Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
Crime Security IT

Cops Set Up Extortion Sting On Symantec's Source Code Thieves 168

Posted by timothy
from the don't-worry-now-we're-telling-the-truth dept.
Sparrowvsrevolution writes "Hackers linked with Anonymous leaked another 1.26 gigabytes of Symantec's data Monday night, what they say is the source code company's PCAnywhere program. More interestingly, also posted a long private email conversation that seems to show a Symantec exec offering the hackers $50,000 to not leak the company's data and to publicly state they had lied about obtaining it. Symantec has responded by revealing that in fact, the $50,000 offer had been a ruse, and the 'Symantec exec' was actually a law enforcement agent trying to trace the hackers. It adds that all the information the hackers have released, including a 2006 version of Norton Internet Security, is outdated and poses no threat to the company or its customers. Symantec says the Anonymous hackers began attempting to extort money from the company in mid-January, and it responded by contacting law enforcement, though it won't comment on the results of the fake payoff sting while the investigation is still ongoing."
This discussion has been archived. No new comments can be posted.

Cops Set Up Extortion Sting On Symantec's Source Code Thieves

Comments Filter:
  • by elrous0 (869638) * on Tuesday February 07, 2012 @10:13AM (#38953985)

    FTFY

    • Re: (Score:2, Interesting)

      by Tsingi (870990)

      Aside from the fact that they did hack in and steal the code.

      It seems pretty obvious that the extortion was entrapment.

      Funny. Both Symantec and the cops have egg on their face on this one. Those guys better be well and truly anonymous because they have stirred the hornets nest.

      • by Sarten-X (1102295)

        Entrapment? I do not think it means what you think it means.

      • by Anonymous Coward on Tuesday February 07, 2012 @11:01AM (#38954751)

        I wouldn't really call it "entrapment." That's if a cop tries to get you to commit a crime you were unlikely to commit. If I hack a major security company and steal their source code blackmailing the company is going to be right there on the list next to "sell on black market." Plus, it's not extortion since the "Symantec Exec" offered the money first.

        Last I checked, the police are totally allowed to lie to suspects. Anything from "last night, your momma said you always were a bad kid" to "we have the smoking gun and it points at you and is covered with every type of DNA imaginable (which would also make you a gun pervert) and it matches to you. It also says you're late on your alimony. "

        • by mangu (126918)

          That's if a cop tries to get you to commit a crime you were unlikely to commit. If I hack a major security company and steal their source code blackmailing the company is going to be right there on the list next to "sell on black market."

          Are we now being judged by the crimes someone else believes we might commit?

          Having followed the alleged Anonymous hacks, the only thing they seem likely to do is to publish the data they got. A cop offering something to get them to do anything else is entrapment.

          • It would only be entrapment if they hadn't already obtained the data. Entrapment would be convincing them to break in and get the data for money before they had already done so. Asking someone to sell you something they have already taken isn't really entrapment seeing the crime has already been committed.
            • Re: (Score:3, Interesting)

              by tragedy (27079)

              If the source code was stolen for reasons other than extortion and the people who stole it are genuinely unlikely to commit extortion, then offering them money then turning around and claiming they're committing extortion is entrapment. Whether it is or isn't entrapment depends a lot on details that are currently secret, so all we can do is speculate.

      • by abigsmurf (919188) on Tuesday February 07, 2012 @11:22AM (#38955033)
        They had already committed the crime, the sting was to get them to give away their identity so they could be prosecuted for it. It's a legitimate tactic.
        • by Tsingi (870990)

          They had already committed the crime, the sting was to get them to give away their identity so they could be prosecuted for it. It's a legitimate tactic.

          Absolutely!

        • by tragedy (27079) on Tuesday February 07, 2012 @01:24PM (#38957073)

          It is a legitimate tactic to find them. Whether or not it's entrapment depends on whether or not they would be charged with extortion on top of the other crimes afterwards and, if they were, whether or not there was any evidence that they actually intended extortion before being offered money (likely they would have to prove that they didn't intend it rather than the prosecution proving they did).

