Symantec to Acquire SecurityFocus

cbv writes "Symantec Corp. today announced the acquisition of SecurityFocus for approximately US$75 million in cash. The press release reads, 'With this acquisition, Symantec will offer customers the most comprehensive, proactive early warning system across the broadest range of threats.' The transaction is expected to close by early to mid-August 2002."

Conflict of Interest?

Will we be seeing more minor security issues inflated to cataclysmic proportions just so Symantec can sell a few more virus scanners?

Re:Conflict of Interest?

I'd be more worried about them *NOT* releasing some security issues of those 800 pounds gorilla that promotes security through obscurity instead of writing safer code.

Symantec is a corporation after all. If let's say, a certain company would cut them vital information required for the lowlevel of the system so that their antivirus technology work effectively (on their future OS), well I can see a very *VERY* persuasive effort that could just work.

I am happy for the people at security focus if it pays off their hard work, but I am worried about the quality and most importantly, the neutrality of the service that will result from this acquisition.

What Aleph1 has to say...

From: [e-mail] [mailto:[e-mail]]
Sent: Wednesday, July 17, 2002 5:28 PM
To: [e-mail]
Subject: Administrivia: Symantec acquiring SecurityFocus

Good day,

Today, SecurityFocus and Symantec announced that Symantec is acquiring
SecurityFocus. Symantec sees real value in the services SecurityFocus
provides to its customers and believes they are an excellent fit with
their current offerings. We at SecurityFocus see this as an opportunity to
provide even better services for the security community.

Symantec recognizes the value and uniqueness of the public services
SecurityFocus provides to the community, such as the numerous mailing
lists we host and the content we provide via the SecurityFocus Online web
site.

In particular, Symantec and SecurityFocus want to ease any fears as to
whether the character of this mailing list will change.

Frequently Asked Questions:

Q. What is the Symantec strategy for keeping data sources?

A. We believe it is critical to maintain the integrity of the existing
security community currently part of the SecurityFocus portal and
Bugtraq mailing list.

Q. What is Symantec's disclosure policy?

A. Symantec believes in responsible vulnerability disclosure and is active
in initiatives to set best practices in this area. Our first priority
is to help our customers protect their computing assets by providing
tools and information to safeguard their systems.

We will work with vendors, if we discover vulnerabilities in other
products, to report and investigate the issue in a thorough and timely
fashion, in the same way that Symantec will work with other security
researchers if they find an issue with any Symantec technology.

We observe a 30-day grace period after the notification of a security
advisory to give users an opportunity to apply the patch. During this
grace period, we provide our customers significant information about
the vulnerability and the fix, but not step-by-step instructions for
exploiting the vulnerability. We do not provide detailed exploit code
or provide samples of malicious code except to other trusted security
researchers and in a secured manner.

Q. Will Symantec change SecurityFocus' vulnerability reporting policy?

A. We believe that in order for the SecurityFocus/Bugtraq community to be
effective, it must be an independent entity. We believe that its
current disclosure policy is appropriate for the venue. Symantec will
continue to operate with its separate disclosure policy.

Sincerly,
Elias Levy, David Ahmad,
and the rest of the SecurityFocus staff

Aleph1; and, all good things come to an end.

We believe that in order for the SecurityFocus/Bugtraq community to be effective, it must be an independent entity. We believe that its current disclosure policy is appropriate for the venue. Symantec will continue to operate with its separate disclosure policy.

Pretty words, Mr. Levy and Mr. Ahmad. Now where is the proof?

Those of us who are working journalists remember the transition of ABC News under Roone Arlege from Cronkite-esque "news" to "entertainment" -- and know that "independence" is a very fragile concept, one that can be crushed very quickly and with little fanfare at any level including the board room. All it takes is one vote of no-confidence on the part of the management to completely change the editorial head, and thus the independence of SecurityFocus. You most likely mean well -- can the same be said of your bosses? Can you point to one Symantec acquition that proved that editorial independence has been achieved in the long run?

