Slashdot Mirror
Cops Set Up Extortion Sting On Symantec's Source Code Thieves
Sparrowvsrevolution writes "Hackers linked with Anonymous leaked another 1.26 gigabytes of Symantec's data Monday night, what they say is the source code company's PCAnywhere program. More interestingly, also posted a long private email conversation that seems to show a Symantec exec offering the hackers $50,000 to not leak the company's data and to publicly state they had lied about obtaining it. Symantec has responded by revealing that in fact, the $50,000 offer had been a ruse, and the 'Symantec exec' was actually a law enforcement agent trying to trace the hackers. It adds that all the information the hackers have released, including a 2006 version of Norton Internet Security, is outdated and poses no threat to the company or its customers. Symantec says the Anonymous hackers began attempting to extort money from the company in mid-January, and it responded by contacting law enforcement, though it won't comment on the results of the fake payoff sting while the investigation is still ongoing."
FTFY
SJW: Someone who has run out of real oppression, and has to fake it.
They would've taken the money. More likely they "offered" money whether it was in a sting or not in order to be able to claim extortion and put the Anonymous hackers in a bad light.
I don't think the hackers are interested in money as much as they are in the information. The fact is Symantec screwed up and they'll have to take it, if they can't protect themselves then why should we trust them?
Custom electronics and digital signage for your business: www.evcircuits.com
Frightening that Anonymous bothers to do it, or that they're actually successful?
Long signatures suck.
Edited short version:
.... Anonymous leaked ... the source code company's PCAnywhere program... Symantec has responded ... all the information the hackers have released... poses no threat to the company....
Its like they're tempting the world to diff their source code up against GPLed prior art to find license violations. I think it would be hilarious if it turns out pcanywhere was just a wrapped version of one of the numerous GPLed VNC implementations or similar.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Of course, anybody who's dealt with Anonymous knows they will try to get you to promise to sell out your customers or otherwise act in a way that's in your interests and detrimental to the interests of everyone you claim to 'protect'. They've done this multiple times. If I were an Anonymous target I would never agree to such a scheme because all that would happen would be that the conversation be published to make me look bad.
Of course, having it be a 'police sting operation' is a great way to make it look like you weren't really going to sell out your customers. And who knows, maybe it's even true. And maybe all that source code really is for 'old versions'.
But, the really incriminating evidence would be if there were emails showing that Symantec has been sponsoring or encouraging virus writers in some way. And I'm certain if Anonymous had that kind of evidence that it would be out in the open by now. So that means they don't. And maybe Symantec isn't as much of a sleaze bag company as I expected them to be.
Need a Python, C++, Unix, Linux develop
Security code should be open for review anyway, or it's probably full of bugs and worthless.
Definitely the latter. Whilst I can agree with some of their arguments, I can't help but worry that a collective risen up from the cesspool that is 4chan wields such power.
Symantec and FBI attempt to patch security vulnerability with cash.
Inheritance is the sincerest form of nepotism.
How would they receive the $50K anyway? Split it up between all members who are supposed to be anonymous? Symantec/Police: Who do we make this check out to? Anonymous: Cash. Symantec/Police: Damn, foiled again!
I see it as the evil mirror reflection of what business & politics has risen up and wielded such power.
There are two types of people in the world: Those who crave closure
now they have a venue where we can see them easily.
They have for decades. It's just that C-SPAN was so fucking boring, nobody bothered.
The cesspool is you and me. They aren't any more dumb or smart than the individuals that compose them at any given time. Nothing is surprising about this unless you haven't been on the internet for a while.
Frightening if you're Big Brother. Seems Anonymous has been looking out for the little guy so far. I definitely wouldn't want to be a CEO of one of these evil megacorporations with Anonymous watching me.
my karma will be here long after I'm gone
Let's see... grinds system to a halt, hard if not impossible to remove short of a reinstall, gives you no information what it actually does, contacts its maker and downloads code after sending god knows what...
Yep. The pattern matches.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
It adds that all the information the hackers have released, including a 2006 version of Norton Internet Security, is outdated and poses no threat to the company or its customers
Let's be honest - even a 2012 version of Norton Internet Security is outdated. And yes, I realize the context of the quote is referring to customer data, but it had to be said.
I hold your frightening and raise you a "duh".
