Forgot your password?
typodupeerror
Security News

Symantec Looks Into Claims of Stolen Source Code 116

Posted by samzenpus
from the all-your-code-are-belong-to-us dept.
wiredmikey writes "A group of hackers claim to have stolen source code for Symantec's Norton Antivirus software. The group is operating under the name Dharmaraja, and claims it found the data after compromising Indian military intelligence servers. So far it's unclear if the claims are a significant threat, as the information posted thus far by the hackers includes a document dated April 28, 1999, that Symantec describes as defining the application programming interface (API) for the virus Definition Generation Service. However, a second post entitled 'Norton AV source code file list' includes a list of file names reputedly contained within Norton AntiVirus source code package. Symantec said it is still in the process of analyzing the data in the second post." Update: 01/06 07:05 GMT by S : In a post to their Facebook page, Symantec has now said some of their source code was indeed accessed, but it was four or five years old.
This discussion has been archived. No new comments can be posted.

Symantec Looks Into Claims of Stolen Source Code

Comments Filter:
  • Nope.. (Score:5, Insightful)

    by Anonymous Coward on Friday January 06, 2012 @01:33AM (#38606916)

    Who would want anything they make?

    • by Anonymous Coward

      Who would want anything they buy?

      FTFY

    • Re:Nope.. (Score:5, Funny)

      by Enigma23 (460910) on Friday January 06, 2012 @02:58AM (#38607280)
      Maybe they're white hat hackers who will return the code in a vastly less bloated form?
      • Yesterday Symantec released there PGP source code to the world maybe that was not source code they wanted. Maybe they will rewrite Nortain 360 rename it to Nortain 180 and make it better and less bloated. Lately there home products are so junk and way over priced.
      • by Anonymous Coward

        How is it that people that have not used a product for YEARS make the most stupid of comments? Norton is one of the fastest and best products at protecting users systems. Check the countless independent reviews. Or better yet, try it for yourself. This is not your grandfathers AV.

    • by oztiks (921504)

      Update says 4 or 5 years ago, which one is it!? Don't you people timestamp your version trees?

      Besides other than virus updates I'd suspect not a hell of a lot of the core would of changed, shrugging it off "oh it was old code who cares" inst fooling me ... j00r b4s3 belongs too ...someone I guess ... heh :)

      • by yakatz (1176317)
        The Symantec FaceBook post answers that:
        The source code is from two different products, one four years old, one five years old. One of them is discontinued.
        https://www.facebook.com/Symantec/posts/10150465997682876
    • Re:Nope.. (Score:5, Funny)

      by GameboyRMH (1153867) <gameboyrmhNO@SPAMgmail.com> on Friday January 06, 2012 @08:31AM (#38608436) Journal

      Imagine the poor black hat who only got this turd as loot. It's like breaking into a bank vault and finding out that it only had some smelly bath mats inside.

    • by mortonda (5175)

      Norton has long outclassed virus makers in terms of damage it does to a computer system; Now the virus makers know how to cause as much damage too!

    • by AmiMoJo (196126)

      To find ways of disabling or otherwise breaking it, to make their viruses immune to one of the most popular AV products.

      Or instead of making fake AV software just make real AV software using the stolen code and sell that. The fake AV software scams only work because the likes of Norton are just as bad when it comes to scary warning messages and demands for payment, so they probably only need to change the logo and card processing URL.

    • Who would want anything they make?

      I don't know about the actual product, but I hear The Daily WTF [thedailywtf.com] wanted to look at the code.

    • by slick7 (1703596)

      Who would want anything they make?

      This is not the stolen source code you are looking for, move along.

  • Hrm, I didn't know hackers even needed to look at the source code in order to make viruses that get around Symantec AV....
    • by bmo (77928) on Friday January 06, 2012 @01:45AM (#38606978)

      They don't.

      1. Write virus code
      2. Load up a machine with the top 10 virus scanners.
      3. Load your virus code
      4. Let them scan.
      5. If they detect it, modify code and go to 3 else 6
      6. Release the hounds.