I was an expert witness at a multi-million dollar trial because a well-respected computer magazine's editorial staff prostituted themselves to shore up a bad space-sales management decision. It only takes one episode to sully the good name of a publication. (The name of the publication is withheld from public statement to protect the guilty and to keep me out of civil court for defamation.)

I'm happy you were able to get a pile of money, but don't think that SecurityFocus will be viewed the same way. Now, if you had made the sale to an outfit like O'Reilly, the SecurityFocus name would have retained its luster and elan in the industry.

All good things must come to an end. Thanks for all the fish.

Prediction!

Prediction: Symantecs products are going to suddenly become very secure.

Loss of credibility

This buyout (sellout?) makes the site a lot less credible in my opinion. They are simply going to use the site to sell more virus protection software.

Countdown.....

Countdown until Rob Rosenberger [vmyths.com] has a nervous breakdown begun... 10 ... 9 ... 8 ... 7 ...

Cash?

Isn't it safer using a credit card?

symantec will NEVER be secure

their products will never be secure as long as they do not detect the fbi's spy software.

The end of the best security related mailing list?

I've always had followed closely the bugtraq list, and I belive strongly it's cutting edge anything goes security ... wonder how the Symantec staff would moderate it

What kind of intentions?

I wonder what kind of intentions Symantec has here. If they want to use SecurityFocus as a well-known security company to help make their products better, or if they just want them for the name. Consider "Tommy Boy"...

I think they'll need new servers....

The contest is on...

Which will be worse, the slashdot effect or the mass unsubscribes pounding the mailing lists??

I'm glad I have Junkbuster

I hate going to any symantec website. Their web pages reek of ads for different products. I'm glad I use Junkbuster to block all of them.

And I'm doubly-glad I use mozilla to stop those damn pop-ups.

And SecurityFocus.com was a great site... I can only hope Symantec doesn't run it into the advertising ground.

Cool but come on......

"With this acquisition, Symantec will offer customers the most comprehensive, proactive early warning system across the broadest range of threats." How long do you think it will take befor an update is released for it after it is released? 5 10 mins? the most! Some one is going to be able to get through it just like everyone else.

Full Disclosure Mailing List

There was a new list started about 2 weeks ago, directly because of this potential issue:

Here was the announcement:

Subject: Announcing new security mailing list

We are pleased to announce the creation of a new security mailing list
dedicated to FULL DISCLOSURE. When Scott Chasin handed over the bugtraq
mailing list, it was clearly dedicated to the immediate and full
dissemination of security issues. The current bugtraq mailing list has
changed over the years, and some of us feel it has changed for the worse.

If you believe in full disclosure, and wish to participate in unfettered,
and unmoderated discussions, please feel free to subscribe to the new
mailing list by accessing http://lists.netsys.com [netsys.com]

I don't trust that list either...

The "announcement" of the Netsys list's creation was spammed [google.com] to everyone who's posted to BugTraq lately. Let's see: unsolicited, bulk, advertising something, and sent to email addresses scraped from a webpage or mailing list. In my world, that's spam. What's worse, the list's owner - Len Rose from Netsys - said that people who were unhappy about the spam were "lunatic diehards" [google.com]. He then proceeded to tell one of them in particular to, quote, "FOAD."

I don't trust a spamming pompous ass to run a security list any more than I trust Symantec to do it. I'm sorry, but Netsys really dropped the ball on this one; I'm not about to hand my email address over to them.

Shaun

Rumours of NAI/McAfee acquisition discussions with

What's REALLY interesting is I've heard that NAI/McAfee have been in acquisition discussions with Symantec.

So, Symantec buys SecurityFocus, NAI busy Symantec, and boom, overnight you have a huge amalgam of one-stop Security and Anti-Virus.

Jeez, kinda scary. No?

--jordan

I read that as...

"Symantec To Aquire Bugs"

the broadest range of threats?

With this acquisition, Symantec will offer customers the most comprehensive, proactive early warning system across the broadest range of threats.

Does that include threating emails from ex-girl freinds?

Cause if soo Sign me up!

