Tuesday, August 28, 2007 11:00 AM PDT
Symantec Tuesday unveiled the 2008 editions of its Norton AntiVirus and Internet Security desktop protection products, adding what it calls "threat interceptor" defense to prevent execution of malicious code enabled through a drive-by download.
Used by consumers and small businesses, Norton AntiVirus 2008 and Norton Internet Security, which includes the antivirus capability plus a desktop firewall and host-based intrusion prevention, will now be able to block drive-by downloads from Web sites where visitors with unpatched computers can easily be infected and their machines compromised. Symantec's 2008 edition security products are designed to run on Windows XP Service Pack 2 and Windows Vista.
"There are multiple infection vectors for drive-by downloads, both Web sites where malicious code is deliberately posted and legitimate Web sites that have been compromised," noted Ed Kim, director of product management at Symantec's consumer division.
One striking example of this was the compromise of the Web sites of Dolphin Stadium and the Miami Dolphins in advance of the Super Bowl football game last winter when Web site visitors encountered drive-by downloads intended to take over their desktop machines.
Kim pointed out that unpatched Web browsers aren't the only means that drive-by downloads exploit to dump malicious code on Web site visitors.
"Hacks are becoming highly focused not only on Web browsers but on third-party applications as well, such as Adobe or QuickTime," he said. Failure to stay completely up to date on software patches can provide the hole for drive-by downloads to slip through.
The threat interceptor technology -- branded as Browser Defender -- works by inspecting function API calls to execute what might be a malicious attack, and proactively blocking them. Kim said in most cases this would still allow the user to continue browsing the Web site, but in some instances it might cause a delay as threat interceptor blocks code execution. "Generally, you'd get a quick notification that we detected an attack," said Kim.
The threat interceptor technology is not included in today's versions of Symantec's corporate antivirus and Internet Security software, but Symantec's history of product rollouts has often entailed adding capabilities introduced in consumer products to corporate editions. Symantec didn't disclose whether that would occur as regards threat interceptor.
Other security upgrades to Norton Internet Security 2008 (but not Norton AntiVirus 2008) include a password-protected encrypted store for sensitive information, such as credit card numbers and addresses. Called Norton Identity Safe, the functionality prevents autofill on a Web site until the Web site's validity is first checked, and allows a "card metaphor persona" for business and personal use. It's also intended to prevent keystroke loggers from stealing sensitive data.
Symantec says other improvements for both Norton Internet Security and Norton AntiVirus entail reducing scan time on a 1GB file from 2 minutes and 15 seconds in the 2007 editions to 1 minute and 55 seconds for the 2008 edition. Norton also says it has shrunk Norton Internet Security 2008 down to 10MB from what was closer to 15MB in earlier editions.
Symantec is also releasing a beta of an upcoming Norton Smartphone Security product for the Windows Mobile and Symbian platforms, which is expected to be generally available in the fall.
- Ellen Messmer, Network World
Comments