Symantec Admits Its Networks Were Hacked in 2006 113
Orome1 writes "After having first claimed that the source code leaked by Indian hacking group Dharmaraja was not stolen through a breach of its networks, but possibly by compromising the networks of a third-party entity, Symantec backpedalled and announced that the code seems to have exfiltrated during a 2006 breach of its systems. Symantec spokesman Cris Paden has confirmed that unknown hackers have managed to get their hands on the source code to the following Symantec solutions: Norton Antivirus Corporate Edition, Norton Internet Security, Norton Utilities, Norton GoBack and pcAnywhere."
Thanks a bunch (Score:5, Interesting)
As this includes a Corporate version, I'm sure enterprises just LOVE to hear that the company to whom they entrust a certain amount of their data security completely lied to them about the effectiveness of that security, and covered up the fact that future use of their product might be for naught.
Re: (Score:3)
Source code in this case is mostly a list of things the software does to attack viruses... they gave away a copy of their secret sauce recipe. Doesn't make the burgers taste worse, it just opens them up to being subject to competition.
Re: (Score:3, Insightful)
You are saying (with a straight face) that having the source code that describes in detail how the software goes about removing viruses is of no use to the people who write them? Go to a doctor immediately and get checked out for massive brain tumors.
Re:Thanks a bunch (Score:4, Insightful)
Other than perhaps finding sploits in Symantec itself no I don't expect looking at virus removal code to be terribly useful to those developing malicious code.
Look yes the AV stuff gets its hooks in pretty deep but until they start implementing their own filesystem drivers and stuff like that (they don't, not on desktops anyway) then there is a finite set of APIs and syscalls they can use. They are mostly documented, or otherwise known. Reading the source to Symantec's AV scanner is not going to give you a lot of insight into how to write something it can't clean up.
Re:Thanks a bunch (Score:5, Insightful)
How they use their signatures and heuristics to detect threats is of great use to attackers. Thinking otherwise is naive.
Re: (Score:2)
Re: (Score:2)
Always good to lift the skirt. Some things never change. And the damage was done back then. Today the bad guys are doing what works today .
Re: (Score:2)
Re: (Score:2)
In the fast moving arms race between malware and anti-malware writers, you can bet that anything important and exploitable will have changed in such a long time span.
but a virus writer will try it anyway...so then you'd want to make really sure it actually has changed...rather than just making assumptions.
Re: (Score:2)
Funny thing is, i read recently of a botnet that used boot sector infections as part of its distribution strategy. And it works, because it seems that various security companies have stepped down their boot checks because nobody used those kinds of attacks any more...
Re: (Score:3)
I've got a computer on my bench that has a virus symantec corp edition is currently protecting. Attempts to remove the file run afowl of symantec, and I can't kill symantec because it refuses to disable or uninstall (can't manually stop services either).
Little bastard has hooks all over the place and is a variant of the "Your harddrive is failing, pay us monies to fix it!" that actually deletes all the start menu shortcuts instead of just moving them.
Re:Thanks a bunch (Score:4, Funny)
> Little bastard has hooks all over the place
This was my experience with Symantec software, too.
Re:Thanks a bunch (Score:5, Informative)
Aaaand, you believe that's not one of the hundreds of variants, or a new variant that also installs other malware, because? I hope you're not the kind of person that "removes" viruses for a fee, and after my Aunt has paid you, she comes home and looks through her image library and gets re-infected...
Just to be perfectly clear: WIPE the drive, FLASH the mobo BIOS, REINSTALL the OS. There is NO SUCH THING as removing malware. Unless you watched that sucker get installed while stepping through it with a debugger, you don't really know WTF is going on or what else it has done.
Perhaps you're just playing with the viruses, cultivating them and studying them before they're released into the wild; Either this, or you don't realize that you are...
Re: (Score:1)
Oh fuck, you obviously have no clue. I do this for a living and your one of the idiots that give me more business. Because people don't like getting WIPED. They like getting fixed.
Re: (Score:2)
... and people are wrong.
But don't let that stop you from abusing the retards of the world. They're there to be used, after all.
Re: (Score:1)
I suggest you go do some research on the current state of virus removal.
90% of the viruses you will deal with on a daily basis are based on the same kits.
This means that they follow the same basic methods for infection, self-preservation, and spreading.
Most of the time, with tools like Process Monitor, you can identify a few of the payload files and upload them to virustotal.
