<story><title>Symantec/Norton Antivirus Remote Heap/Pool Memory Corruption CVE-2016-2208</title><url>https://bugs.chromium.org/p/project-zero/issues/detail?id=820</url></story><parent_chain><item><author>technion</author><text>It&amp;#x27;s high time some of these compliance groups got together and had a good hard look at themselves.&lt;p&gt;It&amp;#x27;s been years since desktop signature-based antivirus provided a significant improvement to security. Every time there&amp;#x27;s a cryptolocker outbreak, I see people scrambling to make decisions like &amp;quot;we need to replace McAfee with Kaspersky&amp;quot;, as though they feel that&amp;#x27;s their answer.&lt;p&gt;When you try telling an insurance auditor &amp;quot;we have a whitelisting application, nothing runs unless I&amp;#x27;ve approved it, products like Symantec Endpoint are unnecessary in that environment&amp;quot;, you first get a confused look, then you hear &amp;quot;ok, so you&amp;#x27;re DON&amp;#x27;T meet the minimum basic security requirements, let me write that down&amp;quot;.&lt;p&gt;It&amp;#x27;s gotten to a point that it&amp;#x27;s actively part of Intel Security&amp;#x27;s advertising, with a recent partner promotion pushing to &amp;quot;help your clients meet their compliancy requirements&amp;quot;. The brochure never even mentioned actually securing anything, just how it ticked various boxes.</text></item></parent_chain><comment><author>pilif</author><text>This is actually a real problem we need public perception changed. If you have proper white-listing in place then AV does nothing but actually decrease the security as these AV programs probably need to be white-listed and thus expose the machines to the kinds of issues as shown here.&lt;p&gt;Unless the compliance auditors are happy with the software just being installed and don&amp;#x27;t check whether it actually runs. That would still be a colossal waste of money for the licenses but at least it would not compromise your security.</text></comment>
<story><title>Symantec/Norton Antivirus Remote Heap/Pool Memory Corruption CVE-2016-2208</title><url>https://bugs.chromium.org/p/project-zero/issues/detail?id=820</url></story><parent_chain><item><author>technion</author><text>It&amp;#x27;s high time some of these compliance groups got together and had a good hard look at themselves.&lt;p&gt;It&amp;#x27;s been years since desktop signature-based antivirus provided a significant improvement to security. Every time there&amp;#x27;s a cryptolocker outbreak, I see people scrambling to make decisions like &amp;quot;we need to replace McAfee with Kaspersky&amp;quot;, as though they feel that&amp;#x27;s their answer.&lt;p&gt;When you try telling an insurance auditor &amp;quot;we have a whitelisting application, nothing runs unless I&amp;#x27;ve approved it, products like Symantec Endpoint are unnecessary in that environment&amp;quot;, you first get a confused look, then you hear &amp;quot;ok, so you&amp;#x27;re DON&amp;#x27;T meet the minimum basic security requirements, let me write that down&amp;quot;.&lt;p&gt;It&amp;#x27;s gotten to a point that it&amp;#x27;s actively part of Intel Security&amp;#x27;s advertising, with a recent partner promotion pushing to &amp;quot;help your clients meet their compliancy requirements&amp;quot;. The brochure never even mentioned actually securing anything, just how it ticked various boxes.</text></item></parent_chain><comment><author>nihonde</author><text>As a lawyer who deals with contracts, one of my major pet peeves is the stupid warranty that requires a party to use &amp;quot;industry-standard virus detection software&amp;quot;. I&amp;#x27;m fairly certain that none of the lawyers who insist on that language know anything about IT security.</text></comment>