Symantec explains PIFTS and debunks conspiracy theories (Update)
by Steve Ragan - Mar 10 2009, 20:25
Interested in a more interactive TTH? Join our Facebook Group
Want regular updates from The Tech Herald? Follow us on Twitter
Talkback
Add your comment (no registration required)
page: 1 2
If it is a legitimate patch, then why:
1) The file itself is designed specifically to send usage history (In the form of Internet Explorer history files, Temporary Internet Files, and Google Desktop information) to 2 private servers: One owned by Microsoft and the other owned by a Washington-based corporation known as 'SwapDrive'. This in and of itself is a breach of our privacy and should be explained immediately.
2) An inconsistency I noticed with the .exe in question was the fact that it has a very curious amount of padding. Padding is often used in cracking and hacking to force an .exe file to match the expected size of the program. However, why would you need any kind of padding in an official .exe from Symantec? Also, there's a lot of nonsense strings in the file; anything from the days of the week to the alphabet. Which tells me you're using even MORE padding.
@Anon
SwapDrive = Symantec
As for the other, ask on their forum and see what they say. They haven't responded to questions about that which were sent over and posted to the forums before. Perhaps they were caught in the backlash and removed.
Symantec's explanation sounds reasonable. They have just holes in their programming standard, which created the problem in the first place, and poor information policy, which allowed the problem to become a large PR-fiasco.
However, not everybody will be as willing to accept Symantec's explanation. This PIFTS.exe is nasty piece of code. It can collect information and send it out, it can recode other programs and it has capacity to be reprogrammed remotely. You have to take Symantec's word that these capabilities were intended to the purpose Symantec is telling us. I believe Symantec, because the whole thing was so badly implemented that I cannot believe that the purpose was to build a spy platform for a sinister purpose.
Regards, 'A user who lost a lot of time in this farce'
Then why the takedowns at digg and google?
We have gone from denial mode to plausible deniability mode. Someone who actually knows how to handle situations like this and is aware of the Streisand effect has taken over. We won't get any more intel out of them trying to hide things and will have to dig in with what we have got.
It was noted across many reputable blogs and websites that PIFTS.EXE threads on Norton's forums were removed prior to the patch being pulled or the spam raid on their support forums.
It has even been suggested that the spam raid was incited by the lack of information about the PIFTS.exe file in the first instance.
Adding to the fact that the questions regarding the file were pulled that the file itself scans internet history, cookies and Google Desktop and sends what it finds to 2 servers in Washington (67.134.208.160/n/ being one of them), why DIGG, Google and Yahoo! Answers all altered their usual parsing of the information and you have enough smoke to start the pitchfork crew yelling and claiming conspiracy. NOt to mention that it appeared in 'newer' versions than this article claims.
A direct answer explaining what the file does would certainly restore my faith in the company - which in turn may help shape what information I give out to others regarding it's security usage.
So 4Chan discovered Pifts in the 3 hour window of opportunity and spammed Symantec's message boards with messages referenceing it?
That is extremely hard to swallow.
Symantec would have been much better off saying someone made a bad judgement call and violated policy by deleting posts.
Are they such bad developers that a single message from a unique IP gets you banned during a flood from some other IP.
No matter how you spin this they are a candidate for the Electrolux big suction award.
They actually expect us to believe this? They scapegoat anonymous, give a vague explanation of the program, and everyone buys it? I don't want my history files sent to anyone, especially not the giant corporation that agreed to cripple its own software to assist in the violation of our constitution. Symantec can go to hell.
It's true, posts were being deleted long before 4chon discovered it. So now anon takes the wrap and symantec walks home freely. What a load of crap.
I have been caught the previous night around 7:10pm PST in the melee and have been witnessing first hand how the drama was unfolding. Thus, I take Mr Cole's explanations of his company's handling to be grossly inadequate and deceitful. I have been witnessing myself how whole threads containing mostly legitimate posts by concerned Symantec users have been repeatedly wiped out. That was the only response from the Symantec to the problem that was causing concern possibly to thousands of their customers! Company's employees in charge were acting as if the PIFTS.EXE fiasco caused panic in their ranks.
Symantec's disgraceful handling of what could have been a non-event convinced me to uninstall all Norton-Symantec products from my computer.
Professor Mariusz Wodzicki
Department of Mathematics
University of California
Berkeley
Once again Symantec have chosen to not tell the entire truth of what happened on the forums.
There was a fairly long thread, with several dozen replies and thousands of views from customers enquiring why something Symantec had sent them was tripping off security alerts. This was several hours before the spamming started, this post was ignored by Symantec and then deleted, without one abusive, or spam post ever being made. The deletion of this thread was then queried and this thread too was deleted without explanation...
Unfortunately it snowballed from there, Symantec refused to comment and the only feedback customers who were legitimately querying this problem on the forums were getting was that their posts were deleted and they were banned.
Only after a few hours of this did Anonymous get involved. Symantec has consistently failed to mention that it was over 12 hours from the first alert and question to them making any form of statement.
This is atrocious customer service and the heavy handed way they dealt with queries only led to fan the flames of the conspiracy fire.
Symantec made a massive mistake and are doing everything they can to shift the blame from themselves.
I have lost trust in this company, I wonder how many other customers have now decided not to re-new their subscriptions due to this poor customer service.
page: 1 2
Add your comment (no registration required)
Comment on this Story