Re: Symantec AntiVirus False Positive

[Brian Inglis <Brian.Inglis@SystematicSw.ab.ca>]

On 2017-10-24 18:29, J.McNamara wrote:
> 
> Harrod, Norm (UJS) writes:
> 
>> https://www.symantec.com/security_response/writeup.jsp?docid=2010-051308-1854-99&vid=4294919973
>>
>> setup-x86_64.exe
>> RISK WS.Reputation.1

See https://sourceware.org/ml/cygwin/2017-07/msg00097.html after last setup change.

>> Unfortunately, this will not allow for use on business networks using
>> Symantec. Not sure who controls the approval of Reputation for Cygwin. 

Symantec - they just rate everything they have not excluded (e.g. real risks to
you from big commercial products, and them from big vendor lawyers, such as MS
Office, Adobe suites, Oracle Java) as a "Reputation" risk, which generates a lot
of false positives they expect the smaller vendor developers to resolve with
them, and leaves a lot of open source projects without the resources to do that,
and their users, stuck. Symantec's Dispute page now gives 404!

There should be a setting or option on warning, to allow you to bypass these
"reputation risks", as they are unsupported by any evidence. You org may have a
group policy in effect to disallow this, and you may have to follow up
internally to have this bypassed for https://cygwin.com/setup-x86{_64}.exe: they
can validate the HTTPS cert and the gpg/pgp
https://cygwin.com/setup-x86{_64}.exe.sig if they want to be sure.

Remember Symantec outsourced all this to India starting in 2004, and recently
had to divest their CAs and businesses to a competent CA, after a number of
certification problems were not responded to or addressed to the satisfaction of
the CA/Browser Forum (of which Symantec are a founding member), and criticisms
of Symantec neither following nor auditing CA practices, led by Google Chrome
and Mozilla root CA teams.

> I used to have problems with rebase getting stuck. I tried to bring it
> to Webroots attention. They had this laundry list of all this stuff to
> do to submit a ticket. I told them it is a problem. It is not enough to
> do that. They wanted to me to be a tester. I thought I am convincing
> enough so no thanks.

The OP can see if there are any usable links in the Symantec product Quarantine
section to report a false positive, and look in their Tools/NoSupport directory
for utilities to take programs out of quarantine, mentioned on their web site.
Better AV products allow this with a click, with another to report it as a false
positive and submit a sample. Many AV products report a false positive on any
(sometimes every) upgrade of installers and system level utilities, until
someone complains.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple