Forgot your password?
typodupeerror
Security IT

Symantec Admits Its Networks Were Hacked in 2006 113

Posted by Soulskill
from the timely-disclosure dept.
Orome1 writes "After having first claimed that the source code leaked by Indian hacking group Dharmaraja was not stolen through a breach of its networks, but possibly by compromising the networks of a third-party entity, Symantec backpedalled and announced that the code seems to have exfiltrated during a 2006 breach of its systems. Symantec spokesman Cris Paden has confirmed that unknown hackers have managed to get their hands on the source code to the following Symantec solutions: Norton Antivirus Corporate Edition, Norton Internet Security, Norton Utilities, Norton GoBack and pcAnywhere."
This discussion has been archived. No new comments can be posted.

Symantec Admits Its Networks Were Hacked in 2006

Comments Filter:
  • Thanks a bunch (Score:5, Interesting)

    by John Napkintosh (140126) on Thursday January 19, 2012 @11:54AM (#38748454) Homepage

    As this includes a Corporate version, I'm sure enterprises just LOVE to hear that the company to whom they entrust a certain amount of their data security completely lied to them about the effectiveness of that security, and covered up the fact that future use of their product might be for naught.

    • Source code in this case is mostly a list of things the software does to attack viruses... they gave away a copy of their secret sauce recipe. Doesn't make the burgers taste worse, it just opens them up to being subject to competition.

      • Re: (Score:3, Insightful)

        by Dishevel (1105119)

        You are saying (with a straight face) that having the source code that describes in detail how the software goes about removing viruses is of no use to the people who write them? Go to a doctor immediately and get checked out for massive brain tumors.

        • Re:Thanks a bunch (Score:4, Insightful)

          by DarkOx (621550) on Thursday January 19, 2012 @12:38PM (#38748982) Journal

          Other than perhaps finding sploits in Symantec itself no I don't expect looking at virus removal code to be terribly useful to those developing malicious code.

          Look yes the AV stuff gets its hooks in pretty deep but until they start implementing their own filesystem drivers and stuff like that (they don't, not on desktops anyway) then there is a finite set of APIs and syscalls they can use. They are mostly documented, or otherwise known. Reading the source to Symantec's AV scanner is not going to give you a lot of insight into how to write something it can't clean up.

          • Re:Thanks a bunch (Score:5, Insightful)

            by rickb928 (945187) on Thursday January 19, 2012 @12:50PM (#38749150) Homepage Journal

            How they use their signatures and heuristics to detect threats is of great use to attackers. Thinking otherwise is naive.

            • It would have been useful 5 years ago. Thinking the source is unchanged since then is naive.
              • by rickb928 (945187)

                Always good to lift the skirt. Some things never change. And the damage was done back then. Today the bad guys are doing what works today .

                • In the fast moving arms race between malware and anti-malware writers, you can bet that anything important and exploitable will have changed in such a long time span.
                  • by dudpixel (1429789)

                    In the fast moving arms race between malware and anti-malware writers, you can bet that anything important and exploitable will have changed in such a long time span.

                    but a virus writer will try it anyway...so then you'd want to make really sure it actually has changed...rather than just making assumptions.

                  • by hitmark (640295)

                    Funny thing is, i read recently of a botnet that used boot sector infections as part of its distribution strategy. And it works, because it seems that various security companies have stepped down their boot checks because nobody used those kinds of attacks any more...

          • by Adriax (746043)

            I've got a computer on my bench that has a virus symantec corp edition is currently protecting. Attempts to remove the file run afowl of symantec, and I can't kill symantec because it refuses to disable or uninstall (can't manually stop services either).

            Little bastard has hooks all over the place and is a variant of the "Your harddrive is failing, pay us monies to fix it!" that actually deletes all the start menu shortcuts instead of just moving them.

            • by nigelo (30096) on Thursday January 19, 2012 @01:25PM (#38749672)

              > Little bastard has hooks all over the place

              This was my experience with Symantec software, too.

