Feeds

Symantec source code leak becomes torrent

'In the name of god! You are killing our CPUs'

Secure remote control for conventional and virtual desktops

Hacktivists once again poked fun at Symantec after previously leaked source code for Symantec's Norton Utilities 2006 software was made available as a torrent on Monday. Symantec downplayed the significance of the leak, saying it only involved obsolete code that had already been exposed.

AntiSec tacked a mocking note onto the release of a 52MB file, which was uploaded to The Pirate Bay and other torrent tracker sites on Monday. "Anyhow with this release is nothing really to prove, just stop making shitty software in the name of god! Your [sic] are only killing our CPU's! [sic]"

"Respect & greetings to @AnonymousIRC @Par_AnoIA."

Back in January, a hacking group calling itself The Lords Of Dharmaraja boasted about stealing the source code for Symantec's security products from Indian government systems.

The security giant initially blamed the leak of source code for older enterprise products on a breach at the network of an unnamed third party, before later admitting that the source code of pcAnywhere and consumer products had also been exposed. It also confessed that the leak was actually down to an earlier (previously undetected) breach of its own systems back in 2006.

It said source code for the 2006-era versions of the following products had been exposed: Norton Antivirus Corporate Edition; Norton Internet Security; Norton SystemWorks (Norton Utilities and Norton GoBack); and pcAnywhere.

Symantec took the highly unusual step in early February of advising customers of pcAnywhere to suspend use of the older versions of remote control desktop management software pending the release of a patch. Shortly after the patch became available, The Lords Of Dharmaraja leaked portions of pcAnywhere source code, together with an invitation for hackers everywhere to pour over the code in order to identify exploits against systems running Symantec's remote control software.

In a statement, Symantec said this week's release is tied to the earlier breach but is less significant than the pcAnywhere leak because it involves only obsolete code.

"Symantec is aware of the claims made online that a group has posted the source code for Norton Utilities 2006. We have analyzed the code that was posted and have concluded that it is the same code that was already posted by another group in January 2012.

As we stated at that time, the 2006 version of Norton Utilities is no longer sold or supported. The current version of Norton Utilities has been completely rebuilt and shares no common code with Norton Utilities 2006. The code that has been posted for the 2006 version poses no security threat to users of the current version of Norton Utilities. Furthermore, we have no indications that the posting of this old code impacts the functionality or security of any other Symantec or Norton solutions.

Independent security experts, such as Imperva, have described the Lords Of Dharmaraja hack and subsequent source code leak saga as more of a trophy scalp for hacktivists than a serious risk to Symantec's customers.

"The implications of the anti-virus code leakage will not keep the Symantec folks awake too late at night, and certainly not their customers," Rob Rachwald, director of security strategy at Imperva, wrote at the time. "After all, there isn’t much hackers can learn from the code which they hadn’t known before [because] most anti-virus product is based on attack signatures." ®

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.