      • by AJH16 (940784) <aj@@@gccafe...com> on Tuesday February 07, 2012 @01:27PM (#38957123) Homepage

        Um, I know it is hard to RTFA, but perhaps you should RTFS.

        "Anonymous hackers began attempting to extort money from the company in mid-January, and it responded by contacting law enforcement,"

        In short, the hackers decided to try to extort Symantec and a police officer responded as if they were the executives. This is in no way entrapment and in no way reflects badly on the police at all. It was a perfectly reasonable attempt at tracking down the perpetrators. How successful it was or wasn't doesn't matter as a lot of law enforcement is trying different things until the criminals screw up. (And yes, the people that broke in to Symantec are criminals and don't deserve any respect or sympathy at all.)

    • by Anonymous Coward on Tuesday February 07, 2012 @10:35AM (#38954375)

      Cops set up FAILED exortion sting

      As a person who is involved in this case (I'm with the cyber-crime unit of the FBI), I can confidently tell you that we've narrowed down our search (based on IP addresses) to a grandmother in a seniors home in Florida.

      Little does she know that joining Anonymous does not make her Anonymous. As I write this, the government is in the process of seizing her assets. She thinks she's smart, but in the end she'll end up loosing everything, including her wheel chair.

    • by tgd (2822)

      Until you hear directly from the authorities that it was, in fact, a sting, its probably safer to assume it wasn't.

      Of course they'll SAY it was a sting... Symantec just had the whole world learn that extortion works with them.

      • by ArhcAngel (247594)
        And until you hear directly from Anonymous that they did, in fact, pilfer the data, it's probably safer to assume it wasn't.

        Of course Symantec will BLAME Anonymous for their data breach...It makes them look more like they were maliciously hacked instead of completely incompetent.

        NOTICE!
        This post is full of sarcasm, innuendo, and tomfoolery.
    • by iamhassi (659463) on Tuesday February 07, 2012 @10:44AM (#38954527) Journal
      Why is Symantec acting like they fooled Anonymous? In the email it says "Say hi to FBI agents" and Symantec is like "We are not in contact with the FBI."

      Symantec fail.

      Title should be: Anonymous outsmarts Police, Symantec sting
      • Makes me wonder if Symantec is ginning this all up to save face. I wonder if we're being "handled".

        • You wonder? I have far more reason to trust the hackers than Symantec at this point.
          • by postbigbang (761081) on Tuesday February 07, 2012 @12:54PM (#38956585)

            I believe that someone broke in and stole stuff from Symantec. I think that much is real. What did they steal? I don't think that we know the extent. Worse, I don't think Symantec knows, and that the extortion plot is possibly a ruse to save face on Symantec's part. Symantec and Verisign.... it seems like a potentially coordinated effort. I wish I could believe Symantec, but they've lied before and I feel they're untrustworthy. Does this mean that the facts are different than what they claim? For me, only third party verification of the claims will make me believe them. "Hacker communiques" are somewhat meaningless until someone coughs more code. I'm betting there's much more stuff stolen, but this is only a feeling.

            And I admit that Symantec might be submitting the facts. But I have to doubt it until the picture becomes clearer. The fact that they had no knowledge of the break-in means that other areas were also vulnerable, and they didn't know that. In an organization whose business is the best security, being breached successfully is tough to forgive. Add in the fact that they're still not sure of the extent, and it seems as though internal systems failure could have been rampant-- and maybe they'll never know, but would NEVER admit such a thing. Heads ought to roll there in a major way. Enrique leaves a negative legacy there....

      • by g0bshiTe (596213) on Tuesday February 07, 2012 @11:22AM (#38955017)
        I was more interested in the fact that Symantec is trying to make it look like Anonymous is into extortion, which from all reports has never been their goal.
        • Up til now, extortion has never been their stated goal. The question is, if someone calling themselves 'Anonymous' hacks your servers, how do you know if it's the 'real' Anonymous or an impostor - or some rogue member(s) of the real Anonymous? After all, they are anonymous.

          Obviously, there's no way to tell - unless one maintains the belief/fantasy that nobody who's really a part of Anonymous would do that. Unless Anonymous is a much smaller collection (group implies too much) than we've been led to beli

    • by Flyerman (1728812)

      Don't they know the only way to trace anything is with a VB GUI interface?

