Cops Set Up Extortion Sting On Symantec's Source Code Thieves 168
Sparrowvsrevolution writes "Hackers linked with Anonymous leaked another 1.26 gigabytes of Symantec's data Monday night, what they say is the source code company's PCAnywhere program. More interestingly, also posted a long private email conversation that seems to show a Symantec exec offering the hackers $50,000 to not leak the company's data and to publicly state they had lied about obtaining it. Symantec has responded by revealing that in fact, the $50,000 offer had been a ruse, and the 'Symantec exec' was actually a law enforcement agent trying to trace the hackers. It adds that all the information the hackers have released, including a 2006 version of Norton Internet Security, is outdated and poses no threat to the company or its customers. Symantec says the Anonymous hackers began attempting to extort money from the company in mid-January, and it responded by contacting law enforcement, though it won't comment on the results of the fake payoff sting while the investigation is still ongoing."
Cops set up FAILED exortion sting (Score:5, Insightful)
FTFY
Re: (Score:2, Interesting)
Aside from the fact that they did hack in and steal the code.
It seems pretty obvious that the extortion was entrapment.
Funny. Both Symantec and the cops have egg on their face on this one. Those guys better be well and truly anonymous because they have stirred the hornets nest.
Re: (Score:2)
Entrapment? I do not think it means what you think it means.
Re:Cops set up FAILED exortion sting (Score:5, Funny)
Entrapment? I do not think it means what you think it means.
What?
Inconceivable.
Re:Cops set up FAILED exortion sting (Score:5, Insightful)
Actually, after having read a portion of the emails, it wasn't anything close to entrapment.
Re: (Score:3)
..however, what they seemingly did propose - the cops/symantec,the symantec knew of the conversation taking place it's actually irrelevant if it was cops or symantec doing the offer, combined they just had no intention of actually paying- back to what they did propose: LYING TO SHAREHOLDERS ABOUT HAVING HACKED SYMANTEC.
yes.
Re: (Score:3)
Watching Catherine Zeta-jones flex around a bunch of lasers ... Yeah maybe I missed the definition myself
Re: (Score:2)
Watching Catherine Zeta-jones flex around a bunch of lasers ... Yeah maybe I missed the definition myself
Hmm, I haven't seen that.
Shannon Elizabeth, Eliza Dushku, Ali Larter, Jennifer Smith
Dressed in latex, about to flex around a bunch of lasers... http://www.imdb.com/media/rm1965725696/tt0261392 [imdb.com]
Re: (Score:2)
You're missing out on seeing the pioneer of laser-latex-flexing :)
Re:Cops set up FAILED exortion sting (Score:5, Insightful)
I wouldn't really call it "entrapment." That's if a cop tries to get you to commit a crime you were unlikely to commit. If I hack a major security company and steal their source code blackmailing the company is going to be right there on the list next to "sell on black market." Plus, it's not extortion since the "Symantec Exec" offered the money first.
Last I checked, the police are totally allowed to lie to suspects. Anything from "last night, your momma said you always were a bad kid" to "we have the smoking gun and it points at you and is covered with every type of DNA imaginable (which would also make you a gun pervert) and it matches to you. It also says you're late on your alimony. "
Re: (Score:3)
That's if a cop tries to get you to commit a crime you were unlikely to commit. If I hack a major security company and steal their source code blackmailing the company is going to be right there on the list next to "sell on black market."
Are we now being judged by the crimes someone else believes we might commit?
Having followed the alleged Anonymous hacks, the only thing they seem likely to do is to publish the data they got. A cop offering something to get them to do anything else is entrapment.
Re: (Score:3)
Re: (Score:3, Interesting)
If the source code was stolen for reasons other than extortion and the people who stole it are genuinely unlikely to commit extortion, then offering them money then turning around and claiming they're committing extortion is entrapment. Whether it is or isn't entrapment depends a lot on details that are currently secret, so all we can do is speculate.
Re: (Score:2)
They already committed the crimes involved in hacking in to get the code. That is a crime that they already committed. Extortion doesn't necessarily go along with that. It may well have been the intent, but that's something that has to be proven. If it isn't proven, then offering them money to comply with not releasing the code, then charging them with extortion after would be entrapment. Just using it as a trick to catch them, then just charging them with the crimes they had committed without it being sugg
That's not entrapment (Score:5, Informative)
Re: (Score:2)
They had already committed the crime, the sting was to get them to give away their identity so they could be prosecuted for it. It's a legitimate tactic.
Absolutely!
