Symantec Looks Into Claims of Stolen Source Code

wiredmikey writes "A group of hackers claim to have stolen source code for Symantec's Norton Antivirus software. The group is operating under the name Dharmaraja, and claims it found the data after compromising Indian military intelligence servers. So far it's unclear if the claims are a significant threat, as the information posted thus far by the hackers includes a document dated April 28, 1999, that Symantec describes as defining the application programming interface (API) for the virus Definition Generation Service. However, a second post entitled 'Norton AV source code file list' includes a list of file names reputedly contained within Norton AntiVirus source code package. Symantec said it is still in the process of analyzing the data in the second post." Update: 01/06 07:05 GMT by S : In a post to their Facebook page, Symantec has now said some of their source code was indeed accessed, but it was four or five years old.

Comments

Nope..

[Anonymous Coward]

Who would want anything they make?

Re:Nope..

[Enigma23]

Maybe they're white hat hackers who will return the code in a vastly less bloated form?

Re:Nope..

[GameboyRMH]

Imagine the poor black hat who only got this turd as loot. It's like breaking into a bank vault and finding out that it only had some smelly bath mats inside.

Symantec released a more up to date statement...

[Anonymous Coward]

...on Facebook (yeah, I dunno). http://www.facebook.com/Symantec/posts/10150465997682876

Symantec can confirm that a segment of its source code used in two of our older enterprise products has been accessed, one of which has been discontinued. The code involved is four and five years old. This does not affect Symantec’s Norton products for our consumer customers. Symantec’s own network was not breached, but rather that of a third party entity. We are still gathering information on the details and are not in a position to provide specifics on the third party involved. Presently, we have no indication that the code disclosure impacts the functionality or security of Symantec’s solutions. Furthermore, there are no indications that customer information has been impacted or exposed at this time. However, Symantec is working to develop remediation process to ensure long-term protection for our customers’ information. We will communicate that process once the steps have been finalized. Given the early stages of the investigation, we have no further details to disclose at this time but will provide updates as we confirm additional facts

Why does the Indian military have the source????

[Anonymous Coward]

Wow, so the Indian military works with major US vendors like Norton to spy on their own people (and I assume other countries people since it will be the same source????)

I assume they have the source code so they can insert extra bits and dispatch spyware the next time Norton auto-updates?

You get an auto-update, they get a spyware app into your PC. Is that it?
I don't think the scandal here is that the source code was stolen, it is a scandal that Norton cooperates will military spyware!!

Bleh!

[SeaFox]

Stealing source code from Symantec is like stealing your neighbor's garbage.

Re:Bleh!

[MightyMartian]

Ghost was a decent product. I stopped using it years ago in favor of Clonezilla.

Re:Bleh!

[Spy Handler]

I also use clonezilla alot, and I agree it's a good product in terms of function. But it has the shit-worst user interface ever (for something that's at least moderately popular). Its UI looks like a badly copied version of the text menu from the mid-90's Slackware installer, I swear.

Re:Huh, and this does...?

[bmo]

They don't.

1. Write virus code
2. Load up a machine with the top 10 virus scanners.
3. Load your virus code
4. Let them scan.
5. If they detect it, modify code and go to 3 else 6
6. Release the hounds.

--
BMO

Offshoring

[happyhamster]

>>The group is operating under the name Dharmaraja
>>...compromising Indian military intelligence servers.

Dear Corporations, "Investors", and CEOs,

Please do not hesitate to keep offshoring every bit of information and technology to the third world. The things you've seen so far are mosquito bites compared to the crap that will hit the fan if you keep "enhancing profits" for another decade or even less.

Respectfully,
Software Developer, a.k.a. the guy who actually has to work for a living.

Re:Offshoring

[jaa101]

It doesn't sound like this falls into the offshoring category to me. Since the military is involved I guess they demanded the source to assure themselves that there were no backdoors. It doesn't seem an unreasonable step for any government (even/especially in the US) to take before using your software in a security context.

The fun is in considering what recourse Symantec has. If they didn't have some really expensive penalty clause in the non-dislosure agreement that will have been involved here they'll be kicking themselves right now. They'll also be wishing they gave themselves some way to identify the source of the leak. Their smart move would have been to insert some minor changes, e.g., to indentation or comments, to make each version released to third parties unique and therefore traceable.

Re:Why does the Indian military have the source???

[Aighearach]

Indeed, a lot of people seem to missing the bombshell here.

Hunh?

[symbolset]

Stealing Symantec's source code is like stealing Typhoid Mary's soup.

Re:Hunh?

[expo53d]

I would be interesting to run grep through the source code. Bet you would find lines like:

# This part slows down the computer if the license is not renewed

Re:Why does the Indian military have the source???

[nmb3000]

Wow, so the Indian military works with major US vendors like Norton to spy on their own people (and I assume other countries people since it will be the same source????)

I assume they have the source code so they can insert extra bits and dispatch spyware the next time Norton auto-updates?

You get an auto-update, they get a spyware app into your PC. Is that it?
I don't think the scandal here is that the source code was stolen, it is a scandal that Norton cooperates will military spyware!!

Wow, +4 already? The tinfoils must be up and about today.

Believe it or not, most major software vendors have licenses and policies in place (e.g., Microsoft) to allow sensitive institutions (governments, defense contractors, etc) access to their source code. The primary reason is actually the opposite of what you say. Customers such as the Indian government want to be able to see what's actually in the code before they agree to buy and install it on their own systems and network.

Think of it as the 1% always getting to run open-source software because they have the clout to demand it (and under strict a NDA).

Occupy Microsoft!

Re:Why does the Indian military have the source???

[rgbrenner]

Wow... so many assumptions in one post.

Don't you think the Indian military needs anti-virus software? Don't you think they would need to examine the source code before running software from an American company on potentially sensitive systems? And don't you think Symantec would give it to them to secure the contract?

Re:Why does the Indian military have the source???

[darkmeridian]

Actually, they probably want to audit the code for backdoors and other security vulnerabilities before deploying the software on their systems. A whole bunch of governments got snookered when Cryto AG sold closed-source encryption software with a backdoor that allowed the US government to easily break their communications. In particular, the NSA was rumored to have backdoored Crypto AG systems since the fifties, allowing the US government to spy on communications from such warm and fuzzy countries as Iran.

Awesome

[zerojoker]

Finally someone can write a working uninstaller!

Here's to a brighter future!

[BagOCrap]

Hope these hackers can turn the source code into something useful.

Re:A little perspective

[Lumpy]

And both STILL are garbage. we saw a 200% speed increase on ALL our corperate Windows machines when we switched from SEP to the enterprise offering from ESET. The change was so dramatic that most of us did not believe that the ESET software was running.

Honestly, SEP and Norton both needs to have even more rewrites because it's the joke of the Enterprise world in regards to performance and reliability.