    • Do tell, oh nice Law Enforcement and Symantec Execs, what "links" this thieves with anonymous?

  • But either way it's still fun to watch what Anonymous gets up to ;)

    • You say fun, I say frightening.
      • by John Napkintosh (140126) on Tuesday February 07, 2012 @10:18AM (#38954081) Homepage

        Frightening that Anonymous bothers to do it, or that they're actually successful?

        • Definitely the latter. Whilst I can agree with some of their arguments, I can't help but worry that a collective risen up from the cesspool that is 4chan wields such power.
          • by NatasRevol (731260) on Tuesday February 07, 2012 @10:34AM (#38954351) Journal

            I see it as the evil mirror reflection of what business & politics has risen up and wielded such power.

            • by Hatta (162192)

              Anonymous is us. Business and politics is the evil reflection.

          • by gparent (1242548) on Tuesday February 07, 2012 @10:38AM (#38954423)

            The cesspool is you and me. They aren't any more dumb or smart than the individuals that compose them at any given time. Nothing is surprising about this unless you haven't been on the internet for a while.

        • by gl4ss (559668)

          anonymous hackers would be better to use than Anonymous.

          anonymous just meaning that they don't know who they are.

      • by Anonymous Coward

        The internet has created a generation of sociopaths.

      • by iamhassi (659463) on Tuesday February 07, 2012 @10:38AM (#38954431) Journal
        Frightening if you're Big Brother. Seems Anonymous has been looking out for the little guy so far. I definitely wouldn't want to be a CEO of one of these evil megacorporations with Anonymous watching me.
        • by Dan541 (1032000)

          Seems Anonymous has been looking out for the little guy so far.

          Yes, by leaking their credit cards and personal information.

      • by Opportunist (166417) on Tuesday February 07, 2012 @10:55AM (#38954687)

        I hold your frightening and raise you a "duh".

        If you spend at least a month in IT security you'll easily see why duh. When you decide for that path, well, at least when I decided, the goal was to make the systems of the companies I work for secure. Safe from hackers, secure against all kinds of attacks. That was the plan, that was the goal.

        Now, about 10 years into the business, the dream has faded. That's not what I do. What I do is writing guidelines and processes nobody reads or bothers to heed, ticking off checklists to be compliant with some law from the ancient days (i.e. any time more than a year ago in security) and generally trying to cover my ass for the moment when (not if, when) the shit hits the fan.

        Because secure, we are not. But we're compliant with about any security protocol or certificate you could name. From BS7799 to ISO27001, from NERC1300 to pretty much all of its CIP substandards. And some PCI-DSS on top. Audit us by any standard you please, free choice, we'll pass.

        Compliance != Security, though. It's better than nothing, I give you that. And some kind of standard has to be found or nothing will ever improve. The problem is that managers don't give half a shit about security. What they care about is the legal matter behind it. It's commendable that our lawmakers finally realized that companies that store important and private data should be forced to uphold some kind of security standard.

        If we could now get some security standards that deserve the name, we could start talking.

    • by Anonymous Coward

      These little tidbits are much more interesting than their large scale DDoS attacks.

  • by guruevi (827432) <evi@smok[ ]cube.be ['ing' in gap]> on Tuesday February 07, 2012 @10:17AM (#38954061) Homepage

    They would've taken the money. More likely they "offered" money whether it was in a sting or not in order to be able to claim extortion and put the Anonymous hackers in a bad light.

    I don't think the hackers are interested in money as much as they are in the information. The fact is Symantec screwed up and they'll have to take it, if they can't protect themselves then why should we trust them?

    • by Opportunist (166417) on Tuesday February 07, 2012 @10:35AM (#38954373)

      It's actually sad. The statements by the "criminals" are more believable and more likely true than the statements by the "serious company".

    • by artor3 (1344997) on Tuesday February 07, 2012 @10:50AM (#38954605)

      I know that's what you want to believe, but read the emails. It's abundantly clear that they did want the money. The only reason they didn't get caught is because they refused to transfer the money in any way that might be traceable.

