11 ms·
$50,000 to keep Symantec source code private
- mrlinx 15y agoHow is blackmailing to not release data something Anonymous would want?
- TylerE 15y agoBecause of course everything _else_ Anonymous has done is totally legal, above board, and not at all disreputable.
- chrisledet 15y agoJust $50k?
- Ctech237 15y agoYeah seriously, their turnover in 2010 was $6 Billion. I mean if your gonna take all that risk ask for a least $50 million.
- rplnt 15y agoIt was just for one product, pcAnywhere.
- Ctech237 15y agoYes but there are probably lots of code blocks that are used throughout their entire software line. Like how they establish secure connections between the client software and the update server.
- rplnt 15y agoStill, the code is worthless for anyone if your product is secure. And I would imagine that product by security company would be secure. Antivirus software might be something different as you might learn how to trick it. But "remote desktop"? It doesn't require any "security by obscurity".
- djtriptych 15y agoThe source is still pretty valuable to a competitor right?
- rplnt 15y agoI would say no. Although I might be mistaken as I don't know what exactly is the application capable of. But from the brief description I think it doesn't contain any magic; something that competitor would love to see. The only benefit I see for competitors is the bad press.
- ConstantineXVI 15y agoNot if Symantec has any proof that they've touched it. You're legally screwed if you touch this code thanks to any combination of patents, trade secrets, or even good old-fashioned copyright violation (just because the source is out there doesn't mean you can use it).
- lambersley 15y ago"..product by security company would be secure" By this logic, wouldn't you also expect the storage of the source code to be secured? In my mind, security implies all forms; physical, logical, in-transit, at rest, etc
- rplnt 15y ago> By this logic, wouldn't you also expect the storage of the source code to be secured? No, developers have to have access to the code and they can just steal it. And this wasn't even the case. If I read correctly, the code was leaked by 3rd party (some India state agency) which had it for some sort of security review.
- stef25 15y agoBit trickier to send or receive that through channels like Liberty Reserve.
- rdtsc 15y agoThis will set a bad precedent for such things (unless it is orchestrated as a sting operation). If genuine, it would be interesting to know the primary motivation -- does Symantec not want the world to see its source because it is afraid its competition will steal its ideas ("our source code is full of awesome ideas") or its source code is pretty bad, sloppy, with backdoors for Uncle Sam that will pretty much shame the company ("our source code is awful and we'll be embarrassed if it was revealed").
- emp_ 15y agoIME this ALWAYS ends up with jail, when figures are present it is usually already a cop negotiating.
- DevX101 15y agoI'm pretty sure the "let's send you $1000 over Paypal as a sign of good faith" was a trap. Looks like the hackers didn't fall for it.
- stef25 15y agoGiving in to not quite what they're being asked to do and trying to buy time does smell like 5-0. If I were them I'd release it at the first signs of stalling and then move on to blackmailing the next company, who will know better than to contact police and just pay the 50K.
- mseebach 15y agoBoth probably. Also patent trolls ("Using a for loop to sequentially read the bytes of a file" and what not). Finally, I suspect at least part of the reason is that the source code contains a number of heuristics that, if known, are easier to circumvent for malware developers.
- scott_s 15y agoThe first sentence opens with "As a part of a sting operation..."
- ibejoeb 15y ago
- recursive 15y agoThis makes Symantec look a lot worse than "Anonymous" IMO. Symantec is supposedly a reputable computer software company. The fact that they have to resort to legal means to secure their own source code is not a positive indication that they do a good job.
- alexholehouse 15y agoSo you'd prefer illegal means? I'm not sure I understand your comment.
- maximveksler 15y agoNo, I believe he refers to technical means. Meaning being able to prevent the leak.
- alexholehouse 15y agoRight, so that's what I originally thought, but they are two separate problems. Yes, of course it would be ideal to prevent the leak in the first place - being a security company and having your sourcecode stolen is not exactly ideal, nor does it reflect very well on your ability to achieve the express purpose of your company. HOWEVER, what's done is done, and given this source code has been stolen, I would on balance prefer Symantec to retrieve the code/neutralize the threat through legal means, rather than acting as "hax0rz" themselves. Whether or not this approach will work is a third debate - you'd hope this was, as suggested, a ploy by law enforcement working with Symantec, but I feel like it would reflect far worse on the company if they took an underhand approach to the situation. It's damage limitation at this point, and for a company so integrated with non-tech companies and individuals a legal approach seems a far more sensible option.
