Computers accidentally "attacked" by Norton AntiVirus
www.chinaview.cn 2007-05-20 14:22:04 — An error occurring in the update of Norton's virus database on Friday has caused millions of PCs and computers to crash-a heavy blow to people's daily work and ongoing business.
Context & Ripple Effects
On Friday, May 18, 2007, an error in a Norton AntiVirus virus-database update turned the security product itself into the outage: machines that received it crashed, and Xinhua put the damage at millions of PCs across China, disrupting daily work and running businesses. The fault came from Symantec's own update pipeline rather than from any attack, which is what makes the incident notable.
The story travelled fast beyond its origin market — InfoWorld picked it up within days under a headline about Chinese users still dealing with the fallout — signaling that a consumer-security vendor's distribution mistake was being read internationally as an operational-risk story, not just a local support headache.
First-order effects
- Millions of Chinese PC users who received the faulty definition update face machines that crash, stalling daily work and business operations until they can obtain a fix or rollback.
- Symantec absorbs an immediate support burden and reputational hit, with the damage concentrated among paying customers of its flagship Norton AntiVirus product.
Second-order effects
- Rival antivirus vendors gain a concrete selling point in the Chinese market, contrasting their own update-testing practices against Norton's failure to win displaced customers.
- Enterprise IT departments re-examine automatic virus-definition deployment, weighing staged rollout and delayed updates against the protection the rapid update cycle is meant to deliver.
Third-order effects
- If definition-update failures repeat across vendors, antivirus software stops being treated as set-and-forget infrastructure and gets managed like any other risky change, with staging, pilot groups, and rollback procedures applied to security signatures themselves.
- Consumer-scale automatic updating comes under scrutiny as a single point of failure — a mechanism that can incapacitate more machines in one mistake than the malware it exists to block, raising questions about vendor accountability for silent, fleet-wide pushes.
The trend: Automatic security-software updates are emerging as a systemic single point of failure, where the update channel itself becomes the largest credible source of mass outages on end-user machines.