Re:That's not entrapment (Score:4, Interesting)
It is a legitimate tactic to find them. Whether or not it's entrapment depends on whether or not they would be charged with extortion on top of the other crimes afterwards and, if they were, whether or not there was any evidence that they actually intended extortion before being offered money (likely they would have to prove that they didn't intend it rather than the prosecution proving they did).
Re:Cops set up FAILED exortion sting (Score:4, Insightful)
Um, I know it is hard to RTFA, but perhaps you should RTFS.
"Anonymous hackers began attempting to extort money from the company in mid-January, and it responded by contacting law enforcement,"
In short, the hackers decided to try to extort Symantec and a police officer responded as if they were the executives. This is in no way entrapment and in no way reflects badly on the police at all. It was a perfectly reasonable attempt at tracking down the perpetrators. How successful it was or wasn't doesn't matter as a lot of law enforcement is trying different things until the criminals screw up. (And yes, the people that broke in to Symantec are criminals and don't deserve any respect or sympathy at all.)
Re:Cops set up FAILED exortion sting (Score:5, Funny)
Cops set up FAILED exortion sting
As a person who is involved in this case (I'm with the cyber-crime unit of the FBI), I can confidently tell you that we've narrowed down our search (based on IP addresses) to a grandmother in a seniors home in Florida.
Little does she know that joining Anonymous does not make her Anonymous. As I write this, the government is in the process of seizing her assets. She thinks she's smart, but in the end she'll end up loosing everything, including her wheel chair.
Re:Cops set up FAILED exortion sting (Score:5, Funny)
Re: (Score:2)
I can confidently tell you that we've narrowed down our search (based on IP addresses) to a grandmother in a seniors home in Florida.
Obviously someone with a disguise that clever is a serious threat to national security. Clearly her takedown warrants a kill, not capture, mission.
Re: (Score:3)
Just send in a drone, then you don't need to worry about warrants or anything.
Re: (Score:3, Funny)
>> a grandmother in a seniors home in Florida
On your conference call you said it was Arizona.
Re: (Score:2)
I wonder if its name happens to be Shady Pines.
Re: (Score:3)
Until you hear directly from the authorities that it was, in fact, a sting, its probably safer to assume it wasn't.
Of course they'll SAY it was a sting... Symantec just had the whole world learn that extortion works with them.
Re: (Score:3)
Of course Symantec will BLAME Anonymous for their data breach...It makes them look more like they were maliciously hacked instead of completely incompetent.
NOTICE!
This post is full of sarcasm, innuendo, and tomfoolery.
Re:Cops set up FAILED exortion sting (Score:5, Interesting)
Symantec fail.
Title should be: Anonymous outsmarts Police, Symantec sting
Re: (Score:3)
Makes me wonder if Symantec is ginning this all up to save face. I wonder if we're being "handled".
Re: (Score:2)
Re:Cops set up FAILED exortion sting (Score:5, Insightful)
I believe that someone broke in and stole stuff from Symantec. I think that much is real. What did they steal? I don't think that we know the extent. Worse, I don't think Symantec knows, and that the extortion plot is possibly a ruse to save face on Symantec's part. Symantec and Verisign.... it seems like a potentially coordinated effort. I wish I could believe Symantec, but they've lied before and I feel they're untrustworthy. Does this mean that the facts are different than what they claim? For me, only third party verification of the claims will make me believe them. "Hacker communiques" are somewhat meaningless until someone coughs more code. I'm betting there's much more stuff stolen, but this is only a feeling.
And I admit that Symantec might be submitting the facts. But I have to doubt it until the picture becomes clearer. The fact that they had no knowledge of the break-in means that other areas were also vulnerable, and they didn't know that. In an organization whose business is the best security, being breached successfully is tough to forgive. Add in the fact that they're still not sure of the extent, and it seems as though internal systems failure could have been rampant-- and maybe they'll never know, but would NEVER admit such a thing. Heads ought to roll there in a major way. Enrique leaves a negative legacy there....
Re:Cops set up FAILED exortion sting (Score:5, Interesting)
Re: (Score:2)
Up til now, extortion has never been their stated goal. The question is, if someone calling themselves 'Anonymous' hacks your servers, how do you know if it's the 'real' Anonymous or an impostor - or some rogue member(s) of the real Anonymous? After all, they are anonymous.
Obviously, there's no way to tell - unless one maintains the belief/fantasy that nobody who's really a part of Anonymous would do that. Unless Anonymous is a much smaller collection (group implies too much) than we've been led to beli
Re: (Score:2)
Don't they know the only way to trace anything is with a VB GUI interface?
"Linked to Anonoymous" (Score:2)
Do tell, oh nice Law Enforcement and Symantec Execs, what "links" this thieves with anonymous?