Not Sure What To Make Of This

So, a company that I do not fully trust when it comes to acurate, honest security reporting purchased a forum (company?) which I do trust on those same matters.

I don't really know what to say. It'd be like Ford buying Volvo or something. Oh, wait . . .

The new BugTraq

REALLY BAD SECURITY VULNERABILITY EXPOSED

DATE: July 17, 2002

AFFECTED SYSTEMS:

All systems for which Symantec sells products.

DESCRIPTION:

Holy Fucking Shit!! The computer just, like, explodes! It's the end of the world!

WORKAROUND:

Install Norton Anti-Virus. If you already have Norton Antivirus installed, buy another copy and install it. That'll fix it, we promise.

Re:The new BugTraq

While exaggerated, I think your post is probably and example of the future of any mailing list done by SecurityFocus. Sad. Symantec always seemed cheap and sleezy to me while SecurityFocus at least tried to be legitimate.

With this purchase, SecurityFocus' credibility (at least with me) has gone out the window. I can't see how they can continue to be credible when they've got a company in charge that ONLY cares about the bottom line. Just look at their irresponsible virus warnings (as you've so clearly demonstrated). Boooooo!

Another free service turned pay-based

There goes another usefull service being prostituted by corporate morons with a MILK THE MASSES mission statement, I guess well have to use another means of information :D

this is the company that would allow magic lantern

Hmmm, this reminds me of something, lets see....

Ahh, Symantec pledges to acquiese to FBI backdoor demands [politechbot.com]

This is a real problem and needs to be addressed.

Has Symantec policy changed with respect to things
like magic lantern and so forth?

bugtraq. Poof.

Well,

I'm sure SecurityFocus will suck by the time they are done with it.

(Sorry if this is trollish but it just seems like things get worse when an outside company aquires something useful.)

Bad news...

for all the information security community. Some of the probable effects have already been discussed in other postings:

1. Would we believe the seriousness of virus threat anouncements? (BTW, please see the interesting musings of Bruce Schneier in the last issue of CRYPTO-GRAM [counterpane.com].
2. Would we believe in the security of Symantec's products?
3. Would Symantec take advantage of first hand information before releasing it to public knowledge?

Even if bugtraq keeps its objectivity (and what a big "if" is that!), doubt will ever remain. A critical resource for the security community has been lost, at least because of the lack of credibility in the new owners.

Where is Symantec headed?

This is interesting news. It is a loss to the security community at large, since securityfocus was such a great resource, although once they went commercial it lost a lot of its appeal to me. Symantec is really positioning itself to be the M$ of security here. About 8 months ago, I was at a meeting with some of their top Sales and Product Dev. folks, and they presented their offerings roadmap. It included an appliance which would:

Serve as a FW/VPN

Act as a network IDS

Serve as a management console for Host IDS

Act as the A/V Manager
Because they have agents installed on every machine when you run Intruder Alert, NAV, or other tools, it would allow them to sync up the status of a host, network, etc. with the mothership at Symantec-Focus, and determine in real-time what devices are vulnerable. This is kind of cool in concept but not easy in execution.

My concern is that they already have bought other products, which are completely jacked up and are still not fixed. I spent my Thanksgiving morning last year doing a disaster recovery on a Symantec Intruder Alert System...what a mess that product is...where is the high availability, the fault tolerance, etc.? Again...cool concept, crappy execution.

This merger puts Symantec in direct competion with folks like eSecurityOnline, and I can tell you that for people already in bed with Symantec who have legal obligations to stay on top of vulnerabilities (e.g. Banks) this makes it a one stop shop for them. I see it as a conflict of interest. They should buy a couple of pen-test companies while they're at it and they can even validate their product implementations are secure ;)

Depressing..

Not that I have anything against Symantec, but it depresses me to see a great resource such as SecurityFocus acquired by a company that notoriously blows the very thing people look to SecurityFocus to provide out of proportions.

Awsome!

Now Symantec can screw up SecurityFocus like they've screwed up everything else that was useful until they bought it!

