Slashdot Mirror
Symantec Looks Into Claims of Stolen Source Code
wiredmikey writes "A group of hackers claim to have stolen source code for Symantec's Norton Antivirus software. The group is operating under the name Dharmaraja, and claims it found the data after compromising Indian military intelligence servers. So far it's unclear if the claims are a significant threat, as the information posted thus far by the hackers includes a document dated April 28, 1999, that Symantec describes as defining the application programming interface (API) for the virus Definition Generation Service. However, a second post entitled 'Norton AV source code file list' includes a list of file names reputedly contained within Norton AntiVirus source code package. Symantec said it is still in the process of analyzing the data in the second post."
Update: 01/06 07:05 GMT by S : In a post to their Facebook page, Symantec has now said some of their source code was indeed accessed, but it was four or five years old.
Who would want anything they make?
...on Facebook (yeah, I dunno). http://www.facebook.com/Symantec/posts/10150465997682876
Wow, so the Indian military works with major US vendors like Norton to spy on their own people (and I assume other countries people since it will be the same source????)
I assume they have the source code so they can insert extra bits and dispatch spyware the next time Norton auto-updates?
You get an auto-update, they get a spyware app into your PC. Is that it?
I don't think the scandal here is that the source code was stolen, it is a scandal that Norton cooperates will military spyware!!
Stealing source code from Symantec is like stealing your neighbor's garbage.
They don't.
1. Write virus code
2. Load up a machine with the top 10 virus scanners.
3. Load your virus code
4. Let them scan.
5. If they detect it, modify code and go to 3 else 6
6. Release the hounds.
--
BMO
Does the code include the keys that would be needed to inject bad/malware virus definitions, causing user's machines to delete files that weren't viruses? Does this open up some sort of command-and-control channel over users machines aside from that risk?
I do not fail; I succeed at finding out what does not work.
>>The group is operating under the name Dharmaraja
>>...compromising Indian military intelligence servers.
Dear Corporations, "Investors", and CEOs,
Please do not hesitate to keep offshoring every bit of information and technology to the third world. The things you've seen so far are mosquito bites compared to the crap that will hit the fan if you keep "enhancing profits" for another decade or even less.
Respectfully,
Software Developer, a.k.a. the guy who actually has to work for a living.
Indeed, a lot of people seem to missing the bombshell here.
Stealing Symantec's source code is like stealing Typhoid Mary's soup.
Help stamp out iliturcy.
Wow, so the Indian military works with major US vendors like Norton to spy on their own people (and I assume other countries people since it will be the same source????)
I assume they have the source code so they can insert extra bits and dispatch spyware the next time Norton auto-updates?
You get an auto-update, they get a spyware app into your PC. Is that it?
I don't think the scandal here is that the source code was stolen, it is a scandal that Norton cooperates will military spyware!!
Wow, +4 already? The tinfoils must be up and about today.
Believe it or not, most major software vendors have licenses and policies in place (e.g., Microsoft) to allow sensitive institutions (governments, defense contractors, etc) access to their source code. The primary reason is actually the opposite of what you say. Customers such as the Indian government want to be able to see what's actually in the code before they agree to buy and install it on their own systems and network.
Think of it as the 1% always getting to run open-source software because they have the clout to demand it (and under strict a NDA).
Occupy Microsoft!
"What do you despise? By this are you truly known." --Princess Irulan, Manual of Muad'Dib
/)
Wow... so many assumptions in one post.
Don't you think the Indian military needs anti-virus software? Don't you think they would need to examine the source code before running software from an American company on potentially sensitive systems? And don't you think Symantec would give it to them to secure the contract?
Actually, they probably want to audit the code for backdoors and other security vulnerabilities before deploying the software on their systems. A whole bunch of governments got snookered when Cryto AG sold closed-source encryption software with a backdoor that allowed the US government to easily break their communications. In particular, the NSA was rumored to have backdoored Crypto AG systems since the fifties, allowing the US government to spy on communications from such warm and fuzzy countries as Iran.
A NYC lawyer blogs. http://www.chuangblog.com/
I've always wondered about the efficacy of such programs. Yes they do have a license, but for obvious reasons the # of people that have access to it are much less than the number of developers, and not only that, the different organizations that have access to it are probably very limited in their ability to communicate, which means that you have a large number of people who each have to analyze large amounts of source, so their ability to really get a deep understanding of any individual part of the code is probably somewhat limited.
Now compare this with open source, even though the # of eyes may be about the same(and yes I'm realistic, only a very, very tiny % of people actually comb through the source of an open source project, even a project like Linux), the ability to coordinate and specialize is much greater. I doubt there are very many people who pore through every change in the Linux kernel(aside from Linus of course), instead what you get is people who are very familiar with certain parts of the source and thus are more aware(and may have even been consulted on) changes in the code. Not to mention they can actually submit code themselves.
Finally someone can write a working uninstaller!
that's what happens when you outsource your programmers to India.
The Indian military outsources to India? Impressive.
Hope these hackers can turn the source code into something useful.
-- Chaos, panic, pandemonium... My job here is done!
A lot of Symantec haters out there. Funny
Lets put some things in to perspective here.
1. Norton is a consumer product. SEP is the enterprise product - Two very different products with very different code and both have been re-written a couple of years ago. (Works a lot better than before and is less "bloated")
2. I would very much doubt that a government defense organization would be purchasing a consumer product like Norton.
3. The segments of code found are from SAV (last rolled out apporximatley 5 years ago and does not exist anymore ) and SEP 11 (released 4 years ago and is no longer sold as SEP 12.1 is the current version and this was re-written to include new technology)
I've never told anyone this before, because it's horrifically tragically sad but I had a picture of Peter Norton torn out of a magazine pinned up near my PC when I was a kid 20 years ago. Yeah I was a complete nerd / geek, especially for performance and hardware.
Back then Norton utilities 6 was the absoloute bees knees, speedisk for DOS is still the most thorough defragger I know of, full with file reorder was the option, it ensured 0 files were fragmented and this was in the days that exceedingly few files on the disk were set as read only / system. It genuinely improved performance significantly.
Their tools were good for maybe 3 or 4 years more, possibly the first one or two Windows tools for 95 had some useful features lacking in the core OS but after that, what a shambles. To me, any machine with Norton utilities (Norton utilities NOT "Nortons utilities" while I'm at it) should pretty much be wiped clean :/