Re: (Score:2)
"Nuke and Pave" is an optimal solution if you have backup of all necessary data and installers and prioritize having a clean machine over speed of cleaning. It's not if you do not.
Sadly, most home users do not have such a backup, and most "computer shop" people find it faster to try to go after infection with surgeon's approach then to simply backup data and nuke the machine. Problem is, regardless of how accurate your searches are, you may still miss something. So you have to choose between being certain t
Re: (Score:2)
Never mind the chance that a backup actually houses a copy of the malware in the first place, and so restoring from backups may well bring the nasty right back...
Re: (Score:1)
You restore from backup, then start the cleanup over again if any important data is damaged or lost.
Or
You restore the backup to a separate drive and manually recover and clean the files that were determined to be vital.
Where I work, losing customer data is NEVER an option. If it can be prevented in any way, we do so.
Re: (Score:1)
Most home users don't have any type of backup.
Unfortunately, neither do most small businesses.
A residential user who has to reinstall a new software can either purchase it or go download a free alternative. It's an annoyance, but not world-ending.
A LARGE number of small businesses have custom software/databases/configuration that was installed for them by a vendor at some point.
Often, this vendor is unreachable/shut down/dead or wa
Re:Thanks a bunch (Score:5, Funny)
re: virus removal (Score:2)
As one of those guys who DOES get paid to remove viruses, I have to disagree with you....
Yes, a complete wipe of everything and a fresh reinstall is the only way to be 100% sure you eliminated whatever malware or virus was on a given machine. BUT, that's like telling the exterminator he should just burn your entire house down to get rid of the ants or spiders you called about, because simply spraying some poison down doesn't guarantee they're all gone.
I've actually gone through the whole "backup data, wipe
Re: (Score:2)
If all you have is a virus, that can delete files and make a nuisance of itself, then a wipe/reinstall is really just doing a better job than the virus would have. I mean, isn't losing all your data what you were afraid the virus would do anyway?
On the other hand, if its malware you're worried about, then a wipe/reinstall is really the best option.
You have to weigh up the cost of reinstalling and restoring backups, against the potential cost of having your bank accounts, email accounts, or even your identit
Re: (Score:2)
Wow, did a shady repair shop tech kill your family or something?
Just wondering because holy crap, you make some huge assumptions as to who and what I am, what's going on, and what I'm capable of.
I've been an IT admin overseeing ~120 state employees for almost 5 years now. When one of my users screws their computer up I fix it, and due to state laws and regulations I'm not allowed to force any changes to our systems that would prevent this from happening on a weekly basis.
I'm also really good at dissecting t
Re: (Score:1)
Re: (Score:1)
Symantec has a removal tool available on their web site which will remove the software, but you should absolutely not do this until the virus has been removed.
As for removing the virus itself, good luck.
My experience is that you can not effectively remove a virus from inside the infected operating system.
Pull the drive, scan from a different system running a different OS, scan
Re: (Score:2)
um, sorry but this is just wrong.
If Symantec is able to disable itself, then the source code definitely allows a virus-writer to do disable it too.
Having insight into how the AV works, gives them greater ability to disable it, if not work around it.
Re: (Score:2)
Yes I am. If you know of an exploit the source code doesn't cover, you know of a 0-day. That use to happen all the time but Microsoft has gotten better at it.
Re: (Score:1)
Yes I am. If you know of an exploit the source code doesn't cover, you know of a 0-day. That use to happen all the time but Microsoft has gotten better at it.
So you're saying Microsoft products are a 0-day virus?
Re:Thanks a bunch (Score:4, Insightful)
Horrible analogy, because the scenario is adversarial in nature.
A far better one would be that the other team just stole your playbook. Your QB still throws the same, your receivers run just as fast, your linebackers still do their thing, but now the other team can anticipate all your plays and outwit you far more often.
Re:Thanks a bunch (Score:5, Informative)
Anybody that still uses Symantec software more or less deserves what they get. I can't imagine that the enterprise version is any less crappy than the home version is.