Sorry for the flamebait, but I've bought too many Symantec products over the years, and they seem to get worse with every revision. I remember when Norton Utilities was something beneficial, now I refer to that package as Norton Anti-System.

Other fun past experiences with Symantec products have included Act, which was a big pile of poo, and WinFax, which was pretty good last time I used it, as long as you limited your use to a specific subset of it's advertised functionality.

Are Symantec's interests honest?

If Symantec wishes to maintain the bugtraq in similar fashion as it presently exists, why would they shell-out 75 million dollars when they could have just perused the site fo' free?

Next is dotSymantec, subscribe for yearly fee to get AntiVirus software, updates, and security advisories...The Internet is beginning to suck, I'm going back to the library, some of those are still FREE!

It doesn't matter

If they believe they just need to shell out 75 million dollars for a stinking mailing list in order to contral an important part of the world's infrastructure, they are idiots.
Getting something to work like bugtraq technically is absolutely no problem. A mailing list with 30000 subscribers, ok let it be 300000, isn't voodoo.
The "selling point" of bugtraq is/was the trust many people have in them, the people which post there, their policy. If anything would cause people to mistrust them, it needs just one trusted guy from the security community to start a new list, and bugtraq is dead. I've even read a post that one alternative has already started.
If someone like Dan Farmer, Wietse Venema or, for the hell of it, Bruce Schneier decided to start a bugtraq clone, the original would not stand a chance if its reputation had already been damaged.

Symantec sells more than JUST anti-virus crap

As if they were the enemy or something...
the enemy is NOT microsoft nor virus authors.
the enemy IS those ignorant programmers that have no idea how to test their code to see if the CODE is vulnerable...

Symantec taking over should have little effect on the amount of product they sell. They are simply heading into a new market and doing so by purchasing the leader in that market. By being ready for what may come, they can better attack the problems when they arrive and better serve their customer base.

--Huck

Editorial Independance

At the company-wide meeting about the acquisition, Symantec president John Schwarz said repeatedly that Symantec is committed on the highest levels to keeping the SecurityFocus Web site [securityfocus.com] alive, and editorially independant. A written policy will set this out explicitly in the weeks to come.

Re:Editorial Independance

"Editorial independance" (sic) lasts only as long as they don't get sued by Micro$oft over some trivial little exploit that gets posted on SecurityFocus. After that, "independance" goes out the window, and the answer is "how high?" (IYKWIM).

Argh!!!

They (the list administrators for securityfocus.com) have sent me this about a billion times now- one copy to each list I subscribe too. Then I check slashdot for a break from all the email spam and there it is again..

So I guess that means that Symantec has acquired SecurityFocus. I also heard that Symantec has acquired SecurityFocus. And in related news, yeah, you guessed it- Symantec has acquired SecurityFocus.

Packetstorm.....

Yeah this really is depressing. However, another site I like in case any of you are unaware is Packetstorm [packetstormsecurity.org]. I like it a lot and so far it hasn't sold out. :-(

How to tell if they are cheating...

Symantec claims that it SecurityFocus will still be "independent". It's possible, but unlikely. The true test will be how often a vulnerability shows up before Symantec releases a fix.

Other acquisitions

They also acquired Recourse Technologies and Riptech. Symantec corporate [symantec.com]

Symantec also bought Riptech and Recourse!

No kidding! [thestreet.com] Here's Riptech's press release [riptech.com] and Recourse's news [recourse.com]. This follows the purchase of MountainWave [mountainwave.com] earlier this month.

Helevius

Mixed feelings...

While it appears that Symantec will generally leave Bugtraq alone (not that it's been very useful for some time, imho), I don't really trust them.

Let me provide my basis (petty as it may seem): I'm the system administrator at an ISP small enough that I do some of the tech support. I've seen NAV's mail scanner totally screw up peoples' mail settings enough times that I don't think quality is something they emphisize. To make matters worse, this problem tends not to be fixed by a reboot, and NAV will lock the mail server fields in OE (I don't think it can do that in Netscape/Mozilla, but I'm not sure) making it impossible to use the affected mail account without completely deleting it and readding it. Sometimes, disabling and re-enabling mail scanning will fix the problem, but that's not always the case.

