Slashdot Mirror

← Back to Stories (view on slashdot.org)

Symantec Admits Its Networks Were Hacked in 2006

Posted by Soulskill on from the timely-disclosure dept.

Orome1 writes "After having first claimed that the source code leaked by Indian hacking group Dharmaraja was not stolen through a breach of its networks, but possibly by compromising the networks of a third-party entity, Symantec backpedalled and announced that the code seems to have exfiltrated during a 2006 breach of its systems. Symantec spokesman Cris Paden has confirmed that unknown hackers have managed to get their hands on the source code to the following Symantec solutions: Norton Antivirus Corporate Edition, Norton Internet Security, Norton Utilities, Norton GoBack and pcAnywhere."

18 of 113 comments (clear)

  1. Thanks a bunch by John+Napkintosh · · Score: 4, Interesting

    As this includes a Corporate version, I'm sure enterprises just LOVE to hear that the company to whom they entrust a certain amount of their data security completely lied to them about the effectiveness of that security, and covered up the fact that future use of their product might be for naught.

    --

    Long signatures suck.
    1. Re:Thanks a bunch by hedwards · · Score: 4, Informative

      Anybody that still uses Symantec software more or less deserves what they get. I can't imagine that the enterprise version is any less crappy than the home version is.

    2. Re:Thanks a bunch by Synerg1y · · Score: 4, Insightful

      Realize that no piece of security software will keep you safe indefinitely from a determined hacker. That applies to security companies as well.

    3. Re:Thanks a bunch by DarkOx · · Score: 3, Insightful

      Other than perhaps finding sploits in Symantec itself no I don't expect looking at virus removal code to be terribly useful to those developing malicious code.

      Look yes the AV stuff gets its hooks in pretty deep but until they start implementing their own filesystem drivers and stuff like that (they don't, not on desktops anyway) then there is a finite set of APIs and syscalls they can use. They are mostly documented, or otherwise known. Reading the source to Symantec's AV scanner is not going to give you a lot of insight into how to write something it can't clean up.

      --
      Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
    4. Re:Thanks a bunch by rickb928 · · Score: 5, Insightful

      How they use their signatures and heuristics to detect threats is of great use to attackers. Thinking otherwise is naive.

      --
      deleting the extra space after periods so i can stay relevant, yeah.
    5. Re:Thanks a bunch by forkfail · · Score: 3, Insightful

      Horrible analogy, because the scenario is adversarial in nature.

      A far better one would be that the other team just stole your playbook. Your QB still throws the same, your receivers run just as fast, your linebackers still do their thing, but now the other team can anticipate all your plays and outwit you far more often.

      --
      Check your premises.
    6. Re:Thanks a bunch by timeOday · · Score: 3, Interesting
      I have to use it at work under OSX and in a lot of ways it's worse than the virii it protects against.

      I am looking right now at a computer with 2 fully-loaded cores that has been viris scanning for 25 solid hours. This is typical. It starts up after EVERY login, then just sits and churns forever with no visible progress. Or sometimes it finishes after a few seconds.

      Sometimes you go to run some other program and it will just freeze up until/unless you kill navx (if you're lucky enough to have admin rights).

      Or you're sitting on a plane, and it decides now would be a fine time to fire up and drain your battery in 40 minutes.

      I can't leave my email box open because it pops up every few seconds and says THREAT DETECTED! (probably in some old email in mail spool already marked as deleted), but you press OK to fix, and after a few seconds it says it failed to repair it, no other explanation, so it pops up a modal dialog box in front of whatever you're trying to do. This occurs a couple times per minute, forever.

      I hate it.

    7. Re:Thanks a bunch by gstoddart · · Score: 4, Interesting

      I have to use it at work under OSX and in a lot of ways it's worse than the virii it protects against.
      I am looking right now at a computer with 2 fully-loaded cores that has been viris scanning for 25 solid hours.

      Some years ago at a previous job, IT decided that 10:30 am would be the perfect time to schedule a full scan of the computers. The rationale being that the computers wouldn't be hibernating or powered off.

      So, promptly at 10:30 am, my machine would lock up and be 100% CPU and memory bound for about 2 hours or more. I asked IT to reschedule it, as it was interfering with my work .. they said no. I told them that I was going to bill them 2 hours/day for the time lost ... they said I can't do that (at the time, they billed customers $1500/day for me).

