Symantec Offers Web-Based PC Checkups

Sean Captain, PCWorld.com

Symantec is inviting you to assess your PC's vulnerability to hackers, viruses, and privacy leaks by running an online checkup at a new portion of its site, launching this week.

Symantec Security Check analyzes PCs for their exposure and proposes remedies for systems that don't pass the test (often, not surprisingly, recommending Symantec security products).

The Hacker Protection portion of the site scan for openings that hackers can exploit. Its Virus Protection checks for a current virus protection program, and its Privacy Protection component determines whether your browser is transmitting your Web-surfing history to other sites.

To take advantage of all of Symantec's services, you must run Microsoft Internet Explorer 4.0 or a later version. Also, you must accept a tracking file called a session cookie (which is deleted after the test) and download an ActiveX program that performs part of the analysis.

Some people consider cookies and ActiveX downloads to be security breaches in their own right. "To require that people do insecure things in order to check their security seems strange to me," says Steve Gibson, whose Gibson Research provides the free, Web-based Shields Up service similar to Symantec's Hacker Protection utility. (See "Is Your PC Open to Hack Attacks?")

However, you can forgo both cookies and ActiveX downloads and still take advantage of Symantec's services except the Virus Protection tests, according to Tom Powledge, senior products manager for Symantec's consumer products division. Some of the services are available to users of the Netscape browser, which does not support ActiveX in the same way as IE.

Halting Hackers

Symantec's Hacker Protection utility, like Shields Up, scans your PC for open ports--electronic gateways into a computer--that hackers can exploit to access a system and files.

Many applications create ports that allow contact between a PC and the Internet. For instance, Web browsers generally bring HTML code into the system via port 80, while FTP programs transfer files through port 21. Symantec Security Check probes 12 of the most commonly used ports for security against unwelcome access.

Unlike Shields Up, Security Check also scans for approximately 60 Trojan horses, which are malicious programs masquerading as other applications that you might unwittingly download. When run, a Trojan horse opens one or more ports to exploit.

Symantec is aware of the GRC service, but draws on its utilities to hone its offerings.

"I think this is something we've identified a need for," Powledge says. "It's been on the drawing board for a while."

Gibson, president of Gibson Research and developer of the Shields Up site, was not aware of Symantec's service, so was unable to compare the two utilities.

Several similar services are available for a subscription. HackerWhacker will scan your PC's ports for security vulnerabilities. You can get a one-time scan of most ports free, and more thorough scans for a sliding fee. Also, Secure-Me-Automated Security Testing offers two free port scans (one lengthy).

Checking for Viruses, Voyeurs

While Shields Up focuses on a system's susceptibility to hacking, Symantec Security Checker also gauges vulnerability to viruses and Web sites that request personal information.

Its Virus Protection portion checks whether your PC is running a virus protection program with up-to-date virus definition files. Symantec's Norton AntiVirus 2001 is not the only program deemed acceptable; but the list is limited to "top sellers...that produce regular updates," Powledge says. Those include Norton AntiVirus, McAfee VirusScan, Trend Micro's PC-cillin, and McAfee.com's ActiveShield.

You can also run a Web-based version of Norton AntiVirus that checks your PC for viruses but does not remove them.

Finally, the Privacy Protection component of Symantec Security Check determines whether a browser is transmitting your Web-surfing history to other sites. Often, Web sites request the identity of the last page you visited.

"I think most people don't realize that information is being sent out over your browser," Powledge says. (See also "Make Your PC Hacker-Proof.")