Slashdot Mirror
Symantec Tells Customers To Stop Using pcAnywhere
Orome1 writes "In a perhaps not wholly unexpected move, Symantec has advised the customers of its pcAnywhere remote control application to stop using it until patches for a slew of vulnerabilities are issued. If the attackers place a network sniffer on a customer's internal network and have access to the encryption details, the pcAnywhere traffic — including exchanged user login credentials — could be intercepted and decoded. If the attackers get their hands on the cryptographic key they can launch remote control sessions and, thus, access to systems and sensitive data. If the cryptographic key itself is using Active Directory credentials, they can also carry out other malicious activities on the network."
Most /.er's stopped using your products a long time ago.
Next up, Intel CEO admits "McAfee is just bloatware that doesn't actually do anything. To be honest, most of it just runs loops that eat up CPU, so people think it's doing something and want to buy a faster Intel CPU. It hasn't stopped an actual virus since the mid-90's."
SJW: Someone who has run out of real oppression, and has to fake it.
this has nothing to do with the leaked source code. Right?
Something bad is coming when people are suddenly anxious to tell the truth.
If the attackers place a network sniffer on a customer's internal network...
You've got a hell of a lot bigger problems than pcAnywhere.
What the story doesn't mention is that the pcAnywhere source was nicked. It sounds like Symantec was aware of the weaknesses, and chose not to act until the source was stolen and the security weaknesses became public.
http://www.channelregister.co.uk/2012/01/18/symantec_leak_latest/
No kidding!!! What do you say at this point?
I can't understand why people still put Symantec on their PC. It's a bloated piece of crap that blocks everything without intelligently deciding if it's a good idea. When I had Symantec installed on my laptop, the CPU was at 100% and I had to manually turn off the firewall just to browse the web.
-- By all means let's be open-minded, but not so open-minded that our brains drop out.
Had to deal with this issue this morning
Extra information http://www.symantec.com/connect/sites/default/files/pcAnywhere%20Security%20Recommendations%20WP_01_23_Final.pdf
Presently if you use PCanywhere for WAN access disable now, if you use it in a closed network should be ok, unless someone is already on the network but if that is the case, you already have a problem better than this.
I think Symantec handled this ok, when Anon stated they had the source code last week Symantec issued a statement about what they had, mainly 2006 code. Anon yesterday declared they had a few zero days Symantec issued a statement dealing with it last night.
I remember the first time I used it. It was a Godsend. It was so nice to simply take control and do it rather than sit there on the phone saying, "Click Start. Start. It's on the bottom left. S-T-A-R-T! No, don't type it. Click the button labeled 'Start'. No, it's not on your keyboard. No, wait. Hit CTRL-ESC. Control Escape. It's on your keyboard. Press and hold control and then press and release escape. Keyboard. It's on your keyboard. Nevermind. Do you see Start on your screen?" Even though we were connecting via dialup, it was lightyears better than trying to imagine the screen the use was describing and then describing elements of it it back to them.
But those days are long gone. Now we have RDP, VNC, WebEx, and a host of other remote desktop utilities and protocols. There is no longer a need for PCAW.
There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
According to this article, the source code for PCANywhere was stolen from Symantec's network in 2006. That's right . . . . 2006. Good work Symantec. It only took you 6 years.
... and have access to the encryption details ...
Um.. yes. Combine those two things, and you might as well consider Ethernet cables to be inherently insecure.
I don't understand the concern here at all.
This isn't another juvenile does-it-run-on-linux rant, but I think its reasonable to point out that remote full screen GUI access via X windows has been around since the mid 80s. A LONG time before any remote GUI windows app or even Windows itself existed.
Just use a secret encrypted key exchange, like Diffie-Hellman, to set up a secure communication channel on the wire. While Diffie-Hellman may be susceptible to MitM attacks, it is about the closest thing you can get to foolproof protection against any form of eavesdropping on any type of broadcast channel, be that over radio, or on local ethernet line (unless the sniffer is a quantum computer, and would be thus break the encryption). To prevent MitM attacks, you need another type of system built on top of that, of course, but this article clearly states that the system in question is vulnerable to sniffers placed on the customer's physical LAN, and not MitM.
File under 'M' for 'Manic ranting'
Not immune.
http://en.wikipedia.org/wiki/Linux_malware
Don't know something? Look it up. Still don't know? Then ask.
Most of us have been advising people not to use pcAnywhere for more than a decade now. :)
Tired of FB/Google censorship? Visit UNCENSORED!
Are you kidding? If we're supposed to stop using pcAnywhere because the source code is out there, just think how unsecure Linux is! It's source code has been out there way longer.
(Your) pcEverywhere
Summation 2
Eventually there's going to be a story about IPv4 address space going scarce again. When that happens what copypaste drivel are you going to paste? Or are you willing to risk being on topic for once?
Non impediti ratione cogitationus.
The researchers continued, "If the Active Directory credentials were used as part of an DoD Exchange tie in, the attackers could get access to incriminating government official emails. If they got access to incriminating DoD emails, they could extort nuclear launch codes out of the officials. If they extorted launch codes out of the officials, they could start a nuclear holocaust."