Re: (Score:3)
We have the Enterprise version where I work - one of my more recent responsibilities is monitoring it. Overall, it's pretty good at detecting most infections but doesn't always remove the infection. Personally, I'll keep using MS Security Essentials on all of my PCs
Re: (Score:3)
The only reason for any of the enterprise-level apps is centralized updating and control. Security Essentials works with WSUS now, so you get the updating, but still, you have no good way to monitor which workstations are well protected or which ones have a problem. At the end of the day, my shop is small enough that I can manage the slightly extra load of a checking things out. I haven't actually had a problem with MS Security Essentials, though back in the day when I was using Norton, it was always screwi
Re: (Score:1)
FYI, the license on Security Essentials is for up to 10 machines at small business. Anything past that (and since you've got WSUS setup, you're probably bigger than that), and you need to move up to MS Forefront Endpoint Protection.
Re: (Score:3)
We used to run the Norton Corporate product and we loved it. It is much lighter on system resources than the retail product. Corp 9, then Corp 10 then Corp 11.
Once we hit version 11 we had a problem. Every time it did a download and update, it would keep a copy of the older downloads and updates. Every 3 months our hard drive would run out of room. The solution a) wait for the patch to fix this for customers with this issue and b) uninstall the software from the server, reinstall it, and then manually ever
Re:Thanks a bunch (Score:4, Interesting)
I am looking right now at a computer with 2 fully-loaded cores that has been viris scanning for 25 solid hours. This is typical. It starts up after EVERY login, then just sits and churns forever with no visible progress. Or sometimes it finishes after a few seconds.
Sometimes you go to run some other program and it will just freeze up until/unless you kill navx (if you're lucky enough to have admin rights).
Or you're sitting on a plane, and it decides now would be a fine time to fire up and drain your battery in 40 minutes.
I can't leave my email box open because it pops up every few seconds and says THREAT DETECTED! (probably in some old email in mail spool already marked as deleted), but you press OK to fix, and after a few seconds it says it failed to repair it, no other explanation, so it pops up a modal dialog box in front of whatever you're trying to do. This occurs a couple times per minute, forever.
I hate it.
Re:Thanks a bunch (Score:5, Interesting)
Some years ago at a previous job, IT decided that 10:30 am would be the perfect time to schedule a full scan of the computers. The rationale being that the computers wouldn't be hibernating or powered off.
So, promptly at 10:30 am, my machine would lock up and be 100% CPU and memory bound for about 2 hours or more. I asked IT to reschedule it, as it was interfering with my work .. they said no. I told them that I was going to bill them 2 hours/day for the time lost ... they said I can't do that (at the time, they billed customers $1500/day for me).
Then I finally told them that since I had local admin privileges, and unless they were willing to change it, I was simply going to uninstall the AV software ... which I ended up doing. And, when people started to uninstall it, they found they had no choice but to change the schedule ... because it was making it impossible for people to do their jobs and HR didn't like the fact that everyone was in the break room bitching about the fact that their computers were unavailable to them.
In my experience, most enterprise AV solutions cause more lost productivity than the things they're meant to prevent.
I'm about one upgrade of AVG away from finding an alternative ... because it suddenly decides that it wants to update, and that I need to reboot right now, or postpone as much as 60 minutes. The problem is that I'm using the computer for my job, and I will tell it when it can reboot or update ... but when it pops up a modal dialog while you're typing, with "OK" selected by default, you can get a case where you've clicked "sure, go ahead and reboot" before you even realize the dialog has been presented. So all of a sudden your machine starts shutting down out from under you.
AVG didn't always suck, but over the last few versions it has become nag-ware which wants to instal crap toolbars in my browser and otherwise do shit that I've not asked it to do.
The use of a modal dialog box that grabs focus should lead to someone being staked to an ant-hill in the hot sun -- I'm running more than your program, and just because you want to do something doesn't mean I don't get a vote.
Unfortunately, I find that AV in general is far more pushy and annoying about deciding it's in charge.
Re: (Score:3)
Comodo antivirus is very good, but really invasive. As a corporate user it's worth having a licence around, and if you get a machine that you really aren't sure what's up with it, try comodo. Then uninstall it once it is done working. It's the only English AV I've found that will reliably detect chinese virii, or other languages, but chinese is particularly troublesome.
Failing that, there's always MSE and avast which are generally 'good enough' for day to day use.
The idea that the anti virus should updat
Re: (Score:1)
Re: (Score:2)
I think your case is more of an IT failure then anti-virus failure. If they properly configured the scan times as well as make them happen less often (why daily scans?), it would work much better for everyone involved. Instead, it seems like you got a dick in IT who figured his needs eclipsed everyone else, while not even properly knowing what his needs are.