            • Re:Thanks a bunch (Score:5, Informative)

              by VortexCortex (1117377) <VortexCortexNO@S ... t-retrograde.com> on Thursday January 19, 2012 @01:31PM (#38749762)

              Aaaand, you believe that's not one of the hundreds of variants, or a new variant that also installs other malware, because? I hope you're not the kind of person that "removes" viruses for a fee, and after my Aunt has paid you, she comes home and looks through her image library and gets re-infected...

              Just to be perfectly clear: WIPE the drive, FLASH the mobo BIOS, REINSTALL the OS. There is NO SUCH THING as removing malware. Unless you watched that sucker get installed while stepping through it with a debugger, you don't really know WTF is going on or what else it has done.

              Perhaps you're just playing with the viruses, cultivating them and studying them before they're released into the wild; Either this, or you don't realize that you are...

              • by Anonymous Coward

                Oh fuck, you obviously have no clue. I do this for a living and your one of the idiots that give me more business. Because people don't like getting WIPED. They like getting fixed.

                • by RockDoctor (15477)

                  Because people don't like getting WIPED. They like getting fixed.

                  ... and people are wrong.

                  But don't let that stop you from abusing the retards of the world. They're there to be used, after all.

              • by operagost (62405) on Thursday January 19, 2012 @03:42PM (#38751950) Homepage Journal
                I'm glad you aren't a physician.
              • As one of those guys who DOES get paid to remove viruses, I have to disagree with you....

                Yes, a complete wipe of everything and a fresh reinstall is the only way to be 100% sure you eliminated whatever malware or virus was on a given machine. BUT, that's like telling the exterminator he should just burn your entire house down to get rid of the ants or spiders you called about, because simply spraying some poison down doesn't guarantee they're all gone.

                I've actually gone through the whole "backup data, wipe

              • by dudpixel (1429789)

                If all you have is a virus, that can delete files and make a nuisance of itself, then a wipe/reinstall is really just doing a better job than the virus would have. I mean, isn't losing all your data what you were afraid the virus would do anyway?

                On the other hand, if its malware you're worried about, then a wipe/reinstall is really the best option.

                You have to weigh up the cost of reinstalling and restoring backups, against the potential cost of having your bank accounts, email accounts, or even your identit

              • by Adriax (746043)

                Wow, did a shady repair shop tech kill your family or something?
                Just wondering because holy crap, you make some huge assumptions as to who and what I am, what's going on, and what I'm capable of.

                I've been an IT admin overseeing ~120 state employees for almost 5 years now. When one of my users screws their computer up I fix it, and due to state laws and regulations I'm not allowed to force any changes to our systems that would prevent this from happening on a weekly basis.
                I'm also really good at dissecting t

            • by operagost (62405)
              It may actually just be setting their "hidden" file attribute. I've seen that one. Kill that process if possible, roll back with System Restore, then run "attrib -h c:\users /s" (or "c:\documents and settings"). You might have to actually "-s" also for it to allow you to -h; I don't remember.
            • by eldorel (828471)
              Perhaps you should consider bring the system to an experienced shop who knows how to properly deal with rootkits and viruses.

              Symantec has a removal tool available on their web site which will remove the software, but you should absolutely not do this until the virus has been removed.

              As for removing the virus itself, good luck.
              My experience is that you can not effectively remove a virus from inside the infected operating system.
              Pull the drive, scan from a different system running a different OS, scan
          • by dudpixel (1429789)

            um, sorry but this is just wrong.

            If Symantec is able to disable itself, then the source code definitely allows a virus-writer to do disable it too.

            Having insight into how the AV works, gives them greater ability to disable it, if not work around it.

        • Yes I am. If you know of an exploit the source code doesn't cover, you know of a 0-day. That use to happen all the time but Microsoft has gotten better at it.

          • by skogula (931230)

            Yes I am. If you know of an exploit the source code doesn't cover, you know of a 0-day. That use to happen all the time but Microsoft has gotten better at it.

            So you're saying Microsoft products are a 0-day virus?

      • Re:Thanks a bunch (Score:4, Insightful)

        by forkfail (228161) on Thursday January 19, 2012 @12:51PM (#38749166)

        Horrible analogy, because the scenario is adversarial in nature.

