Cops Set Up Extortion Sting On Symantec's Source Code Thieves

Sparrowvsrevolution writes "Hackers linked with Anonymous leaked another 1.26 gigabytes of Symantec's data Monday night, what they say is the source code company's PCAnywhere program. More interestingly, also posted a long private email conversation that seems to show a Symantec exec offering the hackers $50,000 to not leak the company's data and to publicly state they had lied about obtaining it. Symantec has responded by revealing that in fact, the $50,000 offer had been a ruse, and the 'Symantec exec' was actually a law enforcement agent trying to trace the hackers. It adds that all the information the hackers have released, including a 2006 version of Norton Internet Security, is outdated and poses no threat to the company or its customers. Symantec says the Anonymous hackers began attempting to extort money from the company in mid-January, and it responded by contacting law enforcement, though it won't comment on the results of the fake payoff sting while the investigation is still ongoing."

Comments

Cops set up FAILED exortion sting

[elrous0]

FTFY

Re:Cops set up FAILED exortion sting

[Tsingi]

Actually, after having read a portion of the emails, it wasn't anything close to entrapment.

Re:Cops set up FAILED exortion sting

[Anonymous Coward]

I wouldn't really call it "entrapment." That's if a cop tries to get you to commit a crime you were unlikely to commit. If I hack a major security company and steal their source code blackmailing the company is going to be right there on the list next to "sell on black market." Plus, it's not extortion since the "Symantec Exec" offered the money first.

Last I checked, the police are totally allowed to lie to suspects. Anything from "last night, your momma said you always were a bad kid" to "we have the smoking gun and it points at you and is covered with every type of DNA imaginable (which would also make you a gun pervert) and it matches to you. It also says you're late on your alimony. "

Re:Cops set up FAILED exortion sting

[postbigbang]

I believe that someone broke in and stole stuff from Symantec. I think that much is real. What did they steal? I don't think that we know the extent. Worse, I don't think Symantec knows, and that the extortion plot is possibly a ruse to save face on Symantec's part. Symantec and Verisign.... it seems like a potentially coordinated effort. I wish I could believe Symantec, but they've lied before and I feel they're untrustworthy. Does this mean that the facts are different than what they claim? For me, only third party verification of the claims will make me believe them. "Hacker communiques" are somewhat meaningless until someone coughs more code. I'm betting there's much more stuff stolen, but this is only a feeling.

And I admit that Symantec might be submitting the facts. But I have to doubt it until the picture becomes clearer. The fact that they had no knowledge of the break-in means that other areas were also vulnerable, and they didn't know that. In an organization whose business is the best security, being breached successfully is tough to forgive. Add in the fact that they're still not sure of the extent, and it seems as though internal systems failure could have been rampant-- and maybe they'll never know, but would NEVER admit such a thing. Heads ought to roll there in a major way. Enrique leaves a negative legacy there....

Re:Cops set up FAILED exortion sting

[AJH16]

Um, I know it is hard to RTFA, but perhaps you should RTFS.

"Anonymous hackers began attempting to extort money from the company in mid-January, and it responded by contacting law enforcement,"

In short, the hackers decided to try to extort Symantec and a police officer responded as if they were the executives. This is in no way entrapment and in no way reflects badly on the police at all. It was a perfectly reasonable attempt at tracking down the perpetrators. How successful it was or wasn't doesn't matter as a lot of law enforcement is trying different things until the criminals screw up. (And yes, the people that broke in to Symantec are criminals and don't deserve any respect or sympathy at all.)

If they were really extorting

[guruevi]

They would've taken the money. More likely they "offered" money whether it was in a sting or not in order to be able to claim extortion and put the Anonymous hackers in a bad light.

I don't think the hackers are interested in money as much as they are in the information. The fact is Symantec screwed up and they'll have to take it, if they can't protect themselves then why should we trust them?

Re:If they were really extorting

[Opportunist]

It's actually sad. The statements by the "criminals" are more believable and more likely true than the statements by the "serious company".

Re:If they were really extorting

[artor3]

I know that's what you want to believe, but read the emails. It's abundantly clear that they did want the money. The only reason they didn't get caught is because they refused to transfer the money in any way that might be traceable.

Anonymous are not the white knights you imagine them. Anyone can "be" them, and that causes them to attract a lot of thugs and sociopaths.

Re:Some things I agree with, some I don't

[John Napkintosh]

Frightening that Anonymous bothers to do it, or that they're actually successful?

Better option for the title

[fibonacci8]

Symantec and FBI attempt to patch security vulnerability with cash.

Who gets paid?

[bryansj]

How would they receive the $50K anyway? Split it up between all members who are supposed to be anonymous? Symantec/Police: Who do we make this check out to? Anonymous: Cash. Symantec/Police: Damn, foiled again!

Re:Some things I agree with, some I don't

[NatasRevol]

I see it as the evil mirror reflection of what business & politics has risen up and wielded such power.

Re:Some things I agree with, some I don't

[gparent]

The cesspool is you and me. They aren't any more dumb or smart than the individuals that compose them at any given time. Nothing is surprising about this unless you haven't been on the internet for a while.

Re:Some things I agree with, some I don't

[iamhassi]

Frightening if you're Big Brother. Seems Anonymous has been looking out for the little guy so far. I definitely wouldn't want to be a CEO of one of these evil megacorporations with Anonymous watching me.

Re:Some things I agree with, some I don't

[Opportunist]

I hold your frightening and raise you a "duh".

If you spend at least a month in IT security you'll easily see why duh. When you decide for that path, well, at least when I decided, the goal was to make the systems of the companies I work for secure. Safe from hackers, secure against all kinds of attacks. That was the plan, that was the goal.

Now, about 10 years into the business, the dream has faded. That's not what I do. What I do is writing guidelines and processes nobody reads or bothers to heed, ticking off checklists to be compliant with some law from the ancient days (i.e. any time more than a year ago in security) and generally trying to cover my ass for the moment when (not if, when) the shit hits the fan.

Because secure, we are not. But we're compliant with about any security protocol or certificate you could name. From BS7799 to ISO27001, from NERC1300 to pretty much all of its CIP substandards. And some PCI-DSS on top. Audit us by any standard you please, free choice, we'll pass.

Compliance != Security, though. It's better than nothing, I give you that. And some kind of standard has to be found or nothing will ever improve. The problem is that managers don't give half a shit about security. What they care about is the legal matter behind it. It's commendable that our lawmakers finally realized that companies that store important and private data should be forced to uphold some kind of security standard.

If we could now get some security standards that deserve the name, we could start talking.