      --
      BMO

      • Oh yes! Hmm, well, I suppose I should start using Rogue Antispyware or Windows AntiVirus 2011 -- they're able to "secure" up your system despite Symantec's presence 99% of the time!
  • by Anonymous Coward on Friday January 06, 2012 @01:35AM (#38606922)

    ...on Facebook (yeah, I dunno). http://www.facebook.com/Symantec/posts/10150465997682876

    Symantec can confirm that a segment of its source code used in two of our older enterprise products has been accessed, one of which has been discontinued. The code involved is four and five years old. This does not affect Symantec’s Norton products for our consumer customers. Symantec’s own network was not breached, but rather that of a third party entity. We are still gathering information on the details and are not in a position to provide specifics on the third party involved. Presently, we have no indication that the code disclosure impacts the functionality or security of Symantec’s solutions. Furthermore, there are no indications that customer information has been impacted or exposed at this time. However, Symantec is working to develop remediation process to ensure long-term protection for our customers’ information. We will communicate that process once the steps have been finalized. Given the early stages of the investigation, we have no further details to disclose at this time but will provide updates as we confirm additional facts

  • by Anonymous Coward on Friday January 06, 2012 @01:37AM (#38606934)

    Wow, so the Indian military works with major US vendors like Norton to spy on their own people (and I assume other countries people since it will be the same source????)

    I assume they have the source code so they can insert extra bits and dispatch spyware the next time Norton auto-updates?

    You get an auto-update, they get a spyware app into your PC. Is that it?
    I don't think the scandal here is that the source code was stolen, it is a scandal that Norton cooperates will military spyware!!

    • by Aighearach (97333) on Friday January 06, 2012 @02:10AM (#38607088) Homepage

      Indeed, a lot of people seem to missing the bombshell here.

      • The bombshell is that Norton has been creating viruses all along... Shit, I've been watching too much X-Files.
      • by thej1nx (763573)
        The only bombshell here is that you fail to realize that Indian military wouldn't trust foreign companies like Norton, Symantec etc. without having access to source code, to ensure there is no key-logger style functionality etc. transmitting sensitive stuff to USA spy agencies.
    • Wow, so the Indian military works with major US vendors like Norton to spy on their own people (and I assume other countries people since it will be the same source????)

      I assume they have the source code so they can insert extra bits and dispatch spyware the next time Norton auto-updates?

      You get an auto-update, they get a spyware app into your PC. Is that it?
      I don't think the scandal here is that the source code was stolen, it is a scandal that Norton cooperates will military spyware!!

      Wow, +4 already? The tinfoils must be up and about today.

      Believe it or not, most major software vendors have licenses and policies in place (e.g., Microsoft [microsoft.com]) to allow sensitive institutions (governments, defense contractors, etc) access to their source code. The primary reason is actually the opposite of what you say. Customers such as the Indian government want to be able to see what's actually in the code before they agree to buy and install it on their own systems and network.

      Think of it as the 1% always getting to run open-source software because they have the clout to demand it (and under strict a NDA).

      Occupy Microsoft!

      • Re: (Score:2, Interesting)

        by Anonymous Coward
        I've always wondered about the efficacy of such programs. Yes they do have a license, but for obvious reasons the # of people that have access to it are much less than the number of developers, and not only that, the different organizations that have access to it are probably very limited in their ability to communicate, which means that you have a large number of people who each have to analyze large amounts of source, so their ability to really get a deep understanding of any individual part of the code
      • by Zarjazz (36278)

        Believe it or not, most major software vendors have licenses and policies in place (e.g., Microsoft [microsoft.com]) to allow sensitive institutions (governments, defense contractors, etc) access to their source code. The primary reason is actually the opposite of what you say. Customers such as the Indian government want to be able to see what's actually in the code before they agree to buy and install it on their own systems and network.

        Yes, this explanation is valid and almost certainly the main reason why this happens. But the fact that any institution can then exploit any bugs they do find is hardly something that can be ignored.

    • by rgbrenner (317308) on Friday January 06, 2012 @03:03AM (#38607296)

      Wow... so many assumptions in one post.

      Don't you think the Indian military needs anti-virus software? Don't you think they would need to examine the source code before running software from an American company on potentially sensitive systems? And don't you think Symantec would give it to them to secure the contract?

      • by Anonymous Coward

        http://articles.timesofindia.indiatimes.com/2010-07-19/internet/28273582_1_cyber-security-cyber-warfare-cryptographic-controls

        You can claim "trust us, we're the military and we don't do this", but in the next breath they are declaring cyber-war.

        So no, I would have to be an idiot not to see the connection, and the original story of the hack was very careful to point out that the hack had revealed several US corporations had provided the source code to their products to the Indian military.

        You can say they ne

        • by thej1nx (763573)
          Declaring cyber-war? Are you an illiterate or a total idiot? Did you even read the article you posted?

          They said they are gearing up to defend themselves against the undeclared cyber-war that is being waged against them. Namely Pakistani/Chinese hacker groups.

