Symantec today unveiled the 2008 editions of its Norton AntiVirus and Internet Security desktop protection products, adding what it calls “threat interceptor” defense to prevent execution of malicious code enabled through a drive-by download.

Used by consumers and small businesses, Norton AntiVirus 2008 and Norton Internet Security, which includes the antivirus capability plus a desktop firewall and host-based intrusion prevention, will now be able to block drive-by downloads from Web sites where visitors with unpatched computers can easily be infected and their machines compromised. Symantec’s 2008 edition security products are designed to run on Windows XP Service Pack 2 and Windows Vista.

“There are multiple infection vectors for drive-by downloads, both Web sites where malicious code is deliberately posted and legitimate Web sites that have been compromised,” noted Ed Kim, director of product management at Symantec’s consumer division.

One striking example of this was the compromise of the Web sites of Dolphin Stadium and the Miami Dolphins in advance of the Super Bowl football game last winter when Web site visitors encountered drive-by downloads intended to take over their desktop machines.

Kim pointed out that unpatched Web browsers aren’t the only means that drive-by downloads exploit to dump malicious code on Web site visitors.

“Hacks are becoming highly focused not only on Web browsers but on third-party applications as well, such as Adobe or QuickTime,” he said. Failure to stay completely up to date on software patches can provide the hole for drive-by downloads to slip through.

The threat interceptor technology — branded as Browser Defender — works by inspecting function API calls to execute what might be a malicious attack, and proactively blocking them. Kim said in most cases this would still allow the user to continue browsing the Web site, but in some instances it might cause a delay as threat interceptor blocks code execution. “Generally, you’d get a quick notification that we detected an attack,” said Kim.

The threat interceptor technology is not included in today’s versions of Symantec’s corporate antivirus and Internet Security software, but Symantec’s history of product rollouts has often entailed adding capabilities introduced in consumer products to corporate editions. Symantec didn’t disclose whether that would occur as regards threat interceptor.

Whitepapers

• The ROI and TCO Benefits of Data Deduplication for Data Protection in the Enterprise
• Best Practices in Lifecycle Management: Comparing KAC(tm), Altiris, LANDesk, and Microsoft SMS
• Security vs. Flexibility: Must IT Management Choose?
• Systems Management Buyer's Guide For Medium Enterprises
• The Trend from UNIX to Linux in SAP(r) Data Centers
• Vulnerability Management For Dummies

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• The Secure Web Gateway. Mission Critical For Business - Webcast
• Mobile Data Security
• Best Practices for Deploying WAN Optimization for Disaster Recovery
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives

View more SECURITY webcasts

Special Reports

• IT Buyer's Guide to Security Information Management
• The Evolution of Network Security
• IP address management in 2008 - six things to know
• The self-managed network

View more SECURITY special reports