I used to prefer NAV over most other virus scanners (and some other Symantec products back in the days of MS-DOS), but I really think they've gone downhill in the past several years. I hope that the same fate doesn't come to Bugtraq--the list has already become bad enough.

Great.

Now I'm terrified.

The company who's tech support told me "Sir, you shouldn't use that program, it's dangerous" when I called, as their customer, to ask how I could remove a so-called 'virus' from the scanning list.

IMHO SecurityFocus sold out

I think we need to start looking for another security site. I don't want one controlled by a large Corp.

This is a sad day :(

Mike

Shameless Plug

SecurityFocus is an excellent asset to the security community and I do hope it manages to retain its journalistic independence through this whole process. I've been running my own small security portal/company the past few years - helps pay the college tuition and all. We do have very thorough daily coverage of news and significant vulnerabilities and the site has a Slashdot-esque feel...URL is in my sig if anyone wants to check it out.

Here are the checks and balances...

The normal "cracker" hates big corporations. If enough crackers realize that every virus they write helps Symantech, they will stop for a while, so Symantech's value to a customer goes down. Symantech will shrink, and security minded people are smart. If security focus is no longer the place to find out about risks, then another source will emerge. The Darwinism of internet communities is great. As soon as one company starts charging for a service, 3 more come out and do it for free, often time learning from the mistakes of the first. Watch this cycle with music sharing. The only music sharing that is viable for more than 6 months at a time is IRC and FTP.

The Announcement on bugtraq ($75M email) verbatim

Good day,

Today, SecurityFocus and Symantec announced that Symantec is acquiring
SecurityFocus. Symantec sees real value in the services SecurityFocus
provides to its customers and believes they are an excellent fit with
their current offerings. We at SecurityFocus see this as an opportunity to
provide even better services for the security community.

Symantec recognizes the value and uniqueness of the public services
SecurityFocus provides to the community, such as the numerous mailing
lists we host and the content we provide via the SecurityFocus Online web
site.

In particular, Symantec and SecurityFocus want to ease any fears as to
whether the character of this mailing list will change.

Frequently Asked Questions:

Q. What is the Symantec strategy for keeping data sources?

A. We believe it is critical to maintain the integrity of the existing
security community currently part of the SecurityFocus portal and
Bugtraq mailing list.

Q. What is Symantec's disclosure policy?

A. Symantec believes in responsible vulnerability disclosure and is active
in initiatives to set best practices in this area. Our first priority
is to help our customers protect their computing assets by providing
tools and information to safeguard their systems.

We will work with vendors, if we discover vulnerabilities in other
products, to report and investigate the issue in a thorough and timely
fashion, in the same way that Symantec will work with other security
researchers if they find an issue with any Symantec technology.

We observe a 30-day grace period after the notification of a security
advisory to give users an opportunity to apply the patch. During this
grace period, we provide our customers significant information about
the vulnerability and the fix, but not step-by-step instructions for
exploiting the vulnerability. We do not provide detailed exploit code
or provide samples of malicious code except to other trusted security
researchers and in a secured manner.

Q. Will Symantec change SecurityFocus' vulnerability reporting policy?

A. We believe that in order for the SecurityFocus/Bugtraq community to be
effective, it must be an independent entity. We believe that its
current disclosure policy is appropriate for the venue. Symantec will
continue to operate with its separate disclosure policy.

Sincerly,
Elias Levy, David Ahmad,
and the rest of the SecurityFocus staff

Linux AV

Now if they would just release a version of NAV for Linux. It would help those of us (most I would guess) who have to suffer WinX crap all day with some Linux mixed in.

Will articles like this continue to appear?...

Past its Prime: Is Anti-Virus Scanning Obsolete? [securityfocus.com]

(If the link stops working, then I guess the answer would be "No".)