          Defending yourself against attacks is declaring cyber-war now? Wow! You are an idiot, regardless of whatever "connections" you see.

          It is interesting that you think that India is an enemy for you. Last I checked, the only few countries which actually con
      • by drinkypoo (153816)

        Yes, no, and no, in that order. Truly sensitive data should be on air gapped machines protected from careless media insertion and you don't need AV there.

        • by rgbrenner (317308)

          There's a wide range of sensitive data.

          What about a Gerneral's laptop he uses to answer (work) emails? Maybe he doesn't read sensitive reports on the laptop, but would it be ok for a foreign power to read those emails? Absolute not.

          You can't expect the Indian government to run software from an American company without checking. An American company that has contracts with the US government BTW.

          If they followed your advice, everything except the most highly classified data would be open to a foreign governmen

    • Actually, they probably want to audit the code for backdoors and other security vulnerabilities before deploying the software on their systems. A whole bunch of governments got snookered when Cryto AG [wikipedia.org] sold closed-source encryption software with a backdoor that allowed the US government to easily break their communications. In particular, the NSA was rumored to have backdoored Crypto AG systems since the fifties, allowing the US government to spy on communications from such warm and fuzzy countries as Iran.

      • by mortonda (5175)

        Ok, so they can audit the source code. Do they actually build the whole thing from this code themselves? With what compiler? I don't think having the code helps them much in this regard...If a hidden compiler trojan were to truly exist, THIS is where I'd expect to find it. It would be simple for MS to include a trojan in the compiler they give, or give binaries that don't match the source code...

        • by b4dc0d3r (1268512)

          Source sharing is essentially public knowledge, it has been around for a long time. Long enough to assume that's why they have the code.

          What the recipients do with the source has not been disclosed to my knowledge.

          I would assume it's up to the recipient to figure out what to do with it, and make sure that is allowed in their contract (Microsoft allegedly tries to negotiate a "come and read it yourself" kind of access so you can't build or copy it, or leak it, after Mainsoft's reported partial leak). Hopef

    • by AHuxley (892839)
      Some local long term http://en.wikipedia.org/wiki/Magic_Lantern_(software) [wikipedia.org] ?
      i.e. keystroke logging software that was safe from some anti-virus companies.
  • Bleh! (Score:5, Funny)

    by SeaFox (739806) on Friday January 06, 2012 @01:38AM (#38606948)

    Stealing source code from Symantec is like stealing your neighbor's garbage.

    • by mcavic (2007672)
      Ghost is a decent product (not great, but very useful). I stopped using NAV years ago because of the bloat.
      • Bloat would merely mean an inconvenience, possibly the need to install a larger and faster hard-drive. However, my favorite independent computer shop informed me that Norton Anti-Virus was the cause of overall performance degrading on my Windows XP along with too-frequent "blue screens of death".

        The computer shop advised me to obtain the freeware versions of AVG Anti-Virus and Malwarebytes. They install both on all new PCs they sell. They assert that no one anti-virus package can detect all threats.

        The f

      • I enjoy ghost, i find it quite useful. specialy version 8 (dos) for cloning drives. its fantastic!
      • Re:Bleh! (Score:4, Interesting)

        by MightyMartian (840721) on Friday January 06, 2012 @02:45AM (#38607230) Journal

        Ghost was a decent product. I stopped using it years ago in favor of Clonezilla.

        • Re:Bleh! (Score:5, Interesting)

          by Spy Handler (822350) on Friday January 06, 2012 @03:00AM (#38607288) Homepage Journal
          I also use clonezilla alot, and I agree it's a good product in terms of function. But it has the shit-worst user interface ever (for something that's at least moderately popular). Its UI looks like a badly copied version of the text menu from the mid-90's Slackware installer, I swear.
          • by shione (666388)

            I would so mod you up if I could. Out of all the open source software that I have used and all the non open source stuff, clonezilla has got to win the cake for the most ghastly interface. Not only is it confusing and long winded but the fonts they have chosen has got to be the most awful that could only be topped if someone picked the disn3y font.

        • The old DOS Norton Utilities was a awesome product, with the Norton disk editor and other cool features, their products now are just bloat and nothing else. using common sense on the Internet can keep you safer than this product.

        • by dissy (172727)

          Ghost was a decent product. I stopped using it years ago in favor of Clonezilla.

          Seconded. Clonezilla is an excellent Ghost replacement, and I even started getting the windows-only admins I work with turned on to it!

