Symantec Update Battles Worms, Phishing

Among the titles that the Cupertino, Calif.-based company is updating are the popular Norton AntiVirus, as well as Personal Firewall and AntiSpam. The three will also appear in the 2005 edition of Symantec's Internet Security suite.

The biggest addition to Symantec's flagship Norton AntiVirus is a new feature dubbed "Internet Worm Protection," which borrows port blocking technology from Personal Firewall to worms that sniff out vulnerabilities by scanning IP addresses for open ports.

"It used to be that worms were like the thief who tries the front door, and if it was locked, goes on to the next house," said Bill Rosenkrantz, group product manager at Symantec. "Now they're trying the front door, the windows, and the chimneys. And they're dressed as cable repair people to get in."

Internet Worm Protection blocks inbound ports for both known and suspected exploits, said Rosenkrantz, stopping the former via signatures that can be downloaded automatically into AntiVirus, stymieing the latter via heuristic scanning that looks for any exploit attempting to get onto a machine via a known vulnerability.

"The threat environment has significantly changed in the last year, and we wanted to include this to provide consumers with baseline protection," said Rosenkrantz.

A number of major security outbreaks in the last 12 months have been caused by worms that don't arrive via e-mail, but instead spread by searching for vulnerable machines on a network. Among the most dire were MSBlast of 2003 and Sasser of 2004, both of which exploited vulnerabilities in Microsoft's Windows.

Norton Personal Firewall 2005 and Norton AntiSpam 2005, meanwhile, have added features to protect users from phishing attacks in which e-mailed links lead to spoofed URLs.

In Personal Firewall, the new tool lets users create a "whitelist" of trusted Web sites to which confidential information -- such as credit card or bank account numbers -- can be transmitted without interruption. Firewall, however, now alerts users when such data is sent to sites not on the trusted list.

"About 75 percent of the threats in the last 12 months have been privacy related," said Rosenkrantz, including phishing attacks and Trojans which open back doors to load key loggers that steal confidential info. The features in Personal Firewall and AntiSpam are a reaction to the growing privacy threat, he added.

AntiSpam's new anti-phishing feature scans incoming e-mail for faked URLs, then quarantines those messages as it does traditional spam. "There is a very standard set of malformed URLs that most phishers use," said Rosenkrantz. Like other Symantec consumer/small business products, AntiSpam will be kept up-to-date as new phisher spoofing tactics appear.

The Norton Internet Security 2005 bundle, which includes AntiVirus, Personal Firewall, and AntiSpam, now includes an Outbreak Alert feature that warns users when a major threat is developing.

"When there's been a category '3' or '4' outbreak," said Rosenkrantz, referring to the 1 through 5 threat label that Symantec slaps on viruses and worms, "users gets an alert on the desktop that offers a 'Fix Now' option." Clicking on the Fix Now connects to Symantec's Web site, and downloads a set of changes to, for instance, block the necessary port being used by the worm, without the end user having to manually make modifications. By Symantec's count, there have been two dozen such outbreaks this year.

Rosenkrantz said that Symantec's goal is to slash the reaction time between the discovery of a threat and protecting a PC. "We want to protect as much as possible as quickly as possible," he added.

Norton AntiVirus 2005, which will sell for $49.95 at retail, is scheduled for release later this month. The $49.95 Norton Personal Firewall 2005, $39.95 Norton AntiSpam 2005, and $69.95 Norton Internet Security will be available in mid-September.

Recognizing that many homes and small businesses using this lineup have multiple machines, Symantec will also debut Home Packs for both AntiVirus and Internet Security that allow installation on up to three PCs. The Home Packs' pricing will be $89.95 for AntiVirus and $119.95 for Internet Security.