Symantec Tells Customers To Stop Using pcAnywhere

Orome1 writes "In a perhaps not wholly unexpected move, Symantec has advised the customers of its pcAnywhere remote control application to stop using it until patches for a slew of vulnerabilities are issued. If the attackers place a network sniffer on a customer's internal network and have access to the encryption details, the pcAnywhere traffic — including exchanged user login credentials — could be intercepted and decoded. If the attackers get their hands on the cryptographic key they can launch remote control sessions and, thus, access to systems and sensitive data. If the cryptographic key itself is using Active Directory credentials, they can also carry out other malicious activities on the network."

Comments

Way ahead of you, Symantec

[elrous0]

Most /.er's stopped using your products a long time ago.

Next up, Intel CEO admits "McAfee is just bloatware that doesn't actually do anything. To be honest, most of it just runs loops that eat up CPU, so people think it's doing something and want to buy a faster Intel CPU. It hasn't stopped an actual virus since the mid-90's."

Re:Way ahead of you, Symantec

[Baloroth]

t hasn't stopped an actual virus since the mid-90's."

I wouldn't say that, it seems to do a pretty good job shutting down Windows.

Come on

[jayhawk88]

If the attackers place a network sniffer on a customer's internal network...

You've got a hell of a lot bigger problems than pcAnywhere.

Re:Come on

[cduffy]

If the attackers place a network sniffer on a customer's internal network...

You've got a hell of a lot bigger problems than pcAnywhere.

Au contraire -- if your infrastructure isn't robust against this class of attack (all internal traffic authenticated and encrypted, particularly during password exchange), you're Doing It Wrong.

Moreover, the concept of "defense in depth" applies -- a hard outer shell with a soft inner core means that when the eventual successful attack does happen (and it will!), the damage is that much worse. You can't have decent security if you design all the internal components assuming that the outer layer will protect them.

Security through obscurity?

[Sockatume]

What the story doesn't mention is that the pcAnywhere source was nicked. It sounds like Symantec was aware of the weaknesses, and chose not to act until the source was stolen and the security weaknesses became public.

http://www.channelregister.co.uk/2012/01/18/symantec_leak_latest/

Re:Security through obscurity?

[jesseck]

The source was stole in 2006. This means that they corrected the problems in their other products which had stolen source, but not pcAnywhere. For 5-6 years, Symantec has been selling software which was potentially compromised.

The current reported theft happened recently, but that source code came from a theft (unreported by Symantec, but known) back in 2006. That means, since 2006, Symantec has known the pcAnywhere source was stolen, knew of vulnerabilities, and chose not to fix that product. It sounds like they patched the rest of their products, though.

Who still uses PCAnywhere?

[ArcherB]

I remember the first time I used it. It was a Godsend. It was so nice to simply take control and do it rather than sit there on the phone saying, "Click Start. Start. It's on the bottom left. S-T-A-R-T! No, don't type it. Click the button labeled 'Start'. No, it's not on your keyboard. No, wait. Hit CTRL-ESC. Control Escape. It's on your keyboard. Press and hold control and then press and release escape. Keyboard. It's on your keyboard. Nevermind. Do you see Start on your screen?" Even though we were connecting via dialup, it was lightyears better than trying to imagine the screen the use was describing and then describing elements of it it back to them.

But those days are long gone. Now we have RDP, VNC, WebEx, and a host of other remote desktop utilities and protocols. There is no longer a need for PCAW.

Re:Good Job Symantec

[elrous0]

It only took you 6 years.

They would have gotten an email out sooner, but Norton was REALLY slowing their computers down.

Re:Finish that sentence!

[alittle158]

...you might as well consider Ethernet cables to be inherently insecure...

Shh...don't let the people at monster cable know that. They might find a new source of revenue in "encrypted ethernet cables"