      Anonymous are not the white knights you imagine them. Anyone can "be" them, and that causes them to attract a lot of thugs and sociopaths.

      • by Lashat (1041424)

        and $50,000 buys a lot of anonymity.

        • Naah. Somewhere between $1,000,000 and $50,000,000 buys a lot of anonymity. $50,000 just gets you started, after which you will have to spend your life being creative, staying on the run, living in odd and uncomfortable places, and never again seeing anyone you are related to or ever knew.

          • by Lashat (1041424)

            Ok. You win with the more money buys more arguement.

            However, (while not explicitly mentioned in my orginal post) I was thinking of servers and software type anonymity. Not fleeing the country and living large in a Swiss Chalet or Grand Cayman Bungalow with my family and 10 friends under assumed identities certified by the state government.

  • I do not recall, and quick search did not return any prior example of, anonymous extorting info/data for money. Why attach this now? To me it reads more like "Anonymous ignores bribes, cop sting failed". Granted there have been threats of various sorts, but I cannot recall there being a money sum attached to any of them.

  • The only extortion is the fact that you have to pay to not have software (That you already paid for) screwing up. On a serious note though, I didn't think Anonymous would ever be so stupid as to try and extort money from a big company. Execs would much rather see their family die than lose corporate profits.
    • by Tsingi (870990)

      I didn't think Anonymous would ever be so stupid as to try and extort money from a big company..

      They didn't try extortion, it was offered and declined.

  • by vlm (69642) on Tuesday February 07, 2012 @10:20AM (#38954129)

    Edited short version:

    .... Anonymous leaked ... the source code company's PCAnywhere program... Symantec has responded ... all the information the hackers have released... poses no threat to the company....

    Its like they're tempting the world to diff their source code up against GPLed prior art to find license violations. I think it would be hilarious if it turns out pcanywhere was just a wrapped version of one of the numerous GPLed VNC implementations or similar.

    • Weel, it seems like Symantec isn't really telling the truth about PCAnywhere not posing a threat to its customers. A quote from this Feb 1, 2012 article [computerworlduk.com]:

      Last week, the company took the highly unusual step of telling pcAnywhere users to disable the program based on a 2006 source code leak and this month's claims by members of Anonymous that they were mining the stolen code for vulnerabilities.

      Symantec spokesman Brian Modena declined to declare the now-patched pcAnywhere as safe to use when asked that question multiple times, but hinted that the fixes the company has released were sufficient.

      So I guess that if you patched your version of PCAnywhere then you're safe according to Symantec.

    • by 0racle (667029)
      Do you have any proof that there might be violations or are you just proposing that any large, successful software project must be infringing on GPL software?
      • by vlm (69642)

        Do you have any proof that there might be violations or are you just proposing that any large, successful software project must be infringing on GPL software?

        Proposing that "no threat to the company" implies they somehow comb their code to find GPL violations (how?), or they don't check so they might well exist. Or they think they're big enough to ignore any legal issues that might exist, which is frankly most likely to be true.

        Its kind of pompous to declare someone elses code is no threat when you almost certainly have no idea if it is or not. That's what makes it hilarious if and/or when they're proven wrong.

        Its about as bad as publicly declaring a piece of

  • Amusing... (Score:4, Interesting)

    by Omnifarious (11933) * <eric-slash.omnifarious@org> on Tuesday February 07, 2012 @10:21AM (#38954147) Homepage Journal

    Of course, anybody who's dealt with Anonymous knows they will try to get you to promise to sell out your customers or otherwise act in a way that's in your interests and detrimental to the interests of everyone you claim to 'protect'. They've done this multiple times. If I were an Anonymous target I would never agree to such a scheme because all that would happen would be that the conversation be published to make me look bad.

    Of course, having it be a 'police sting operation' is a great way to make it look like you weren't really going to sell out your customers. And who knows, maybe it's even true. And maybe all that source code really is for 'old versions'.

    But, the really incriminating evidence would be if there were emails showing that Symantec has been sponsoring or encouraging virus writers in some way. And I'm certain if Anonymous had that kind of evidence that it would be out in the open by now. So that means they don't. And maybe Symantec isn't as much of a sleaze bag company as I expected them to be.