        A far better one would be that the other team just stole your playbook. Your QB still throws the same, your receivers run just as fast, your linebackers still do their thing, but now the other team can anticipate all your plays and outwit you far more often.

    • Re:Thanks a bunch (Score:5, Informative)

      by hedwards (940851) on Thursday January 19, 2012 @12:03PM (#38748562)

      Anybody that still uses Symantec software more or less deserves what they get. I can't imagine that the enterprise version is any less crappy than the home version is.

      • We have the Enterprise version where I work - one of my more recent responsibilities is monitoring it. Overall, it's pretty good at detecting most infections but doesn't always remove the infection. Personally, I'll keep using MS Security Essentials on all of my PCs

        • The only reason for any of the enterprise-level apps is centralized updating and control. Security Essentials works with WSUS now, so you get the updating, but still, you have no good way to monitor which workstations are well protected or which ones have a problem. At the end of the day, my shop is small enough that I can manage the slightly extra load of a checking things out. I haven't actually had a problem with MS Security Essentials, though back in the day when I was using Norton, it was always screwi

          • by Anonymous Coward

            FYI, the license on Security Essentials is for up to 10 machines at small business. Anything past that (and since you've got WSUS setup, you're probably bigger than that), and you need to move up to MS Forefront Endpoint Protection.

        • by fwarren (579763)

          We used to run the Norton Corporate product and we loved it. It is much lighter on system resources than the retail product. Corp 9, then Corp 10 then Corp 11.

          Once we hit version 11 we had a problem. Every time it did a download and update, it would keep a copy of the older downloads and updates. Every 3 months our hard drive would run out of room. The solution a) wait for the patch to fix this for customers with this issue and b) uninstall the software from the server, reinstall it, and then manually ever

      • Re:Thanks a bunch (Score:4, Interesting)

        by timeOday (582209) on Thursday January 19, 2012 @12:53PM (#38749186)
        I have to use it at work under OSX and in a lot of ways it's worse than the virii it protects against.

        I am looking right now at a computer with 2 fully-loaded cores that has been viris scanning for 25 solid hours. This is typical. It starts up after EVERY login, then just sits and churns forever with no visible progress. Or sometimes it finishes after a few seconds.

        Sometimes you go to run some other program and it will just freeze up until/unless you kill navx (if you're lucky enough to have admin rights).

        Or you're sitting on a plane, and it decides now would be a fine time to fire up and drain your battery in 40 minutes.

        I can't leave my email box open because it pops up every few seconds and says THREAT DETECTED! (probably in some old email in mail spool already marked as deleted), but you press OK to fix, and after a few seconds it says it failed to repair it, no other explanation, so it pops up a modal dialog box in front of whatever you're trying to do. This occurs a couple times per minute, forever.

        I hate it.

        • Re:Thanks a bunch (Score:5, Interesting)

          by gstoddart (321705) on Thursday January 19, 2012 @01:19PM (#38749570) Homepage

          I have to use it at work under OSX and in a lot of ways it's worse than the virii it protects against.
          I am looking right now at a computer with 2 fully-loaded cores that has been viris scanning for 25 solid hours.

          Some years ago at a previous job, IT decided that 10:30 am would be the perfect time to schedule a full scan of the computers. The rationale being that the computers wouldn't be hibernating or powered off.

          So, promptly at 10:30 am, my machine would lock up and be 100% CPU and memory bound for about 2 hours or more. I asked IT to reschedule it, as it was interfering with my work .. they said no. I told them that I was going to bill them 2 hours/day for the time lost ... they said I can't do that (at the time, they billed customers $1500/day for me).

          Then I finally told them that since I had local admin privileges, and unless they were willing to change it, I was simply going to uninstall the AV software ... which I ended up doing. And, when people started to uninstall it, they found they had no choice but to change the schedule ... because it was making it impossible for people to do their jobs and HR didn't like the fact that everyone was in the break room bitching about the fact that their computers were unavailable to them.