Re: (Score:1)
To me it sounds like the problem is the paranoid configuration set by your systems administrator. I work at a company that has more than 100 OSX computers running SEP 11 and I never heard anyone having issues like that, apart from the annoyance of the LiveUpdate application popping once a day.
Re: (Score:1)
The enterprise edition of Symantec has one redeeming quality, it doesn't expire. Some of my computers have been running it over 10 years with NO ransom fees, but without software support.
I made grandma an enterprise user years ago, it's better than nothing as it keeps well known pests away. Grandma won't run Linux she likes her Juno mail client.
Re: (Score:2)
The enterprise edition of Symantec has one redeeming quality, it doesn't expire. Some of my computers have been running it over 10 years with NO ransom fees, but without software support.
And it actually still gets virus signature/engine updates that can detect new viruses?
Re: (Score:2)
Yes. I still have a copy running on my old machine (my old university had a license for all students and teachers to use corporate version). I believe I installed the AV around 2006 or so when I bought the machine and installed XP.
It still gets signature and engine updates for both AV and FW.
Re: (Score:2)
Whew (wipes brow),
For a moment there, I saw your thread title, and thought you were thanking bonch; I was about to skip right to the next thread.
But now, since the source is open, maybe we can all work together to fix it....
Come to think of it, they made more money with it broken than they would ever make with it fixed.
cheers,
Re:Thanks a bunch (Score:5, Insightful)
Realize that no piece of security software will keep you safe indefinitely from a determined hacker. That applies to security companies as well.
Re: (Score:2)
Realistically, it probably wouldn't affect a single sale. The reason is that companies buy SEP not because of its virus stomping capability. They buy it because it has good audit logging, works with Cisco's NAC, and checks that all-important little box off about "do these machines have antivirus on them?".
If SEP wasn't able to report that machines were up to date, didn't lock out "hack tools", and didn't work with the healthcheck features, then Symantec would be in a world of hurt.
As for security, even wi
Re: (Score:3)
If the software is decently written, then exposure of the source code won't matter anyway.
Exposure of the sourcecode is only going to be a problem if its full of easily noticeable exploitable holes.. Such a situation would be unforgivable, since you'd have expected them to fix such holes internally anyway.
The sourcecode for Linux, OpenBSD, Apache and many other widely used pieces of software are already available to the public, and it doesn't result in mass hacks against these systems. On the contrary, many
Re: (Score:2)
So you are saying that now that the code is out there Symantec is going to use the community to fix the massive problems that will be revealed?
I think that you are giving them too much credit.
Re: (Score:2)
Hmm. 5-6 years. I'm guessing that's enough time, given the corporate turnover rate, for anyone who could be held responsible for entrusting such data to Symantec to pack their bags and pass the buck. For anyone who's left, how's it go again? Something like, "nobody ever got fired for buying IBM equipment." I wonder if there's an equivalent today regarding security and trusting your data to third parties. Clearly, having management learn something other than "VPN equals security" and "large corporations are
Re: (Score:1)
"completely lied to them" Lied to them for 6 years! Is probably still lying.
Re: (Score:2)
Paden said that the 2006 attack presented no threat to customers using the most recent versions of Symantec's software.
Hmm... this too rather begs the question of why they didn't tell people.
Either they wanted to mitigate possible security threats by not letting the bad guys know they were vulnerable, or it was a marketing ploy that put customers in danger. Either way, maybe not so good...
Obscure CNBC reference (Score:1)
We have yet another winner of the Late Lameo award. You're such a lameo,
Surely this is a good thing... (Score:5, Insightful)
Surely this is a good thing, the hackers might release an anti-virus for Norton
Re:Surely this is a good thing... (Score:5, Funny)
Re: (Score:2)
I love the fact that comment got an +5 Insightful mod...only on Slashdot...
In all seriousness though that program is evil, I would be glad to see it lose market share by any measure, I never completely managed to remove it from an old desktop of mine (came pre-packaged) and that's despite removing all the program files, using their own uninstaller and purging the registries. I've since given the box away to a friend but I wiped all the drives before doing so and apparently it still comes up with popups occa
Re: (Score:2)
Indeed they have, it's endearingly called "applying the Linux patch"
*grins*
Re: (Score:2)
*crosses arms*
Obviously, I'm going to have to switch to McAfee (Score:5, Funny)
That'll be a lot better, right?
