Slashdot Mirror
Symantec Admits Its Networks Were Hacked in 2006
Orome1 writes "After having first claimed that the source code leaked by Indian hacking group Dharmaraja was not stolen through a breach of its networks, but possibly by compromising the networks of a third-party entity, Symantec backpedalled and announced that the code seems to have exfiltrated during a 2006 breach of its systems. Symantec spokesman Cris Paden has confirmed that unknown hackers have managed to get their hands on the source code to the following Symantec solutions: Norton Antivirus Corporate Edition, Norton Internet Security, Norton Utilities, Norton GoBack and pcAnywhere."
As this includes a Corporate version, I'm sure enterprises just LOVE to hear that the company to whom they entrust a certain amount of their data security completely lied to them about the effectiveness of that security, and covered up the fact that future use of their product might be for naught.
Long signatures suck.
We have yet another winner of the Late Lameo award. You're such a lameo,
Surely this is a good thing, the hackers might release an anti-virus for Norton
I reject your reality and substitute my own.
That'll be a lot better, right?
SJW: Someone who has run out of real oppression, and has to fake it.
We have to take ten points a day off your score for releasing your findings five years late. Good luck keeping your GPA up.
...they were running McAfee at the time!
Word game?
the code seems to have exfiltrated
Wow, must be bad working at Symantec. Even the code wants to escape.
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
Better, switch to PC-Cillin and you'll be sure that nobody's exploiting your system. Because when it takes up 99% of your system resources you're sure as hell not going to bother turning it on anytime soon.
Maybe they'll use the source code for Norton GoBack to rebuild the program into less of a headache.
Why didn't they use Norton?
Was working with a company that was dealing with some security issues in late 2008, and we found out that the source of the breach was going right through Norton like a hot knife through butter. However, just about any other security solution would stop it. At that time, we theorized that whoever had created the problem had some intimate/inside knowledge of Norton systems and we even joked that "Symantec better check who has their source code".
If someone with illegally-obtained source code anonymously posts the Ghost and other file formats AND posts a credible "here's how I reverse engineered the file formats" document, and others use it to create open-source software to read the software, will Symantec have any recourse against those who write, host, or use the resulting software?
Who the hell outsourced the hacking to India, and have they really sunk so low?
WARNING: Smartphones have side effects--most of them undocumented.
...or not.
Norton Antivirus: De-Crappified, Open Source, Slightly Illegal Edition
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
why would we re adoopt that memory leakin shiznit?
The pay-for antivirus industry makes most of its money in valuing the updates that they send out. Open source at his point can write an antivirus heuristics program but can't get the staff to write good enough updates for known trouble programs.
If they just had open sourced their programs they wouldn't had lost face.
Their programs are just mechanisms. It's the filter data where the value is at.
Midnight AV ?
Realistically, the codebase has to have changed somewhat since then, right?
Considering my low esteem for their anti-virus products, I'm not surprised security is also of low caliber.
The breach makes me wonder if Symantec is even dogfooding their own security products. Wouldn't the drag on their systems from Norton cause such slow response times that hackers would lose interest and move on? Security through performance degradation!
Ask me about my sig!
I wondered how it could go from good (meh... mediocre) to bad so quickly. They didn't steal anything - they left bloat!
If someone with illegally-obtained source code anonymously posts the Ghost and other file formats AND posts a credible "here's how I reverse engineered the file formats" document, and others use it to create open-source software to read the software, will Symantec have any recourse against those who write, host, or use the resulting software?
If the cracker posts a document with a clear specification without any code examples, then users of that specification will likely be safe. If there is a single line of code in the spec, then it would be a big no no.
It is dangerous to be right when the government is wrong.
I called their customer support to inquire. They opened a Ticket and said someone who I couldnt understand would get back to me within 3 days or maybe not at all. I think they then called me "assface".
The pay-for antivirus industry makes most of its money in valuing the updates that they send out. Open source at his point can write an antivirus heuristics program but can't get the staff to write good enough updates for known trouble programs.
So implement the code that downloads the updates.
It is dangerous to be right when the government is wrong.
.... for each and every paying customer who's PC's were being compromised and having both their identity stolen as well as their PC's being used to help share and harbor malware. In 2006 I was still foolishly paying for that service. I should be receiving a refund for years of purchases, for failure to notify me that my security software was breached. By withholding this information they were willingly complicit in any illegal activities that happened on any of their customer's PC's. They continue to push / shove their product down the throats of the non-technical user community with the grand notion of "your system is secure with us". How is this any different than the cigarette companies saying it's perfectly safe to smoke, knowing all the while of the harmful affects.
They knew their product was breached, but failed to disclose, and continued to sell it.
Life takes interesting turns, but the most interest is when you're off the beaten path.
Why are we assuming that the breach only stole code, and did not hide malicious code in the source?