          In my experience, most enterprise AV solutions cause more lost productivity than the things they're meant to prevent.

          so it pops up a modal dialog box in front of whatever you're trying to do

          I'm about one upgrade of AVG away from finding an alternative ... because it suddenly decides that it wants to update, and that I need to reboot right now, or postpone as much as 60 minutes. The problem is that I'm using the computer for my job, and I will tell it when it can reboot or update ... but when it pops up a modal dialog while you're typing, with "OK" selected by default, you can get a case where you've clicked "sure, go ahead and reboot" before you even realize the dialog has been presented. So all of a sudden your machine starts shutting down out from under you.

          AVG didn't always suck, but over the last few versions it has become nag-ware which wants to instal crap toolbars in my browser and otherwise do shit that I've not asked it to do.

          The use of a modal dialog box that grabs focus should lead to someone being staked to an ant-hill in the hot sun -- I'm running more than your program, and just because you want to do something doesn't mean I don't get a vote.

          Unfortunately, I find that AV in general is far more pushy and annoying about deciding it's in charge.

          • by Sir_Sri (199544)

            Comodo antivirus is very good, but really invasive. As a corporate user it's worth having a licence around, and if you get a machine that you really aren't sure what's up with it, try comodo. Then uninstall it once it is done working. It's the only English AV I've found that will reliably detect chinese virii, or other languages, but chinese is particularly troublesome.

            Failing that, there's always MSE and avast which are generally 'good enough' for day to day use.

            The idea that the anti virus should updat

          • I've had good luck with Comodo so far. Their "internet security" suite is a lot like AVG+Kerio firewall a few years back. Application behavior blocking is good to have, half of SELinux-style protection (and easier to configure) is better than none at all.
          • by Luckyo (1726890)

            I think your case is more of an IT failure then anti-virus failure. If they properly configured the scan times as well as make them happen less often (why daily scans?), it would work much better for everyone involved. Instead, it seems like you got a dick in IT who figured his needs eclipsed everyone else, while not even properly knowing what his needs are.

        • by Unka (173010)

          To me it sounds like the problem is the paranoid configuration set by your systems administrator. I work at a company that has more than 100 OSX computers running SEP 11 and I never heard anyone having issues like that, apart from the annoyance of the LiveUpdate application popping once a day.

      • I can't imagine that the enterprise version is any less crappy than the home version is.

        The enterprise edition of Symantec has one redeeming quality, it doesn't expire. Some of my computers have been running it over 10 years with NO ransom fees, but without software support.

        I made grandma an enterprise user years ago, it's better than nothing as it keeps well known pests away. Grandma won't run Linux she likes her Juno mail client.

        • by TheLink (130905)

          The enterprise edition of Symantec has one redeeming quality, it doesn't expire. Some of my computers have been running it over 10 years with NO ransom fees, but without software support.

          And it actually still gets virus signature/engine updates that can detect new viruses?

          • by Luckyo (1726890)

            Yes. I still have a copy running on my old machine (my old university had a license for all students and teachers to use corporate version). I believe I installed the AV around 2006 or so when I bought the machine and installed XP.

            It still gets signature and engine updates for both AV and FW.

    • Whew (wipes brow),

      For a moment there, I saw your thread title, and thought you were thanking bonch; I was about to skip right to the next thread.

      But now, since the source is open, maybe we can all work together to fix it....

      Come to think of it, they made more money with it broken than they would ever make with it fixed.

      cheers,

    • Re:Thanks a bunch (Score:5, Insightful)

      by Synerg1y (2169962) on Thursday January 19, 2012 @12:09PM (#38748642)

      Realize that no piece of security software will keep you safe indefinitely from a determined hacker. That applies to security companies as well.

    • by mlts (1038732) *

      Realistically, it probably wouldn't affect a single sale. The reason is that companies buy SEP not because of its virus stomping capability. They buy it because it has good audit logging, works with Cisco's NAC, and checks that all-important little box off about "do these machines have antivirus on them?".

      If SEP wasn't able to report that machines were up to date, didn't lock out "hack tools", and didn't work with the healthcheck features, then Symantec would be in a world of hurt.