Re: (Score:2)
Better, switch to PC-Cillin and you'll be sure that nobody's exploiting your system. Because when it takes up 99% of your system resources you're sure as hell not going to bother turning it on anytime soon.
You're five years late.... (Score:3)
We have to take ten points a day off your score for releasing your findings five years late. Good luck keeping your GPA up.
In their defence... (Score:4, Funny)
...they were running McAfee at the time!
"exfiltrated" (Score:5, Funny)
the code seems to have exfiltrated
Wow, must be bad working at Symantec. Even the code wants to escape.
Re: (Score:2)
I still don't understand how code can have baby smooth skin...
GoBack... (Score:1)
They aint got Norton? (Score:1)
Why didn't they use Norton?
Re: (Score:2)
I KNEW IT! (Score:5, Interesting)
Was working with a company that was dealing with some security issues in late 2008, and we found out that the source of the breach was going right through Norton like a hot knife through butter. However, just about any other security solution would stop it. At that time, we theorized that whoever had created the problem had some intimate/inside knowledge of Norton systems and we even joked that "Symantec better check who has their source code".
Good, maybe now we'll have GoBack etc file formats (Score:4, Interesting)
If someone with illegally-obtained source code anonymously posts the Ghost and other file formats AND posts a credible "here's how I reverse engineered the file formats" document, and others use it to create open-source software to read the software, will Symantec have any recourse against those who write, host, or use the resulting software?
Re: (Score:3)
If someone with illegally-obtained source code anonymously posts the Ghost and other file formats AND posts a credible "here's how I reverse engineered the file formats" document, and others use it to create open-source software to read the software, will Symantec have any recourse against those who write, host, or use the resulting software?
If the cracker posts a document with a clear specification without any code examples, then users of that specification will likely be safe. If there is a single line of code in the spec, then it would be a big no no.
You're all missing the big picture (Score:3)
Who the hell outsourced the hacking to India, and have they really sunk so low?
I think we're all missing the big opportunity here (Score:2)
Norton Antivirus: De-Crappified, Open Source, Slightly Illegal Edition
Re: (Score:3)
The pay-for antivirus industry makes most of its money in valuing the updates that they send out. Open source at his point can write an antivirus heuristics program but can't get the staff to write good enough updates for known trouble programs.
Re: (Score:2)
The pay-for antivirus industry makes most of its money in valuing the updates that they send out. Open source at his point can write an antivirus heuristics program but can't get the staff to write good enough updates for known trouble programs.
So implement the code that downloads the updates.
Re: (Score:3)
In other words, you want to break the paywall.... these guys know security so that ain't happening.
Re: (Score:2)
If it's illegal (and it would be) they'd find a way to use Symantec's updates.
Open Source (Score:1)
If they just had open sourced their programs they wouldn't had lost face.
Their programs are just mechanisms. It's the filter data where the value is at.
2006? So... 6 year old code? (Score:1)
Re: (Score:2)
Surprised? (Score:2)
Considering my low esteem for their anti-virus products, I'm not surprised security is also of low caliber.
The breach makes me wonder if Symantec is even dogfooding their own security products. Wouldn't the drag on their systems from Norton cause such slow response times that hackers would lose interest and move on? Security through performance degradation!
Re: (Score:2)
They are not crazy enough to do this
Support (Score:1)
Even Bigger point being missed.... lawsuits (Score:2)
.... for each and every paying customer who's PC's were being compromised and having both their identity stolen as well as their PC's being used to help share and harbor malware. In 2006 I was still foolishly paying for that service. I should be receiving a refund for years of purchases, for failure to notify me that my security software was breached. By withholding this information they were willingly complicit in any illegal activities that happened on any of their customer's PC's. They continue to pu
Why are we assuming (Score:2)
Why bother... Symantec's code is already malicious (Score:1)
Yo dawg, we herd u liek malicious code, so we put some malicious code in your malicious code so you can ruin your computer while you ruin your computer by installing Symantec's software.
Security Software and Foreign Nationals (Score:1)
Re: (Score:1)
Yeah, like those guys will know what to do with it. The Symantec guys really are loosers!
ladeda (Score:2)
I had a MBR virus in 97, you may be asking what the point of that was, well ... neither I (back then) or Symantec (today) are doing anything meaningful. One major difference was I had a job and brought in money ... Symantec just extorts it from people who dont know better, all the while it bogs your machine down and is effectively useless at its one and only task.
Symantecs Free Public Service (Score:1)