In the 4Q of 2005, Symantec purchased Sygate, which was largely a company of Chinese foreign nationals and Chinese ex-patriots in the US. They then proceed to give that team access to Symantec source code so that they code can integrate the firewall into the Corporate product. Surprise, somehow the source code is "hacked" in 2006. Bullshit. It is even worse now. Ask Symantec how much source code is developed and maintained in China. I always enjoy a good hand-waving.
Yo dawg, we herd u liek malicious code, so we put some malicious code in your malicious code so you can ruin your computer while you ruin your computer by installing Symantec's software.
I had a MBR virus in 97, you may be asking what the point of that was, well ... neither I (back then) or Symantec (today) are doing anything meaningful. One major difference was I had a job and brought in money ... Symantec just extorts it from people who dont know better, all the while it bogs your machine down and is effectively useless at its one and only task.
If it's illegal (and it would be) they'd find a way to use Symantec's updates.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Today the code is 6 years old, but it was new when it was stolen in 2006. It has taken 6 years for Symantec to admit to the breach.
It's probably worse. They didn't realize the breach included source code until now (assuming they didn't realize the breach happened because of the recently leaked code).
And with the SW writting attitude of the last decade, the inner workings of the antivirus engine might not have changed that much. Too much software seems to have stalled, and focuses on cosmetic changes to justify/sell yearly upgrades. There is a need for improvement, but real new features require more investment than they're willing to commit, so tend to skirt the issues and implement useless features.
Because this sounds exactly what we hear from support from these clowns daily - Virus? Wipe and reinstall. Drive with bad sectors or a dead RAID array member? Wipe and reinstall. Dead motherboard or power supply? Wipe and reinstall....
In other words, you want to break the paywall.... these guys know security so that ain't happening.
As one of those guys who DOES get paid to remove viruses, I have to disagree with you....
Yes, a complete wipe of everything and a fresh reinstall is the only way to be 100% sure you eliminated whatever malware or virus was on a given machine. BUT, that's like telling the exterminator he should just burn your entire house down to get rid of the ants or spiders you called about, because simply spraying some poison down doesn't guarantee they're all gone.
I've actually gone through the whole "backup data, wipe drive, reload OS, reinstall all needed apps from the original CDs, restore data" process for people on many occasions, when they had a computer that was so obviously screwed up, I didn't feel like I was making headway with anything else.
That's really a losing proposition for everyone involved when you're reached that point, though. Inevitably, there's SOMETHING that doesn't get put back the way the user wants it, because he/she can no longer find an installation disc for some program or lost a license key for some downloadable product. It takes so much time, you can't really bill your normal labor rate for such a project, or the customer will go ballistic (and probably refuse to pay!). It's really not what they WANTED to pay you to do in the first place when they called you.
In most cases (maybe 80% of the one I've encountered?), I see pretty readily identifiable infections (like those fake "AntiVirus 2011" programs that would pop up on startup and do a fake scan), or I have a system that's still fairly usable, except for symptoms like random pop-ups in the browser, telling me it's not quite right. Most of these issues are pretty well documented all over the net, with people offering known good solutions for removing them. If I boot from a CD and scan the system while its own OS isn't running, I stand a good chance of finding and removing the most stubborn pieces of the malware with that. A full scan with a couple other good tools like Malware Bytes as a follow-up, and if nothing else is detected at that point AND the PC seems to be working right? That's good enough for most people.
know that hackers have been using the presence of NORTON (most any of it) to hack their way into users systems. Best advice? Get some serious anti-virus and firewall, that does NOT include anything with 'NORTON' on the cover.
...as nobody else has as yet:
JUL. (Just Use Linux)
And BEFORE you all start bleating about market share blah blah command line blah blah not my software blah blah drivers blah blah, just this: in 10 years I have NEVER EVER been inconvenienced by malware. So my productivity has never been impacted by the malware circus a.k.a. Windows.
I like to think that Symantec provides a self maintaining honeypot for those of us who use more obscure, less intrusive, and less expensive solutions which aren't so highly exploited. Thanks Symantec. I also like Backup Exec, somewhat.
Now my business insurance is invalid. Thanks to me reading this article, I now know that my corporate anti-virus solution in my office is potentially flawed. Knowing this, I must now choose another solution. If I don't then my insurance company, in the event that one of my clients gets a virus from some of our software distributions, will not cover those damages. Even if I claim I did not know, my insurance provider now has an excuse to be held unaccountable, which is all they usually need.
Great. I thought I had my day planned too. Let's flip a coin to find an alternative.
Note: I have Norton Antivirus Corporate Edition installed on my office machines _purely_ because it is mandated by my public and product insurance / professional indemnity insurance policies. I practice a far more effective method of virus prevention as my primary defence: common sense.
Sorry. Not funny.
because I'm curious about the comments