      As for security, even wi

      • by Bert64 (520050)

        If the software is decently written, then exposure of the source code won't matter anyway.

        Exposure of the sourcecode is only going to be a problem if its full of easily noticeable exploitable holes.. Such a situation would be unforgivable, since you'd have expected them to fix such holes internally anyway.

        The sourcecode for Linux, OpenBSD, Apache and many other widely used pieces of software are already available to the public, and it doesn't result in mass hacks against these systems. On the contrary, many

        • by Dishevel (1105119)

          So you are saying that now that the code is out there Symantec is going to use the community to fix the massive problems that will be revealed?
          I think that you are giving them too much credit.

    • by Tim4444 (1122173)

      Hmm. 5-6 years. I'm guessing that's enough time, given the corporate turnover rate, for anyone who could be held responsible for entrusting such data to Symantec to pack their bags and pass the buck. For anyone who's left, how's it go again? Something like, "nobody ever got fired for buying IBM equipment." I wonder if there's an equivalent today regarding security and trusting your data to third parties. Clearly, having management learn something other than "VPN equals security" and "large corporations are

    • by cbass377 (198431)

      "completely lied to them" Lied to them for 6 years! Is probably still lying.

    • by forkfail (228161)

      Paden said that the 2006 attack presented no threat to customers using the most recent versions of Symantec's software.

      Hmm... this too rather begs the question of why they didn't tell people.

      Either they wanted to mitigate possible security threats by not letting the bad guys know they were vulnerable, or it was a marketing ploy that put customers in danger. Either way, maybe not so good...

  • We have yet another winner of the Late Lameo award. You're such a lameo,

  • by el3mentary (1349033) on Thursday January 19, 2012 @11:57AM (#38748486)

    Surely this is a good thing, the hackers might release an anti-virus for Norton

    • by Krneki (1192201) on Thursday January 19, 2012 @12:35PM (#38748954)
      They tried, but apparently removing norton proved to be too difficult.
      • I love the fact that comment got an +5 Insightful mod...only on Slashdot...

        In all seriousness though that program is evil, I would be glad to see it lose market share by any measure, I never completely managed to remove it from an old desktop of mine (came pre-packaged) and that's despite removing all the program files, using their own uninstaller and purging the registries. I've since given the box away to a friend but I wiped all the drives before doing so and apparently it still comes up with popups occa

    • Indeed they have, it's endearingly called "applying the Linux patch"

      *grins*

    • *crosses arms*

  • by elrous0 (869638) * on Thursday January 19, 2012 @11:57AM (#38748490)

    That'll be a lot better, right?

    • by hedwards (940851)

      Better, switch to PC-Cillin and you'll be sure that nobody's exploiting your system. Because when it takes up 99% of your system resources you're sure as hell not going to bother turning it on anytime soon.

  • by LostCluster (625375) * on Thursday January 19, 2012 @11:58AM (#38748492)

    We have to take ten points a day off your score for releasing your findings five years late. Good luck keeping your GPA up.

  • by nick357 (108909) on Thursday January 19, 2012 @11:59AM (#38748508)

    ...they were running McAfee at the time!

  • by Baloroth (2370816) on Thursday January 19, 2012 @12:01PM (#38748544)

    the code seems to have exfiltrated

    Wow, must be bad working at Symantec. Even the code wants to escape.

  • Maybe they'll use the source code for Norton GoBack to rebuild the program into less of a headache.
  • by Anonymous Coward

    Why didn't they use Norton?

  • I KNEW IT! (Score:5, Interesting)

    by SoTerrified (660807) on Thursday January 19, 2012 @12:15PM (#38748736)

    Was working with a company that was dealing with some security issues in late 2008, and we found out that the source of the breach was going right through Norton like a hot knife through butter. However, just about any other security solution would stop it. At that time, we theorized that whoever had created the problem had some intimate/inside knowledge of Norton systems and we even joked that "Symantec better check who has their source code".