          If anyone is looking for an open source "corporate back-end Ghost", check out the FOG project [fogproject.org]. I've just begun deploying the infrastructure needed for it, but lets one backup and reimage a computer remotely using an awesome network boot method.

          They both take a little bit to get used to, but it's no worse then getting used to or working around the problems and quirks of Gho

    • by nmb3000 (741169)

      Stealing source code from Symantec is like stealing your neighbor's garbage.

      Hey, maybe if the source is published publicly, some bright person(s) can improve it and issue a "fork" of Symantec's code :)

      All they probably have to do is remove a few speed up loops [thedailywtf.com]!

    • Don't insult my neighbors. Some of their garbage is decent.

  • Unless their newer antivirus programs are nothing more than updated virus definitions, it shouldn't really bother Symantec.

    • It may still the same code base that makes Norton run real slow it in.

    • by angus_rg (1063280)

      Recent versions allow quarenting on behaviors, like flashxxx.ocx tries to write to c:\windows\.... Figure out the function hook, and you can bypass these actions before they occur.

      In addition, any encryption keys embedded would be fair game. possibly allowing to impersonate a live update server.

      Reasons it's not relevant:
      Any decent virus writer has disassembled it more than a Jetta in your average chop shop.

      Corporate IT departments rarely read Vendor best practices and miss the boat on writing to system dir

  • At least we will get some great versions of Norton Total Internet Security 2013 floating about now.

  • This is yet another reason why reliance on closed-source security software is risky.
    • True. But maybe this will result in a better product.
    • The only open-source AV I am aware of-- ClamAV-- lacks real time scanning, and is generally awful. The version that supports real time scanning-- MoonSecure-- is apparently very much alpha, and has a high risk of ruining your machine.

      Ill take the closed-source Security Essentials, thanks.

      Heck even the best virus removal tools out there-- Kaspersky's tools, Combofix, GMER-- are closed source.

      • There's MoonSecure for Windows, a FOSS virus scanner with real-time scanning. It uses the ClamAV virus definition database which is unfortunately not that great...

    • by T Murphy (1054674)
      Can you clarify your argument? How is your computer at risk because its closed-source virus scanner had its source code released, as opposed to using open-source from the get-go? Yes, maybe the closed-source program has easy exploits that wouldn't exist in open-source, but until such an exploit becomes news I don't see what you are getting at.
      • by hashless (1833294)
        The implication is that exploits will be released based on the source code. When software source code is first released, there are many potential errors to be exploited. If the software were available for various eyes to see from the beginning, most of the exploitable bugs would have been patched long ago. Now, the user base is much larger than for newly released code. Therefore, the potential impact of a hypothetical resulting exploit is greater than if the software's source code had been publicly availabl
  • It's not stealing! (Score:1, Interesting)

    by Anonymous Coward

    Since the original source code wasn't destroyed and is still in the hands of Symantec, and the hackers merely made an identical copy without permission...

    then it's not theft, it's copyright infringement.

  • by msobkow (48369) on Friday January 06, 2012 @01:56AM (#38607032) Homepage Journal

    Does the code include the keys that would be needed to inject bad/malware virus definitions, causing user's machines to delete files that weren't viruses? Does this open up some sort of command-and-control channel over users machines aside from that risk?

    • by msobkow (48369)

      Or are the crackers just counting coup for filching the source code?

      And yes, I'm one of those pedantic buggers who insist that they're crackers, not hackers. Crackers steal and do damage; hackers study out of curiousity.

      • by Aighearach (97333)

        The implied risk is that the Indian military is conducting industrial espionage against the US, and then storing their bounty on internet connected computers for all the world to crack and steal.

  • Offshoring (Score:5, Insightful)

    by happyhamster (134378) on Friday January 06, 2012 @02:09AM (#38607086)

    >>The group is operating under the name Dharmaraja
    >>...compromising Indian military intelligence servers.

    Dear Corporations, "Investors", and CEOs,

    Please do not hesitate to keep offshoring every bit of information and technology to the third world. The things you've seen so far are mosquito bites compared to the crap that will hit the fan if you keep "enhancing profits" for another decade or even less.

    Respectfully,
    Software Developer, a.k.a. the guy who actually has to work for a living.

    • Re: (Score:3, Interesting)

      by jaa101 (627731)
      It doesn't sound like this falls into the offshoring category to me. Since the military is involved I guess they demanded the source to assure themselves that there were no backdoors. It doesn't seem an unreasonable step for any government (even/especially in the US) to take before using your software in a security context.

