On Tuesday Symantec acknowledged that source code for older versions of its Norton security products did in fact leak out.
After a hacker using the alias “YamaTough” claimed his crew was in possession of source code for Norton Antivirus roughly two weeks ago, Symantec stated the hackers were only in possession of source code for Symantec Endpoint Protection 11.0 and Symantec Antivirus 10.2. However, the company now admits that source code for some of its Norton products was stolen in an attack in 2006.
“Upon investigation of the claims made by Anonymous regarding source code disclosure, Symantec believes that the disclosure was the result of a theft of source code that occurred in 2006,” Symantec spokesperson Cris Paden told SecurityWeek in an emailed statement. “We believe that source code for the 2006-era versions of the following products was exposed: Norton Antivirus Corporate Edition; Norton Internet Security; Norton SystemWorks (Norton Utilities and Norton GoBack); and pcAnywhere.”
“Due to the age of the exposed source code, except as specifically noted below, Symantec customers – including those running Norton products — should not be in any increased danger of cyber attacks resulting from this incident,” he continued. “Customers of Symantec’s pcAnywhere product may face a slightly increased security risk as a result of this exposure if they do not follow general best practices. Symantec is currently in the process of reaching out to our pcAnywhere customers to make them aware of the situation and to provide remediation steps to maintain the protection of their devices and information.”
Symantec has taken steps to improve security policies and procedures since the time of the 2006 breach, Paden said, without elaborating.
YamaTough purports to be a member of Lords of Dharmaraja, an Indian hacking group. Two weeks ago the group posted a document dated April 28, 1999, that Symantec described as defining the application programming interface (API) for the virus Definition Generation Service. The document described how the software is designed to work, but contained no actual source code.
The Lords of Dharmaraja also released a purported memo that outlined an Indian intercept program known as RINOA, so named due to the vendors involved – RIM, Nokia, and Apple. According to the memo, the vendors provided India with backdoors into their technology. In a post on Twitter Jan. 14, YamaTough wrote that more stolen information will be posted online. Two days later, he tweeted that pcAnywhere source code was being made available to the black hat community for exploitation.
Customers using the up-to-date versions of the affected products are not at risk.
More from Brian Prince
- U.S. Healthcare Companies Hardest Hit by ‘Stegoloader’ Malware
- CryptoWall Ransomware Cost Victims More Than $18 Million Since April 2014: FBI
- New Adobe Flash Player Flaw Shares Similarities With Previous Vulnerability: Trend Micro
- Visibility Challenges Industrial Control System Security: Survey
- Adobe Flash Player Zero-Day Exploited in Attack Campaign
- Researchers Demonstrate Stealing Encryption Keys Via Radio
- Researchers Uncover Critical RubyGems Vulnerabilities
- NSA, GCHQ Linked to Efforts to Compromise Antivirus Vendors: Report
Latest News
- Comcast Wants a Slice of the Enterprise Cybersecurity Business
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- New York Attorney General Fines Vendor for Illegally Promoting Spyware
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- 20 Million Users Impacted by Data Breach at Instant Checkmate, TruthFinder
- Cyber Insights 2023 | Zero Trust and Identity and Access Management
- Cyber Insights 2023 | The Coming of Web3
- European Police Arrest 42 After Cracking Covert App