  • by Anonymous Coward on Thursday January 19, 2012 @12:22PM (#38748816)

    If someone with illegally-obtained source code anonymously posts the Ghost and other file formats AND posts a credible "here's how I reverse engineered the file formats" document, and others use it to create open-source software to read the software, will Symantec have any recourse against those who write, host, or use the resulting software?

    • If someone with illegally-obtained source code anonymously posts the Ghost and other file formats AND posts a credible "here's how I reverse engineered the file formats" document, and others use it to create open-source software to read the software, will Symantec have any recourse against those who write, host, or use the resulting software?

      If the cracker posts a document with a clear specification without any code examples, then users of that specification will likely be safe. If there is a single line of code in the spec, then it would be a big no no.

  • by Provocateur (133110) on Thursday January 19, 2012 @12:25PM (#38748862) Homepage

    Who the hell outsourced the hacking to India, and have they really sunk so low?

  • Norton Antivirus: De-Crappified, Open Source, Slightly Illegal Edition

    • The pay-for antivirus industry makes most of its money in valuing the updates that they send out. Open source at his point can write an antivirus heuristics program but can't get the staff to write good enough updates for known trouble programs.

      • The pay-for antivirus industry makes most of its money in valuing the updates that they send out. Open source at his point can write an antivirus heuristics program but can't get the staff to write good enough updates for known trouble programs.

        So implement the code that downloads the updates.

      • by TheSpoom (715771)

        If it's illegal (and it would be) they'd find a way to use Symantec's updates.

  • by Anonymous Coward

    If they just had open sourced their programs they wouldn't had lost face.

    Their programs are just mechanisms. It's the filter data where the value is at.

  • Realistically, the codebase has to have changed somewhat since then, right?
    • by jesseck (942036)
      Today the code is 6 years old, but it was new when it was stolen in 2006. It has taken 6 years for Symantec to admit to the breach.
  • Considering my low esteem for their anti-virus products, I'm not surprised security is also of low caliber.

    The breach makes me wonder if Symantec is even dogfooding their own security products. Wouldn't the drag on their systems from Norton cause such slow response times that hackers would lose interest and move on? Security through performance degradation!

    • "The breach makes me wonder if Symantec is even dogfooding their own security products."

      They are not crazy enough to do this
  • I called their customer support to inquire. They opened a Ticket and said someone who I couldnt understand would get back to me within 3 days or maybe not at all. I think they then called me "assface".
  • .... for each and every paying customer who's PC's were being compromised and having both their identity stolen as well as their PC's being used to help share and harbor malware. In 2006 I was still foolishly paying for that service. I should be receiving a refund for years of purchases, for failure to notify me that my security software was breached. By withholding this information they were willingly complicit in any illegal activities that happened on any of their customer's PC's. They continue to pu

  • Why are we assuming that the breach only stole code, and did not hide malicious code in the source?
  • by Anonymous Coward
    In the 4Q of 2005, Symantec purchased Sygate, which was largely a company of Chinese foreign nationals and Chinese ex-patriots in the US. They then proceed to give that team access to Symantec source code so that they code can integrate the firewall into the Corporate product. Surprise, somehow the source code is "hacked" in 2006. Bullshit. It is even worse now. Ask Symantec how much source code is developed and maintained in China. I always enjoy a good hand-waving.
    • So they gave access to Steve Grogan, Willie McGinest, and Tony Bruschi?
      Yeah, like those guys will know what to do with it. The Symantec guys really are loosers!
  • I had a MBR virus in 97, you may be asking what the point of that was, well ... neither I (back then) or Symantec (today) are doing anything meaningful. One major difference was I had a job and brought in money ... Symantec just extorts it from people who dont know better, all the while it bogs your machine down and is effectively useless at its one and only task.

  • I like to think that Symantec provides a self maintaining honeypot for those of us who use more obscure, less intrusive, and less expensive solutions which aren't so highly exploited. Thanks Symantec. I also like Backup Exec, somewhat.

...when fits of creativity run strong, more than one programmer or writer has been known to abandon the desktop for the more spacious floor. - Fred Brooks, Jr.

Working...