Re: (Score:1)
Re: (Score:1)
Re:Some things I agree with, some I don't (Score:4, Insightful)
Frightening that Anonymous bothers to do it, or that they're actually successful?
Re: (Score:2)
Re:Some things I agree with, some I don't (Score:5, Insightful)
I see it as the evil mirror reflection of what business & politics has risen up and wielded such power.
Re: (Score:3)
Anonymous is us. Business and politics is the evil reflection.
Re: (Score:3)
Wow, what a great argument. Other places are more evil. So business buying politicians isn't bad. And don't ever talk about one without saying other things are worse.
And then you end with a 'grow up' charge.
You didn't win anything on the debate team, did you?
Re: (Score:2)
Re: (Score:3)
The unfortunate fact for those who want to vilify business, or any other group, is that just like any other group, only a very small percentage of that group actually does that stuff. The vast, vast majority of business people (both statistically and in my own mid-size experience over 40 years) try to do the right thing all the time. It's not always obvious what the right thing is, but they try. Most businesses would rather not mess with politics at all, and many donate token amounts of money to campaign
Re: (Score:3)
Same dumb argument you used before. Somalia>corruption so not allowed to talk about corruption.
Guess what? Corruption is evil. Maybe not Somalia evil, but still evil.
Also, you don't get to judge what my definition of evil is.
Apparently you haven't argued with too many people in the real world.
Re: (Score:3)
Self interest is the root of evil. Those people being mutilated happens because it is in the self interest of the mutilator. You are trying to argue shades of gray here.
Re: (Score:3)
Did it occur to you that maybe Somalia and Afghanistan didn't start out evil, but had to allow certain things to happen to become so?
And that maybe we're allowing those same things to start happening here?
Re: (Score:2)
Re:Some things I agree with, some I don't (Score:4, Insightful)
The cesspool is you and me. They aren't any more dumb or smart than the individuals that compose them at any given time. Nothing is surprising about this unless you haven't been on the internet for a while.
Re: (Score:2)
anonymous hackers would be better to use than Anonymous.
anonymous just meaning that they don't know who they are.
Re: (Score:1)
The internet has created a generation of sociopaths.
Re:Some things I agree with, some I don't (Score:4, Funny)
now they have a venue where we can see them easily.
They have for decades. It's just that C-SPAN was so fucking boring, nobody bothered.
Re: (Score:2)
Re:Some things I agree with, some I don't (Score:4, Insightful)
Re: (Score:3)
Seems Anonymous has been looking out for the little guy so far.
Yes, by leaking their credit cards and personal information.
Re:Some things I agree with, some I don't (Score:5, Insightful)
I hold your frightening and raise you a "duh".
If you spend at least a month in IT security you'll easily see why duh. When you decide for that path, well, at least when I decided, the goal was to make the systems of the companies I work for secure. Safe from hackers, secure against all kinds of attacks. That was the plan, that was the goal.
Now, about 10 years into the business, the dream has faded. That's not what I do. What I do is writing guidelines and processes nobody reads or bothers to heed, ticking off checklists to be compliant with some law from the ancient days (i.e. any time more than a year ago in security) and generally trying to cover my ass for the moment when (not if, when) the shit hits the fan.
Because secure, we are not. But we're compliant with about any security protocol or certificate you could name. From BS7799 to ISO27001, from NERC1300 to pretty much all of its CIP substandards. And some PCI-DSS on top. Audit us by any standard you please, free choice, we'll pass.
Compliance != Security, though. It's better than nothing, I give you that. And some kind of standard has to be found or nothing will ever improve. The problem is that managers don't give half a shit about security. What they care about is the legal matter behind it. It's commendable that our lawmakers finally realized that companies that store important and private data should be forced to uphold some kind of security standard.
If we could now get some security standards that deserve the name, we could start talking.
Re: (Score:3)
Bluntly, I prefer them doing it and shaming companies that don't give a shit about their security to the alternative, industrial espionage you don't notice 'til it's far too late.
At least this way managers are pissing their pants and upping the security budget. No kidding, my budget skyrocketed this year.
Re: (Score:1)
These little tidbits are much more interesting than their large scale DDoS attacks.
If they were really extorting (Score:5, Insightful)
They would've taken the money. More likely they "offered" money whether it was in a sting or not in order to be able to claim extortion and put the Anonymous hackers in a bad light.
I don't think the hackers are interested in money as much as they are in the information. The fact is Symantec screwed up and they'll have to take it, if they can't protect themselves then why should we trust them?