Convicted Felons as Employees

This brings up the interesting point of what Symantec will do about employing people with felony convictions. Anyone know what Poulsen is going to do?

Damn. Talk about ambitous...

"With this acquisition, Symantec will offer customers the most comprehensive, proactive early warning system across the broadest range of threats."

I take it that this comprehensive, proactive early warning system offers protection against the broadest range of threats, including hostile air strikes, early warning Surface to Air Missile detection, drive by shootings, nuclear tipped ICBMs and the occasional Gene Simons appearance on TV...? Come to think of it, I could use a product like that. Thanks Symantec!

What's the alternate?

Is there an alternate source? Will Bugtraq still be on there?

In other news...

MSFT today announced the acquisition of Integrity [dictionary.com] for $358 billion(USD).

This follows on the footsteps of several recent corporate buyouts, including the impending $5.8x10^300 (USD) Church of Scientology buyout of Truth [dictionary.com] and Morality [dictionary.com].

Man, I am so glad I'm a fucking trans-national megacorporation. Suckas!

Symantec advertorial?

Editorial independence does not necessarily end if one company buys another. It is premature to assume that the quality of SecurityFocus (however you assess that) will materially change for the worse. Don't jump to conclusions until there is a reason to warrant the charges that are being thrown around.

That said, if Symantec simply wanted to support the growth and dissemination of security-related information it could have paid for ads and provided technical resources to SecurityFocus, (however much that may have spurred charges of bias or interference) instead of buying it outright.

The acquisition legitimately raises questions of conflict of interest.

Will we see Symantec advertorial content written by product marketing managers? Will we see Symantec's products being touted as the solutions to problems and vulnerabilities?

The most valuable commodity that SecurityFocus had was its independence (of ownership) from any of the product vendors. Without that independence there will always be doubt and doubters.

for the antisec movement it's a day..

even if not as intended but bugtraq will loose
a lot of reputation over the time anyway. Especially
to those people posting serious things. Maybe it's
like fighting satan with the devil but this will
make the world a lot more secure in the long run.
Shure such a simple step can not prevent full
disclosure from existing but it will split up the
scene pretty well.. it will be intresting to watch
the full impact within the next month and thank you
symantec!

Relax

Yes, we all know the evils of Microsoft, Symantec, IBM, HP, Compaq, GE, Sears, 7-11 and, oh yes, I can't stand Pizza hut. So I ask you. Is there any company we actually trust?

I am a cynic's cynic and agree that this purchase spells the doom of SecurityFocus. But why do I feel this way? I was just going over this in my head and I cannot remember why I believe this. Because "everyone" says so? That's just not good enough. I have been using securityfocus for years. I am sure some things will change. Some changes I'll like and some I won't (we fear change... Unless it's happens to a *nix OS!) I think, for now, I'll stick with SF and avoid the panic unsubsrcibe.

Corporations may be evil but in this crazy mixed up world of ours they seem to be a necessary evil.

Cheers!

Better than McAfee

Hey, complain all you want about this, it is still infinitely better than McAfee buying SecurityFocus. Then we would have popup ads for cleansweep, spamkiller, and other such garbage. Imagine if AOL purchased SecurityFocus, then everytime you went to the web site, you would have to click no to not buy some stupid product.

Is it just me or...

Has all the useful security news for *nix sites have been going down the drain lately?
I mean, I am sure symantec is a great windoze security company, but what do they care about securityfocus?
Now that website is probably going to be filled with even more useless HTML and crap
bleh!

Re:good for SYM

I dunno.. after having been a user of Peter Norton's software in the early and mid 80s, I just don't trust Symantec's stuff anymore. I've had to rescue too many people from grievous harm (Macs and PCs) due to Symantec "utilities". They totally fucked up "AtGuard". And does anyone know what "Optimize your hard drive" really means? For all their faults, I still like McAfee (been a user of their software since '86). I'm sorry that NetAss had to screw them up for so long.

Re:We dig Security Focus too

yeah.. if they don't plan on changing it any, then why did they just drop 75 large on it? I don't think they're that altruistic..