You are here: silicon.com > Software > Security Strategy

Security Strategy

Hacker hidey-hole found in Symantec product

Hidden directory now seen as a risk

Tags: flaw, hacker, security flaw, symantec

By Joris Evers

Published: 12 January 2006 08:15 GMT

Symantec has released an update to its popular Norton SystemWorks to fix a security problem that could be abused by cyber criminals to hide malicious software.

In the PC-tuning application, a feature called the Norton Protected Recycle Bin creates a hidden directory on Windows systems. The feature is meant to help people restore modified or deleted files but the hidden folder might not be scanned during scheduled or manual virus scans, Symantec said in an advisory released on Tuesday.

The security giant said: "This could potentially provide a location for an attacker to hide a malicious file on a computer," adding it is not aware of any attempts by hackers to conceal malicious code in the folder. "This update is provided proactively to eliminate the possibility of that type of activity," it said.

Symantec's alert has echoes of Sony BMG Music Entertainment's recent PC security fiasco. The record label was found to be shipping copy-protected CDs that planted so-called rootkit software on the computers that played them. The rootkit technology also offered a hiding place for malicious software.

When the recovery feature was first introduced, hiding the directory helped ensure a user would not accidentally delete the files in it, Symantec said.

The company said in its advisory: "In light of current techniques used by malicious attackers, Symantec has re-evaluated the value of hiding this directory."

Security monitoring company Secunia rates the issue "not critical". Symantec itself deems the risk impact "low".

Symantec credits Mark Russinovich, the Sysinternals researcher who also investigated the Sony rootkit, and F-Secure, a Finnish security company that has a rootkit detection product, for helping it address the SystemWorks issue.

The Norton update will display the previously hidden "NProtect" directory in the Windows interface, which will allow it to be scanned by antivirus products, Symantec said. The new version is available through the Symantec LiveUpdate service. Installing the software will require a system reboot.

Joris Evers writes for CNET News.com

  1. Zones
  2. Management
  3. Networks
  4. Software
  5. IT Services
  6. Hardware
  1. Verticals
  2. Public Sector
  3. Financial Services
  4. Retail & Leisure

  • Jobs
Audio Recognition / C++ - Music Industry - London

Music Industry. My client is a web-based service for Broadcasters, Producers and Music Distributors are looking to recruit a web developer. This ...

Technical Manager needed - Music Industry - London

Music Industry. An interest in music would also be advantageous. This company is in the music industry and is based in the heart of Londons westend. ...

Desktop Field Engineer-IT Giant-25-30,000 South of London

There is now the opportunity for an experienced desktop engineer to join this hugely successful organisation; they are Microsoft Gold partners and ...

CIO50 2008
The silicon.com CIO50 2008 profiles the most influential and innovative tech chiefs in the UK across all industries and organisation size, from the biggest FTSE100 companies to high growth dot-com start ups and the public sector. The list was voted on by the UK CIO community and a panel of experts. Find out more in our latest special report.





Quick Sitemap Links: