[ insider_reports_insider ]
Symantec Calms PIFTS Panic
SecurityProNews
Staff Writer
2009-03-10
 Insider Reports RSS Feed
When users of Symantec's Norton Antivirus received a strange message about an odd executable file, the panic became exponential when Symantec started actively deleting posts about it in its own support forums. And then came the real bad news.
 | | Symantec Calms PIFTS Panic |  |
Lesson 1: If a screw-up on your part causes the mob to panic, it's best not to feed that fear because you think the mob is being rude.
So here's how it went down. Norton users saw a pop-up warning them about how a file called PIFTS.exe was trying to access the Internet, and the dialogue box asked if they would allow the file to do so. After tracing, it became clear the file was trying to communicate with Symantec servers for an unknown purpose.
This of course leads to a certain percentage the conclusion that:
1. Symantec is spying on them for some reason.
2. PIFTS.exe is a government snoop program distributed by Symantec.
Because clearly these are the obvious, most logical, and Occam's Razor simplest solutions to the mystery, said mob and the rest of the concerned (but not that concerned) customer base took to Symantec's support forums, only to encounter an active ban on posts about PIFTS.exe, all of them aggressively deleted.
Then the Digg bury-brigade struck, Snopes.com was accused of hiding the information, and on and on into Crazy Town everyone went.
The official story from Symantec, once somebody finally got a hold of someone, was that a coder goofed on a diagnostics patch update and Norton's system caught it by mistake. As for why posts were deleted about it in the forums, Symantec's senior director of product management Dave Cole said hundreds of new registrants were spamming the forum with abusive comments. That means everybody had to stay in at recess.
The fair thing to say is that Symantec didn't yet know what was happening in the forum and took standard abuse precautions while they figured it out. The mean thing to say is that they might want to get one of their coders-not the PIFTS guy, though-to slap a message across the forum headers so nobody continues to panic and theorize.
And what happens after that? Well, the real bad guys take over, targeting search queries for PIFTS and showing up high in Google's search results before leading panicky dunces to a scareware pitch that costs them $30 and a virus install.
Pretty good day all around sounds like.
View All Articles by SecurityProNews
About the Author:
SecurityProNews is a daily online and email publication focusing on internet security issues.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