Re:If they were really extorting (Score:5, Insightful)
It's actually sad. The statements by the "criminals" are more believable and more likely true than the statements by the "serious company".
Re:If they were really extorting (Score:5, Funny)
It's actually sad. The statements by the "criminals" are more believable
You mean to tell me you believe Symantec?
Re:If they were really extorting (Score:4, Insightful)
I know that's what you want to believe, but read the emails. It's abundantly clear that they did want the money. The only reason they didn't get caught is because they refused to transfer the money in any way that might be traceable.
Anonymous are not the white knights you imagine them. Anyone can "be" them, and that causes them to attract a lot of thugs and sociopaths.
Re: (Score:2)
and $50,000 buys a lot of anonymity.
Re: (Score:3)
Naah. Somewhere between $1,000,000 and $50,000,000 buys a lot of anonymity. $50,000 just gets you started, after which you will have to spend your life being creative, staying on the run, living in odd and uncomfortable places, and never again seeing anyone you are related to or ever knew.
Re: (Score:2)
Ok. You win with the more money buys more arguement.
However, (while not explicitly mentioned in my orginal post) I was thinking of servers and software type anonymity. Not fleeing the country and living large in a Swiss Chalet or Grand Cayman Bungalow with my family and 10 friends under assumed identities certified by the state government.
Re: (Score:3)
Most people, including in Anon, don't have contacts with the sort of people who'd pay for the code. They would be fearful of contacting an undercover cop, of getting rooked, or of getting in over their heads.
Besides, I suspect they would have released the data whether they got paid or not. You know... "for the lulz."
Re: (Score:2)
Most people, including in Anon, don't have contacts with the sort of people who'd pay for the code.
Think of the characters in Office Space trying to find someone to launder some money.
Extortion != Anonymous (Score:1)
I do not recall, and quick search did not return any prior example of, anonymous extorting info/data for money. Why attach this now? To me it reads more like "Anonymous ignores bribes, cop sting failed". Granted there have been threats of various sorts, but I cannot recall there being a money sum attached to any of them.
Re: (Score:2)
Anon wants nothing. Anon is nothing. Hell, do we really have to regurgitate the crap news casters spit out, lacking more (or any) information, especially if we should know better?
Anonymous isn't more a coherent group than the "people who like garlic bread".
Re: (Score:3, Funny)
Anonymous isn't more a coherent group than the "people who like garlic bread".
It is much easier to determine who is a member of the second group. Plus the "people who like garlic bread" can't sneak up on you.
Re: (Score:2)
hence he said "the entity Anon in that email"
Re: (Score:2)
But to argue that the entity Anon in that email is doing anything other then extortion is absolute bullshit.
Is that not how you would proceed if you wanted to do exactly what they did?
Extortion? (Score:1)
Re: (Score:2)
I didn't think Anonymous would ever be so stupid as to try and extort money from a big company..
They didn't try extortion, it was offered and declined.
GPL violations? (Score:3)
Edited short version:
.... Anonymous leaked ... the source code company's PCAnywhere program... Symantec has responded ... all the information the hackers have released... poses no threat to the company....
Its like they're tempting the world to diff their source code up against GPLed prior art to find license violations. I think it would be hilarious if it turns out pcanywhere was just a wrapped version of one of the numerous GPLed VNC implementations or similar.
Re: (Score:2)
Last week, the company took the highly unusual step of telling pcAnywhere users to disable the program based on a 2006 source code leak and this month's claims by members of Anonymous that they were mining the stolen code for vulnerabilities.
Symantec spokesman Brian Modena declined to declare the now-patched pcAnywhere as safe to use when asked that question multiple times, but hinted that the fixes the company has released were sufficient.
So I guess that if you patched your version of PCAnywhere then you're safe according to Symantec.
Re: (Score:2)
Re: (Score:2)
Do you have any proof that there might be violations or are you just proposing that any large, successful software project must be infringing on GPL software?
Proposing that "no threat to the company" implies they somehow comb their code to find GPL violations (how?), or they don't check so they might well exist. Or they think they're big enough to ignore any legal issues that might exist, which is frankly most likely to be true.
Its kind of pompous to declare someone elses code is no threat when you almost certainly have no idea if it is or not. That's what makes it hilarious if and/or when they're proven wrong.
Its about as bad as publicly declaring a piece of
Amusing... (Score:4, Interesting)
Of course, anybody who's dealt with Anonymous knows they will try to get you to promise to sell out your customers or otherwise act in a way that's in your interests and detrimental to the interests of everyone you claim to 'protect'. They've done this multiple times. If I were an Anonymous target I would never agree to such a scheme because all that would happen would be that the conversation be published to make me look bad.