    • Re: (Score:3, Interesting)

      by Omnifarious (11933) *

      As an aside, the only people who believe that Anonymous is after money are people who have already sold out their ethics. Generally a big part of their self-justification for having done so is that 'everybody does it', and so the idea that Anonymous is in it for anything but the money would induce major cognitive dissonance.

      The tactic of trying to get your target to believe you want to extort them is a fantastic tactic for discovering people who deserve the kind of publicity it generates when you publish th

    • But, the really incriminating evidence would be if there were emails showing that Symantec has been sponsoring or encouraging virus writers in some way. And I'm certain if Anonymous had that kind of evidence that it would be out in the open by now. So that means they don't. And maybe Symantec isn't as much of a sleaze bag company as I expected them to be.

      Do you really think that conspiracy is plausible? Just consider how much money there is to make by writing malware and, suddenly, Symantec doesn't have to get its hands dirty to have a running business.

  • by Anonymous Coward

    1.26 Gigabytes is one hell of a big virus. That's what Symantec make, right?

  • by Dr. Tom (23206) <tomh@nih.gov> on Tuesday February 07, 2012 @10:27AM (#38954231) Homepage
    Security code should be open for review anyway, or it's probably full of bugs and worthless.
  • by fibonacci8 (260615) on Tuesday February 07, 2012 @10:33AM (#38954329)
    Symantec and FBI attempt to patch security vulnerability with cash.
  • Who gets paid? (Score:4, Insightful)

    by bryansj (89051) on Tuesday February 07, 2012 @10:33AM (#38954337)
    How would they receive the $50K anyway? Split it up between all members who are supposed to be anonymous? Symantec/Police: Who do we make this check out to? Anonymous: Cash. Symantec/Police: Damn, foiled again!
  • You offered Anon 50k as a ruse and they declined. After they tried to extort that very sum out of you.

    Yeah. Sure. I believe your story.

  • by james_van (2241758) on Tuesday February 07, 2012 @10:45AM (#38954543)

    It adds that all the information the hackers have released, including a 2006 version of Norton Internet Security, is outdated and poses no threat to the company or its customers

    Let's be honest - even a 2012 version of Norton Internet Security is outdated. And yes, I realize the context of the quote is referring to customer data, but it had to be said.

    • by forkfail (228161)

      Let's be honest - even a 2022 version of Norton Internet Security is outdated. And yes, I realize the context of the quote is referring to customer data, but it had to be said.

      FTFY.

  • As been pointed out already, this is a report of a FAILED sting. Which makes those doing the sting look stupid, and the hackers at least cautious.

    It also brings to light that a security company that sells software to prevent people from being hacked, got hacked, had source code stolen, and perhaps extorted for money to cover it up.

    I am not sure how you could possibly ruin your reputation any further than they have already done.

    • by gl4ss (559668)

      I am not sure how you could possibly ruin your reputation any further than they have already done.

      I'm not so sure that you're familiar with Symantecs nagware marketing method(of course they've already done that too but it's unrelated to this)

      • by DarthVain (724186)

        Agreed, they didn't exactly have a shiny reputation before this.

        However if you only really do one thing, that you sell. Then you epically fail at it, to the point that its not even your customers that are getting owned, but your own company. Then Announce it to the world, "Hey look at us, we are a bunch of stupid idiots!"

        I can't see how this company even exists anymore. You can get FREE software that does a better job.

  • by nitehawk214 (222219) on Tuesday February 07, 2012 @11:12AM (#38954893)

    Wait, people still use PCAnywhere?

  • ... if it wasn't the case before, it sure is now that as distasteful as payoffs may be, they are no longer going to be an option, even if they might have been the best possible option for some corporation/entity.

  • The source is out there, so what? It's still protected by copyright, and most people won't be able to compile it.

    It's not like anyone can use it, apart from doing security-analysis and either sending symantec patches, or hacking their customers. And in that respect, it's not different than any open source software.

    (Well, of course, if you got a 10 year open source history, chances are your code is much better than if it gets accidentally released after years of bad practice. So this will hurt in the beginni

"Free markets select for winning solutions." -- Eric S. Raymond

Working...