Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Symantec defiant after New York Times hackers evade antivirus defences

Only one Trojan detected, newspaper said

Article comments

Symantec has offered a carefully-worded but defiant response to the news that one of its customers, the New York Times, was attacked by Chinese hackers with barely any intervention from its software.

Earlier today, the newspaper revealed that hackers probably connected to the Chinese military had spent four months trying to hack into the email accounts of dozens of its journalists, entering the network via compromised PCs.

Forensics carried out by the paper’s security consultant Mandiant showed that the weapon of choice was 45 pieces of targeted Trojan malware, only one of which was detected by the installed Symantec antivirus software.

Clearly sensitive to the issue, Symantec’s response has been to issue a statement implying that such sophisticated attacks could only be stopped using a layered security approach.

"Advanced attacks like the ones the New York Times described in the following article, underscore how important it is for companies, countries and consumers to make sure they are using the full capability of security solutions,” read a statement.

“Turning on only the signature-based anti-virus components of endpoint solutions alone are not enough in a world that is changing daily from attacks and threats.”

Symantec did not say whether the New York Times had access to those extra layers of security, nor why they would not have been configured if they had. Signature-based AV remains the core of most endpoint security.

It is unlikely that either side will want to be drawn into an embarrassing public argument and so no more will likely be heard of the matter.

Commenting on the hacks, BAE Systems Detica’s Cyber Security MD David Garfield agreed that endpoint monitoring was no longer sufficient to protect organisations from targeted Advanced Persistent Threats or APTs that use Advanced Evasion Techniques (AETs) to hide.

“Organisations shouldn’t ask what their security tools are telling them, but ask what they are not telling them; that can only be done by monitoring and analysing their networks for evidence of compromise,” he advised.

The question, then, is less why Symantec's software didn't spot the attacks but how any conventional antivirus software could do a better job under the same pressure.


More from Techworld

More relevant IT news


Mike_Acker said: those who follow hacking already know that malware kits are carefully obfuscated disguised and tested and then certified -- to be not detected by popular AV packagesso if you are using an OS that allows application programs -- such as browsers Java Flash email -- to update your os -- then you will be toast as soon as the hackers get around to you if you are using Windows be sure you are at Windows7 with UAC set at always notify you would tell your people to never accept any updates a better idea would be to add AppLocker -- from MSFT and take control over what is allowed on your computers or start using Linux Remember after Google got hacked back in 2010 -- that is what they did Today polymorphic virus are the norm these render the traditional AV obsolete you cannot search for something when you do not know what it looks like

Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *