Symantec Hides Rootkits In Software

Consumer Affairs
Jan. 19, 2006

What's worse than finding spyware and viruses on your computer? Finding out that the software you use to keep your computer safe may be just as dangerous.

Symantec, makers of the popular Norton AntiVirus protection software and numerous other products, routinely hides a "rootkit" in its Norton SystemWorks program suite.

The rootkit was designed to prevent SystemWorks users from mistakenly deleting files necessary to run the program suite, but the rootkit also hides the files from antivirus scans. Clever hackers could use the security hole to upload viruses into a computer without being detected.

Symantec issued a patch to the software on Jan. 10 that would enable users to see the hidden files. In a statement, the company said that it "is not aware of any attempts by hackers to conceal malicious code in the…folder. This update is provided proactively to eliminate the possibility of that type of activity."

The rootkit was detected by Windows software architect Mark Russinovich and a team from Finnish security experts F-Secure.

Russinovich is credited with exposing the hidden rootkits in Sony BMG's copy-protected CDs. The Sony rootkits installed on users' computers without their consent, and could lead to numerous hardware and security flaws.

Russinovich has said that the usage of rootkits by commercial companies is "very worrisome."

"When you use rootkit-type techniques, even if your intentions are good, the user no longer has full control of the machine," Russinovich said in an interview with eWeek. "It's impossible to manage the security and health of that system if the owner is not in control."

Federal judge Naomi Rice Buchwald gave tentative approval on Jan. 12th to a settlement in one of the many lawsuits filed against Sony over the rootkits. The settlement terms included offering cash payments or free music downloads to buyers of the affected CD's, and prevents Sony from selling any CD's with copy-protected software until 2008 at the earliest.

Lawsuits filed by Texas Attorney General Greg Abbott and the Electronic Frontier Foundation against Sony are still going ahead.