If you spend at least a month in IT security you'll easily see why duh. When you decide for that path, well, at least when I decided, the goal was to make the systems of the companies I work for secure. Safe from hackers, secure against all kinds of attacks. That was the plan, that was the goal.
Now, about 10 years into the business, the dream has faded. That's not what I do. What I do is writing guidelines and processes nobody reads or bothers to heed, ticking off checklists to be compliant with some law from the ancient days (i.e. any time more than a year ago in security) and generally trying to cover my ass for the moment when (not if, when) the shit hits the fan.
Because secure, we are not. But we're compliant with about any security protocol or certificate you could name. From BS7799 to ISO27001, from NERC1300 to pretty much all of its CIP substandards. And some PCI-DSS on top. Audit us by any standard you please, free choice, we'll pass.
Compliance != Security, though. It's better than nothing, I give you that. And some kind of standard has to be found or nothing will ever improve. The problem is that managers don't give half a shit about security. What they care about is the legal matter behind it. It's commendable that our lawmakers finally realized that companies that store important and private data should be forced to uphold some kind of security standard.
If we could now get some security standards that deserve the name, we could start talking.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Anonymous isn't more a coherent group than the "people who like garlic bread".
It is much easier to determine who is a member of the second group. Plus the "people who like garlic bread" can't sneak up on you.
Wow, what a great argument. Other places are more evil. So business buying politicians isn't bad. And don't ever talk about one without saying other things are worse.
And then you end with a 'grow up' charge.
You didn't win anything on the debate team, did you?
There are two types of people in the world: Those who crave closure
Wait, people still use PCAnywhere?
I'm a good cook. I'm a fantastic eater. - Steven Brust
Anonymous is us. Business and politics is the evil reflection.
Give me Classic Slashdot or give me death!
They had already committed the crime, the sting was to get them to give away their identity so they could be prosecuted for it. It's a legitimate tactic.
Same dumb argument you used before. Somalia>corruption so not allowed to talk about corruption.
Guess what? Corruption is evil. Maybe not Somalia evil, but still evil.
Also, you don't get to judge what my definition of evil is.
Apparently you haven't argued with too many people in the real world.
There are two types of people in the world: Those who crave closure
Do tell, oh nice Law Enforcement and Symantec Execs, what "links" this thieves with anonymous?
NO SIG
Self interest is the root of evil. Those people being mutilated happens because it is in the self interest of the mutilator. You are trying to argue shades of gray here.
Did it occur to you that maybe Somalia and Afghanistan didn't start out evil, but had to allow certain things to happen to become so?
And that maybe we're allowing those same things to start happening here?
Check your premises.
Bluntly, I prefer them doing it and shaming companies that don't give a shit about their security to the alternative, industrial espionage you don't notice 'til it's far too late.
At least this way managers are pissing their pants and upping the security budget. No kidding, my budget skyrocketed this year.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Agreed: if corporations were people, they'd be sociopaths.
"For a successful technology, reality must take precedence over public relations, for nature cannot be fooled." Feynman
The unfortunate fact for those who want to vilify business, or any other group, is that just like any other group, only a very small percentage of that group actually does that stuff. The vast, vast majority of business people (both statistically and in my own mid-size experience over 40 years) try to do the right thing all the time. It's not always obvious what the right thing is, but they try. Most businesses would rather not mess with politics at all, and many donate token amounts of money to campaigns on both sides just to avoid the 'gentle' extortions that the Federal politicians and bureaucracy impose on them.
Just like in every other field, the stuff you hear about in the news is there for two reasons: It's unusual (i.e. it is 'news'), and it is shocking/depraved/bleeding/evil/ or whatever other form of titillation the media think will sell. If it were really common, it wouldn't be in the news.
A while back (1990s IIRC), the IRS did a line-by-line audit of a larger than usual number of small business owners - companies in the $5 million to $30 million range, just to see how much cheating was going on. Their finding was that the vast majority of said owners were paying an average of 5% more in taxes than they were required to, because it was less hassle and less risky to avoid taking questionable deductions.
I've worked with corporate heads of Fortune 500 and Global 1000 companies as well, and the same is true there. Most, not all, are trying to do the right thing. Those who are willing to use shady means are often shunned because they can't be trusted within the organization either.
It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
Seems Anonymous has been looking out for the little guy so far.
Yes, by leaking their credit cards and personal information.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"