      The fun is in considering what recourse Symantec has. If they didn't have some really expensive penalty clause in the non-dislosure agreement that will have been involved here they'l

      • by LS (57954)

        To be fair though, Symantec does do quite a bit of offshoring, with development offices in Beijing and Chengdu, amongst other places in Asia.

  • by Anonymous Coward

    Just like watching adds for "My Clean PC" the whole computer virus industry is a scam in the first place. It all originates from the fact that someone tried to sue the pants of Microsoft about file system maintenance utilities...and in return for not going all the way and taking Microsoft to the cleaners the folks just shook hands and made a deal to leave some security crumbs for the offended corporation.

    The end result was the scam about operating system security, when in reality the solution was to lock do

  • Computers all over the world will be infected with Norton by December and human civilization as we know it will cease to exist!

  • Hunh? (Score:4, Funny)

    by symbolset (646467) * on Friday January 06, 2012 @02:40AM (#38607212) Homepage Journal
    Stealing Symantec's source code is like stealing Typhoid Mary's soup.
    • Re: (Score:3, Funny)

      by expo53d (2511934)
      I would be interesting to run grep through the source code. Bet you would find lines like:

      # This part slows down the computer if the license is not renewed

      • by Jahava (946858)

        I would be interesting to run grep through the source code. Bet you would find lines like:

        # This part slows down the computer if the license is not renewed

        ... and being written in a scripting language probably doesn't help either!

      • by laejoh (648921)
        For better or worse, also try this: $grep "SCO" -iR /tmp/symantec.source.code
      • by angus_rg (1063280)

        # This part slows down the computer if the license is not renewed

        Nah. That would indicate they wrote it in Perl, and perl is fast at finding things. Oh wait, it could also mean TCL.....

      • by phorm (591458)

        I think that's a "feature" of the AV whether or not your license is renewed...

  • Awesome (Score:5, Funny)

    by zerojoker (812874) on Friday January 06, 2012 @03:51AM (#38607436)
    Finally someone can write a working uninstaller!
  • by BagOCrap (980854) on Friday January 06, 2012 @05:15AM (#38607754) Homepage

    Hope these hackers can turn the source code into something useful.

  • A little perspective (Score:2, Informative)

    by Anonymous Coward

    A lot of Symantec haters out there. Funny

    Lets put some things in to perspective here.

    1. Norton is a consumer product. SEP is the enterprise product - Two very different products with very different code and both have been re-written a couple of years ago. (Works a lot better than before and is less "bloated")
    2. I would very much doubt that a government defense organization would be purchasing a consumer product like Norton.
    3. The segments of code found are from SAV (last rolled out apporximatley 5 years ago

    • by Lumpy (12016) on Friday January 06, 2012 @09:30AM (#38608706) Homepage

      And both STILL are garbage. we saw a 200% speed increase on ALL our corperate Windows machines when we switched from SEP to the enterprise offering from ESET. The change was so dramatic that most of us did not believe that the ESET software was running.

      Honestly, SEP and Norton both needs to have even more rewrites because it's the joke of the Enterprise world in regards to performance and reliability.

      • I've had NOD32 at home for years. I wish I could install it at work. However, thanks to kickbacks to the local government, Sophos consistently quote 50% lower than I can get any competing product for.

        Pisses me the fuck off.
  • by AbRASiON (589899) * on Friday January 06, 2012 @11:14AM (#38609796) Journal

    I've never told anyone this before, because it's horrifically tragically sad but I had a picture of Peter Norton torn out of a magazine pinned up near my PC when I was a kid 20 years ago. Yeah I was a complete nerd / geek, especially for performance and hardware.
    Back then Norton utilities 6 was the absoloute bees knees, speedisk for DOS is still the most thorough defragger I know of, full with file reorder was the option, it ensured 0 files were fragmented and this was in the days that exceedingly few files on the disk were set as read only / system. It genuinely improved performance significantly.

    Their tools were good for maybe 3 or 4 years more, possibly the first one or two Windows tools for 95 had some useful features lacking in the core OS but after that, what a shambles. To me, any machine with Norton utilities (Norton utilities NOT "Nortons utilities" while I'm at it) should pretty much be wiped clean :/

  • Sounds more like a "group of finance officers" are trying to boost corporate revenue by using that old trick again. "Our old software has been compromised! Upgrade to the latest version of __________ to stay secure! As a loyal customer, here's a 20% off coupon code that we didn't accidentally print out and include in our retail box."

Man is the best computer we can put aboard a spacecraft ... and the only one that can be mass produced with unskilled labor. -- Wernher von Braun

Working...