highlights that security software from various companies, including Symantec, has been found to contain vulnerabilities that could be exploited by attackers to gain control of a victim's system. This indicates a broader issue within the antivirus industry where security software from different organizations has been identified as potential attack vectors for intruders [44658].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the vulnerabilities found in Symantec's suite of anti-virus products. The critical flaws uncovered by Google security researcher Tavis Ormandy were described as basic flaws that should have been caught during code development and review. These vulnerabilities allowed attackers to gain remote-code execution on a machine, with one flaw even being exploitable with a worm just by emailing a file or sending a link to an exploit. Ormandy criticized the antivirus industry for failing to secure its own software and not opening their code to security professionals for vulnerability audits [44658]. (b) The software failure incident related to the operation phase is evident in the fact that security software, including antivirus products, can become an attack vector for intruders to seize control of a victim's system. Security software, which is supposed to protect critical systems and data, can ironically become the biggest vulnerability in those systems. The flaws in security software, such as antivirus scanners, can be exploited by attackers due to the high levels of privilege they operate with on machines. This highlights the operational risks introduced by using security software that itself contains vulnerabilities [44658].
Boundary (Internal/External) within_system (a) within_system: The software failure incident reported in the articles is primarily due to contributing factors that originate from within the system. The critical vulnerabilities found in Symantec's suite of anti-virus products were identified by Google security researcher Tavis Ormandy. These vulnerabilities, including flaws in the unpacker used by Symantec to examine compressed executable files, allowed attackers to gain remote-code execution on a machine and compromise an entire enterprise fleet [44658]. (b) outside_system: The software failure incident does not seem to be primarily attributed to contributing factors that originate from outside the system. The vulnerabilities uncovered in Symantec's security software were inherent to the design and implementation of the products themselves, rather than being caused by external factors beyond Symantec's control [44658].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the articles is primarily attributed to non-human actions, specifically vulnerabilities in Symantec's security software products that were discovered by Google security researcher Tavis Ormandy [44658]. These vulnerabilities allowed attackers to exploit the software without human intervention, such as gaining remote-code execution on a machine or compromising an entire enterprise fleet just by emailing a file or sending a link to an exploit. The flaws in the software were fundamental and should have been caught during code development and review, indicating failures introduced without human participation. (b) However, human actions also played a role in this software failure incident. The article mentions that security firms like Symantec may have hired developers without special training in writing secure code, leading to vulnerabilities in the software [44658]. Additionally, the lack of thorough code review, testing, and the use of risky programming languages like C and C++ contributed to the software flaws. Human decisions regarding the design and development of the security software ultimately played a part in the failure incident.
Dimension (Hardware/Software) software (a) The software failure incident discussed in the articles is primarily attributed to software vulnerabilities rather than hardware issues. The vulnerabilities found in Symantec's anti-virus products were related to flaws in the software code, particularly in the unpacker used to examine compressed executable files [44658]. (b) The software failure incident is directly linked to software vulnerabilities. The critical vulnerabilities discovered in Symantec's suite of anti-virus products were due to flaws in the software code, allowing attackers to exploit the system and gain remote-code execution on a victim's machine [44658].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident reported in the articles is non-malicious. The vulnerabilities found in Symantec's suite of anti-virus products were critical vulnerabilities that could be exploited by attackers to gain remote-code execution on a machine. These vulnerabilities were discovered by Google security researcher Tavis Ormandy, who highlighted that some of the flaws were basic and should have been caught during code development and review. The incident was a result of flaws in the software that could be exploited by attackers, rather than intentional malicious actions [44658].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incident related to the vulnerabilities found in Symantec's anti-virus products can be attributed to poor decisions made during the development and review process. The vulnerabilities were described as basic flaws that should have been caught by the company during code development and review. Additionally, the flaws were severe enough to allow attackers to gain remote-code execution on a machine, making them a significant security risk [44658]. (b) On the other hand, the incident can also be linked to accidental decisions or unintended consequences. The vulnerabilities discovered in Symantec's products were not intentional but rather resulted from mistakes made during the development process. The flaws were not part of the intended design but were critical oversights that could potentially compromise entire enterprise fleets [44658].