      Then I finally told them that since I had local admin privileges, and unless they were willing to change it, I was simply going to uninstall the AV software ... which I ended up doing. And, when people started to uninstall it, they found they had no choice but to change the schedule ... because it was making it impossible for people to do their jobs and HR didn't like the fact that everyone was in the break room bitching about the fact that their computers were unavailable to them.

      In my experience, most enterprise AV solutions cause more lost productivity than the things they're meant to prevent.

      so it pops up a modal dialog box in front of whatever you're trying to do

      I'm about one upgrade of AVG away from finding an alternative ... because it suddenly decides that it wants to update, and that I need to reboot right now, or postpone as much as 60 minutes. The problem is that I'm using the computer for my job, and I will tell it when it can reboot or update ... but when it pops up a modal dialog while you're typing, with "OK" selected by default, you can get a case where you've clicked "sure, go ahead and reboot" before you even realize the dialog has been presented. So all of a sudden your machine starts shutting down out from under you.

      AVG didn't always suck, but over the last few versions it has become nag-ware which wants to instal crap toolbars in my browser and otherwise do shit that I've not asked it to do.

      The use of a modal dialog box that grabs focus should lead to someone being staked to an ant-hill in the hot sun -- I'm running more than your program, and just because you want to do something doesn't mean I don't get a vote.

      Unfortunately, I find that AV in general is far more pushy and annoying about deciding it's in charge.

      --
      Lost at C:>. Found at C.
    8. Re:Thanks a bunch by nigelo · · Score: 3, Funny

      > Little bastard has hooks all over the place

      This was my experience with Symantec software, too.

      --
      *Still* negative function...
    9. Re:Thanks a bunch by VortexCortex · · Score: 4, Informative

      Aaaand, you believe that's not one of the hundreds of variants, or a new variant that also installs other malware, because? I hope you're not the kind of person that "removes" viruses for a fee, and after my Aunt has paid you, she comes home and looks through her image library and gets re-infected...

      Just to be perfectly clear: WIPE the drive, FLASH the mobo BIOS, REINSTALL the OS. There is NO SUCH THING as removing malware. Unless you watched that sucker get installed while stepping through it with a debugger, you don't really know WTF is going on or what else it has done.

      Perhaps you're just playing with the viruses, cultivating them and studying them before they're released into the wild; Either this, or you don't realize that you are...

    10. Re:Thanks a bunch by operagost · · Score: 5, Funny

      I'm glad you aren't a physician.

      --

      Gamingmuseum.com: Give your 3D accelerator a rest.
  2. Surely this is a good thing... by el3mentary · · Score: 5, Insightful

    Surely this is a good thing, the hackers might release an anti-virus for Norton

    --
    I reject your reality and substitute my own.
    1. Re:Surely this is a good thing... by Krneki · · Score: 5, Funny

      They tried, but apparently removing norton proved to be too difficult.

      --
      Love many, trust a few, do harm to none.
  3. Obviously, I'm going to have to switch to McAfee by elrous0 · · Score: 5, Funny

    That'll be a lot better, right?

    --
    SJW: Someone who has run out of real oppression, and has to fake it.
  4. In their defence... by nick357 · · Score: 4, Funny

    ...they were running McAfee at the time!

    --
    Word game?
  5. "exfiltrated" by Baloroth · · Score: 5, Funny

    the code seems to have exfiltrated

    Wow, must be bad working at Symantec. Even the code wants to escape.

    --
    "None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
  6. I KNEW IT! by SoTerrified · · Score: 5, Interesting

    Was working with a company that was dealing with some security issues in late 2008, and we found out that the source of the breach was going right through Norton like a hot knife through butter. However, just about any other security solution would stop it. At that time, we theorized that whoever had created the problem had some intimate/inside knowledge of Norton systems and we even joked that "Symantec better check who has their source code".

  7. Good, maybe now we'll have GoBack etc file formats by Anonymous Coward · · Score: 4, Interesting

    If someone with illegally-obtained source code anonymously posts the Ghost and other file formats AND posts a credible "here's how I reverse engineered the file formats" document, and others use it to create open-source software to read the software, will Symantec have any recourse against those who write, host, or use the resulting software?