The researchers concluded, "and that is why you never give a mouse a cookie."
So I understand that Symantec is either using very poor cryptography or even exchanging authentication credentials in plain text!
Have they had any chance to read a few basic documents about, say, ssh?
M0R0N5!
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
you are of coarse correct , unfortunately 90% or so of offices in the U.S are 'doing it wrong'
âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
but rather a 'feature'. Software package to be renamed to pcAnyone.
Availability of source code isn't a problem if you don't depend on "security by [source] obscurity." The problem is that Semantec not only relies on source obscurity but didn't do anything (for years) when the weak security was defeated by exposing the source.
The goal of security is not to hide the security method but to make it clear that not having something (e.g. a key or lock combo) will make it very difficult to penetrate. Essentially you want put it all on the user. You make it so hard to break the security that it makes compromising the user easier. You steal his keys even though you know how the key was cut with a laser and how its RFID tag works. You steal his private encryption keys even though you have the encryption algorithm. If a vault is good enough, you'll have to attack the owner until he gives up the vault's combination.
If you want to obscure your design details to add one more hurdle, go for it. Just don't depend on it keeping you safe. Layer's folks. Security by obscurity is a single layer. You shouldn't let it be a single point of failure.
Class-action suit in 3 .. 2 .. 1 :-)
No really a company that pretends to sell security is compromised in 2K6, refuses to inform anyone about it. So technically, if someone is able to provide some sort of proof that systems are compromised because the source code is out in the wide open as of 2K6 and $$$ got lost, then it's up to Symantec to pay for it.
This is the stuff that I really intensively hate about the ICT sector, them 'take the money and run' companies that don't give a damn about anything, as long as the sales figures are going up.
if the attackers place a network sniffer on a customer's internal network
...that customer has much bigger problems to worry about than Symantec applications.
Bow before me, for I am root.
Microsoft's terminal services are pretty decent. It seems you've not used them.
"Symantec Tells Customers To Stop Using pcAnywhere" ...IT staff have been begging users to stop using pcAnywhere for years.
"You want to know how to help your kids? Leave them the fuck alone." -George Carlin
There is no reason for remote access to a desktop PC in a business environment.
I can understand remote access to data and remote application sessions (citrix/terminal services/remote desktop server/etc), but what is the business case justification for remotely logging in to the PC on your desktop at work?
"You want to know how to help your kids? Leave them the fuck alone." -George Carlin
Work from home ?
Symantec has bought out several good companies where there is no good replacement yet ( free or commercial ).
Im taking things such as Ghost ( corporate, not the mess they made of the home version ), much of the Altiris management suite and workflow, some backup tools... And I'm sure there are others too.
But i agree, that most of what they have bought they have eventually destroyed, and what isn't toast yet will be in time.
---- Booth was a patriot ----
No, you are correct. Viruses and Malware exists for Linux.
Now compare it to the windows list http://en.wikipedia.org/wiki/List_of_computer_viruses. It's split into 5 separate wiki pages, all of which are at LEAST 5 times longer the entire Linux list.
When dealing with STDs, which are you more likely to catch one from, the cheap whore house with asian girls in slavery, or the Playboy mansion.
Did you even read what you linked to? The link doesn't even come close to backing up your point. In fact, its lack of naming a single piece of malware in the wild actually moots your point (yes, I verbified a noun).
The worst it has to say is that the kernel didn't prevent buffer overflows until 2009. You only need AV on Windows. Yes, you can be socially engineered on any OS, trojans will run on any OS, and no AV will protect you from deliberately installing anything you want. And yes, given a dedicated enough cracker any sytem can be compromised in time.
But as long as you're not a complete idiot, the only platform that's at risk is Windows.
Free Martian Whores!
Did you even read what you linked to? The link doesn't even come close to backing up your point
I did, it does. First sentence even.
But as long as you're not a complete idiot,
My point was simply that it is not immune, nothing more.
Don't know something? Look it up. Still don't know? Then ask.
When dealing with STDs, which are you more likely to catch one from, the cheap whore house with asian girls in slavery, or the Playboy mansion.
Herpes is pervasive in the adult entertainment industry so you are likely to get one from either choice, but yes you are more likely to get a deadly STD from the the whore house than from the bunnies.
Don't know something? Look it up. Still don't know? Then ask.
LogMeIn, RDP, VNC.. all better alternatives to paying for that shit.
WHO NEEDS SHIFT WHEN YOU HAVE CAPSLOCK/ DAMN1
hahaha, this is funny. My company just rolled out pcAnywhere across all desktops (internally!)
---- Put Sig here:
Appearently you have never worked in I.T doing things like uh, I don't know SUPPORT.
No you can't give the user the admin password to rejoin the domain or download the latest softare from the shares over the phone
1. So you can work from home. I don't keep 100% of my files on network shares, and don't even have the exact same programs loaded on my home pc, so I need to remote into my work pc sometimes.
2. So HelpDesk staff can remote into your pc for troubleshooting and support.