Symantec today unveiled the 2008 editions of its Norton AntiVirus and Internet Security desktop protection products, adding what it calls “threat interceptor” defense to prevent execution of malicious code enabled through a drive-by download.

Used by consumers and small businesses, Norton AntiVirus 2008 and Norton Internet Security, which includes the antivirus capability plus a desktop firewall and host-based intrusion prevention, will now be able to block drive-by downloads from Web sites where visitors with unpatched computers can easily be infected and their machines compromised. Symantec’s 2008 edition security products are designed to run on Windows XP Service Pack 2 and Windows Vista.

“There are multiple infection vectors for drive-by downloads, both Web sites where malicious code is deliberately posted and legitimate Web sites that have been compromised,” noted Ed Kim, director of product management at Symantec’s consumer division.

One striking example of this was the compromise of the Web sites of Dolphin Stadium and the Miami Dolphins in advance of the Super Bowl football game last winter when Web site visitors encountered drive-by downloads intended to take over their desktop machines.

Kim pointed out that unpatched Web browsers aren’t the only means that drive-by downloads exploit to dump malicious code on Web site visitors.

“Hacks are becoming highly focused not only on Web browsers but on third-party applications as well, such as Adobe or QuickTime,” he said. Failure to stay completely up to date on software patches can provide the hole for drive-by downloads to slip through.

The threat interceptor technology — branded as Browser Defender — works by inspecting function API calls to execute what might be a malicious attack, and proactively blocking them. Kim said in most cases this would still allow the user to continue browsing the Web site, but in some instances it might cause a delay as threat interceptor blocks code execution. “Generally, you’d get a quick notification that we detected an attack,” said Kim.

The threat interceptor technology is not included in today’s versions of Symantec’s corporate antivirus and Internet Security software, but Symantec’s history of product rollouts has often entailed adding capabilities introduced in consumer products to corporate editions. Symantec didn’t disclose whether that would occur as regards threat interceptor.

Whitepapers

• Boost Productivity While Cutting Costs with Next-generation Collaboration
• Deploying Virtualized NetWare on Linux Whitepaper
• Driving Business Success Through Workgroup Choice and Flexibility
• Toward More Flexible, Next-Generation Collaboration Solutions
• Collaboration Tools and Organizational Success Whitepaper
• The ROI and TCO Benefits of Data Deduplication for Data Protection in the Enterprise

View more SECURITY whitepapers

Webcasts

• Creating a high performance workplace with wireless networking
• Harnessing the power of communications to increase workplace performance
• Making data centers the IT strategic focus
• Protecting assets and employees with IP Video Surveillance
• Stay out of the headlines: Detecting and preventing network intrusions
• Transforming the Enterprise WAN Edge: Video from Cisco

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• IP address management in 2008 - six things to know
• The self-managed network

View more SECURITY special reports