Symantec today confirmed that the pcAnywhere source code published on
the Web Monday by hackers who tried to extort $50,000 from the company
was legitimate. A company spokesman also said that Symantec
expects that the rest of the source code stolen from its network in 2006
will also be made public.
Symantec's acknowledgement followed
the appearance late Monday of a 1.3GB file on various file-sharing
websites, including Pirate Bay, that claimed to be the source code of
the pcAnywhere remote-access software. Download activity for the
BitTorrent file has been moderately brisk: As of mid-morning Tuesday,
Pirate Bay identified 376 "seeders," the term for a computer that has a
complete copy of the file -- and about 200 "leechers," or computers that
have downloaded only part of the complete torrent. The Anonymous hacking group claimed responsibility for posting the pcAnywhere source code.
"We
can confirm that the source code is legitimate," said Cris Paden, a
spokesman for Symantec, in an email reply to questions. "It is part of
the original cache of code for 2006 versions of the products that
Anonymous has claimed to have been in possession during the last few
weeks." Also on Monday, an individual or group going by the name
"Yama Tough" had published a series of emails on Pastebin that detailed
an attempt to extort $50,000 from Symantec. Previously, Yama Tough had claimed responsibility
for stealing the source code to pcAnywhere and other Symantec security
software. At one point, Yama Tough had threated to publish the source
code, but then recanted. The Pastebin-posted emails covered
negotiations between Yama Tough and someone identified as "Sam Thomas,"
supposedly a Symantec employee, over payment for not disclosing the
source code. In fact, Thomas was a pseudonym used by U.S. authorities,
whom Symantec had alerted to the threat.
"In January, an
individual claiming to be part of the 'Anonymous' group attempted to
extort a payment from Symantec in exchange for not publicly posting
stolen Symantec source code they claimed to have in their possession,"
said Paden. "Symantec conducted an internal investigation into this
incident and also contacted law enforcement, given the attempted
extortion and apparent theft of intellectual property. The
communications with the person(s) attempting to extort the payment from
Symantec were part of the law enforcement investigation." Paden
declined to identify the law enforcement agency, but the Federal Bureau
of Investigation (FBI) has jurisdiction in extortion attempts that
affect foreign or interstate commerce. The negotiations went on
for nearly a month -- the emails began on Jan. 18 -- but broke down when
Yama Tough rejected Thomas' conditions, which included an offer of
payments of $2,500 each month for the first three months, with the
balance to be paid on proof that the copy of the stolen source code had
been destroyed.
Yama Tough tried to spin a different story on Twitter. "They've
been tricked trolled into offering a bribe so the false statement be
[sic] made we never had the code and lied =)," Yama Tough said yesterday in a tweet.
Symantec's Paden also said today that it expects Anonymous to shortly publish source code belonging to other products. "So
far, they have posted code for the 2006 version of Norton Utilities and
pcAnywhere," said Paden. "We also anticipate that at some point, they
will post the code for Norton Antivirus [NAV] Corporate Edition and
Norton Internet Security [NIS]. NAV Corporate Edition is no longer for
sale or supported, and NIS has been completely rebuilt."" Yama
Tough promised that the source code for NAV Corporate Edition would hit
the Web today. "NAV release coming in seven hours," Yama Tough said on
Twitter about six hours ago. Two weeks ago, Symantec took the unprecedented step
of telling users of pcAnywhere to disable or uninstall the software
until it could finish patching vulnerabilities it had uncovered.
Symantec wrapped up that patching last week, and gave the all-clear to customers. Symantec has also offered free upgrades to pcAnywhere 12.5 for users of editions prior to version 12.0.
No comments:
Post a Comment