Of course, having it be a 'police sting operation' is a great way to make it look like you weren't really going to sell out your customers. And who knows, maybe it's even true. And maybe all that source code really is for 'old versions'.
But, the really incriminating evidence would be if there were emails showing that Symantec has been sponsoring or encouraging virus writers in some way. And I'm certain if Anonymous had that kind of evidence that it would be out in the open by now. So that means they don't. And maybe Symantec isn't as much of a sleaze bag company as I expected them to be.
Re: (Score:3, Interesting)
As an aside, the only people who believe that Anonymous is after money are people who have already sold out their ethics. Generally a big part of their self-justification for having done so is that 'everybody does it', and so the idea that Anonymous is in it for anything but the money would induce major cognitive dissonance.
The tactic of trying to get your target to believe you want to extort them is a fantastic tactic for discovering people who deserve the kind of publicity it generates when you publish th
Re: (Score:2)
But, the really incriminating evidence would be if there were emails showing that Symantec has been sponsoring or encouraging virus writers in some way. And I'm certain if Anonymous had that kind of evidence that it would be out in the open by now. So that means they don't. And maybe Symantec isn't as much of a sleaze bag company as I expected them to be.
Do you really think that conspiracy is plausible? Just consider how much money there is to make by writing malware and, suddenly, Symantec doesn't have to get its hands dirty to have a running business.
1.26 Gig? (Score:1)
1.26 Gigabytes is one hell of a big virus. That's what Symantec make, right?
Re:1.26 Gig? (Score:5, Interesting)
Let's see... grinds system to a halt, hard if not impossible to remove short of a reinstall, gives you no information what it actually does, contacts its maker and downloads code after sending god knows what...
Yep. The pattern matches.
should be public anyway (Score:3, Interesting)
Better option for the title (Score:5, Insightful)
Re: (Score:2)
Symantec Eschews Success Assaying Stingy Sting
Who gets paid? (Score:4, Insightful)
Umm... lemme get this story straight... (Score:2)
You offered Anon 50k as a ruse and they declined. After they tried to extort that very sum out of you.
Yeah. Sure. I believe your story.
I realize I'm taking this out of context (Score:3)
It adds that all the information the hackers have released, including a 2006 version of Norton Internet Security, is outdated and poses no threat to the company or its customers
Let's be honest - even a 2012 version of Norton Internet Security is outdated. And yes, I realize the context of the quote is referring to customer data, but it had to be said.
Re: (Score:2)
Let's be honest - even a 2022 version of Norton Internet Security is outdated. And yes, I realize the context of the quote is referring to customer data, but it had to be said.
FTFY.
Wow. Dumb. (Score:2)
As been pointed out already, this is a report of a FAILED sting. Which makes those doing the sting look stupid, and the hackers at least cautious.
It also brings to light that a security company that sells software to prevent people from being hacked, got hacked, had source code stolen, and perhaps extorted for money to cover it up.
I am not sure how you could possibly ruin your reputation any further than they have already done.
Re: (Score:2)
I am not sure how you could possibly ruin your reputation any further than they have already done.
I'm not so sure that you're familiar with Symantecs nagware marketing method(of course they've already done that too but it's unrelated to this)
Re: (Score:2)
Agreed, they didn't exactly have a shiny reputation before this.
However if you only really do one thing, that you sell. Then you epically fail at it, to the point that its not even your customers that are getting owned, but your own company. Then Announce it to the world, "Hey look at us, we are a bunch of stupid idiots!"
I can't see how this company even exists anymore. You can get FREE software that does a better job.
PCAnywhere (Score:3)
Wait, people still use PCAnywhere?
Re: (Score:2)
Well... (Score:2)
... if it wasn't the case before, it sure is now that as distasteful as payoffs may be, they are no longer going to be an option, even if they might have been the best possible option for some corporation/entity.
Why even care? (Score:2)
The source is out there, so what? It's still protected by copyright, and most people won't be able to compile it.
It's not like anyone can use it, apart from doing security-analysis and either sending symantec patches, or hacking their customers. And in that respect, it's not different than any open source software.
(Well, of course, if you got a 10 year open source history, chances are your code is much better than if it gets accidentally released after years of bad practice. So this will hurt in the beginni
Re: (Score:2)
Here's the business model of companies like Symantec:
1. Pay to have a "demo" of your software on every new PC.
2. Nag people who don't know how the hell to get rid of your crap into buying it.
3. Profit!
Re: (Score:2)
they could have made a hundred times that by selling the source code to a rival
who would actually buy the norton internet security source code?
Re: (Score:2)
Re: (Score:2)