Capability (Incompetence/Accidental) development_incompetence, unknown (a) The software failure incident related to development incompetence is evident in the case of Symantec's vulnerabilities discovered by Google security researcher Tavis Ormandy. Ormandy found critical vulnerabilities in Symantec's anti-virus products, some of which were basic flaws that should have been caught during code development and review. He criticized the antivirus industry for failing to secure its own software and failing to open their code to security professionals for vulnerability audits [44658]. (b) The software failure incident related to accidental factors is not explicitly mentioned in the provided article.
Duration permanent (a) The software failure incident discussed in the articles seems to be more of a permanent nature. The vulnerabilities found in Symantec's suite of anti-virus products were critical and serious, allowing attackers to gain remote-code execution on a machine and compromise an entire enterprise fleet [44658]. These vulnerabilities were described as "as bad as it gets" by the security researcher who discovered them, indicating a significant and long-lasting impact [44658]. Symantec promptly fixed the vulnerabilities and provided patches, but the underlying issues with security software design and vulnerabilities being exploited by attackers suggest a more permanent nature of the software failure incident.
Behaviour omission, value, other (a) crash: The articles do not specifically mention a software failure incident related to a crash where the system loses state and does not perform any of its intended functions. (b) omission: The software failure incident mentioned in the articles is related to the omission of performing its intended functions. For example, the vulnerabilities found in Symantec's security software allowed attackers to exploit the system without the victim needing to interact with the malicious file or link, compromising the victim's machine [44658]. (c) timing: The articles do not mention a software failure incident related to timing, where the system performs its intended functions but at the wrong time. (d) value: The software failure incident discussed in the articles is related to the system performing its intended functions incorrectly. In this case, the vulnerabilities in Symantec's security software allowed attackers to gain remote-code execution on a machine, potentially compromising an entire enterprise fleet [44658]. (e) byzantine: The articles do not specifically mention a software failure incident related to a byzantine behavior where the system behaves erroneously with inconsistent responses and interactions. (f) other: The other behavior described in the articles is the security software, which is supposed to protect critical systems and data, becoming the biggest vulnerability and liability in those systems. This highlights a critical failure in the security software's design and implementation, making it an attack vector for intruders to seize control of a victim's system [44658].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence, other (a) death: There is no mention of people losing their lives due to the software failure incident in the provided article [44658]. (b) harm: There is no mention of people being physically harmed due to the software failure incident in the provided article [44658]. (c) basic: There is no mention of people's access to food or shelter being impacted because of the software failure incident in the provided article [44658]. (d) property: The software failure incident impacted people's material goods, money, or data as attackers could gain remote-code execution on a machine, potentially compromising an entire enterprise fleet [44658]. (e) delay: There is no mention of people having to postpone an activity due to the software failure incident in the provided article [44658]. (f) non-human: Non-human entities were impacted as the security software, which is supposed to protect critical systems and data, became a vulnerability and liability, potentially allowing attackers to seize control of a victim's system [44658]. (g) no_consequence: There were observed consequences of the software failure incident, such as serious vulnerabilities being uncovered in Symantec's security software products [44658]. (h) theoretical_consequence: There were potential consequences discussed, such as the security software being an ideal target for attackers due to its trusted code and high privilege levels, but it is unclear how actively hackers exploit these vulnerabilities [44658]. (i) other: The software failure incident led to a loss of trust in security companies like Symantec, requiring them to do more than just release patches to regain the trust of customers [44658].
Domain finance The software failure incident discussed in the articles is related to the **(h) finance** industry. The incident involved critical vulnerabilities found in Symantec's suite of anti-virus products, which are crucial for protecting systems and data in various financial institutions and organizations [Article 44658].

Sources

Back to List