Symantec braces for further source code leaks
Symantec today confirmed that the pcAnywhere source code published on the Web on Monday by hackers who tried to extort $50,000 from the company was legitimate.
A spokesman also said the company expects that the rest of the code stolen from its network in 2006 will also be made public.
Symantec’s acknowledgement followed the appearance of a 1.3Gb file on various file-sharing websites, including Pirate Bay, that claimed to be the source code of the pcAnywhere remote-access software.
Download activity for the BitTorrent file has been moderately brisk: As of mid-morning Tuesday, Pirate Bay identified 376 ‘seeders’ (the term for a computer that has a complete copy of the file) and about 200 ‘leechers" (computers that have downloaded only part of the complete torrent).
The Anonymous hacking collective claimed responsibility for posting the pcAnywhere source code.
"We can confirm that the source code is legitimate," said Cris Paden, a spokesman for Symantec, in an e-mail. "It is part of the original cache of code for 2006 versions of the products that Anonymous has claimed to have been in possession during the last few weeks."
Failed sting
Also on Monday, an individual or group going by the name ‘Yama Tough’ had published a series of e-mails on Pastebin that detailed an attempt to extort $50,000 from Symantec.
Previously, Yama Tough had claimed responsibility for stealing the source code to pcAnywhere and other Symantec security software. At one point, Yama Tough had threatened to publish the source code, but then recanted.
The Pastebin-posted e-mails covered negotiations between Yama Tough and someone identified as ‘Sam Thomas,’ supposedly a Symantec employee, over payment for not disclosing the source code. In fact, Thomas was a pseudonym used by US authorities, whom Symantec had alerted to the threat.
"In January, an individual claiming to be part of the Anonymous group attempted to extort a payment from Symantec in exchange for not publicly posting stolen Symantec source code they claimed to have in their possession," said Paden. "Symantec conducted an internal investigation into this incident and also contacted law enforcement, given the attempted extortion and apparent theft of intellectual property. The communications with the person(s) attempting to extort the payment from Symantec were part of the law enforcement investigation."
Paden declined to identify the law enforcement agency, but the FBI has jurisdiction in extortion attempts that affect foreign or interstate commerce.
The negotiations went on for nearly a month – beginning on 18 January – but broke down when Yama Tough rejected Thomas’ conditions, which included an offer of payments of $2,500 each month for the first three months, with the balance to be paid on proof that the copy of the stolen source code had been destroyed.
Yama Tough tried to spin a different story on Twitter.
"They’ve been tricked trolled into offering a bribe so the false statement be [sic] made we never had the code and lied =)," Yama Tough tweeted.
Symantec’s Paden also said it expects Anonymous to publish source code belonging to other products.
"We also anticipate Anonymous to post the rest of the code they have claimed have in their possession," Paden said. "So far, they have posted code for the 2006 version of Norton Internet Security and pcAnywhere. We also anticipate that at some point, they will post the code for Norton Antivirus Corporate Edition and Norton SystemWorks. Both products no longer exist."
Two weeks ago, Symantec took the unprecedented step of telling users of pcAnywhere to disable or uninstall the software until it could finish patching vulnerabilities it had uncovered. Symantec wrapped up that patching last week, and gave the all-clear to customers . Symantec has also offered free upgrades to pcAnywhere 12.5 for users of editions prior to version 12.0.
IDG News Service
Subscribers 0
Fans 0
Followers 0
Followers