- chollida1 15y ago> The fact that they have to resort to legal means to secure their own source code is not a positive indication that they do a good job. Really? So if I, a supposedly reputable citizen have to resort to calling the police after my house is broken into that reflects poorly on me? Symantec may have doen things that reflect poorly on them, but I don't think calling the police in is one of them. That's what you are supposed to do. Remember that pretty much every tech company has had some of their code broken into, whether it's microsoft's OS, to Google's Chinese gmail back doors to oracle's db leak.
- danvideo 15y agoone of the article's comments links to pastebin that appears to be the source code already posted - as of last night
- Tichy 15y agoIs the code so embarrassing? If I wouldn't avoid them already, I would do so now.
- darxius 15y agoThe source was leaked last night: http://thepiratebay.se/torrent/7014253/Symantec_s_pcAnywhere_Leaked_Source_Code http://thepiratebay.se/torrent/7014253/Symantec_s_pcAnywhere... Has anyone heard of an official response from Symantec?
- fossuser 15y agoNow that the code is available I wonder if the product will get better. Although I'd imagine any community that tries to form around it might get smacked down with a lawsuit. It'd be interesting to allow one to develop though.
- tlrobinson 15y agoI doubt anyone will attempt to form a community around 3rd party builds/modifications to it. Malware authors will look for vulnerabilities, and curious people might study it (though you should be extremely cautious about doing so)
- DanielStraight 15y agoAccording to this source, Symantec's reply was law enforcement posing as Symantec: http://blogs.computerworld.com/19695/antisec_leaks_symantec_pcanywhere_source_code_after_50k_extortion_not_paid http://blogs.computerworld.com/19695/antisec_leaks_symantec_...
- drcube 15y agoI know nothing about antivirus software, but isn't security software supposed to be open? Otherwise, it's just security through obscurity. It sounds to me like Symantec just wants to hide all their vulnerabilities.
- elliottcarlson 15y agoThere is a large market for antivirus software - obviously Symantec is one of the biggest - but there are trade secrets in how their heuristics engines work and other secrets that give them a possible competitive edge.
- drcube 15y agoSeems to me like they would also get a competitive edge by ignoring the expensive antivirus programming and just sending the occasional false alert to the user to make them think their software is actually doing something. When they get a real virus: "Well, we can't catch all of them, sorry. Go ahead and pay for an update, that might fix it." How would you even know, unless you saw the source code?
- Travis 15y agoAside from the difficulty in uncovering the truth, I think this would be a clear example of criminal fraud. It would take a pretty large effort to cover up something like this, as well (disgruntled ex-employees would be hugely incentivized to speak to prosecutors). So while you probably wouldn't know via technical means, my gut feeling is that a conspiracy in a company that large would quickly surface.
- drcube 15y agoI agree. My point was that you don't know what they're doing. It probably isn't as bad as "nothing at all", but you can't say where along the spectrum between that and "rock solid" they actually lie without taking a peek under the hood. Which is why I'm a proponent of free and open-source software wherever possible, especially for security applications.
- Ctech237 15y agoAt this point Symantec has probably come to the conclusion that their source code is compromised. I don't think it’s possible for them to assume that anon won't use the source for themselves. The whole thing is a sting operation. If it wasn’t then Symantec’s future is dependent on an agreement that has no way of being verified. Anon probably knows this too and there just having a laugh.
- zalew 15y agohttp://hackerne.ws/item?id=3560533 http://hackerne.ws/item?id=3560533 original submission, not zdnetted
- djtriptych 15y agoSo what's the legal environment around downloading the now-leaked source? I have to say I'm pretty curious about the code quality and possible backdoors... Are there even protections for the press in this case? Or is every who pulls this torrent guilty of receiving stolen property or something along those lines. Excuse my ignorance, but frankly I'd like to poke around.
- 16s 15y agoYou'll likely be labeled a terrorist and not be able to board an aeroplane... at least in the USA. Edit: I meant this to be humorous, though it may not be far from the truth. If Symantec values its source code above a certain dollar amount, I'm sure it would be a federal offense in America to download this code. This is how Kevin Mitnick became a federal fugitive... it was simply based on the dollar amount of the source code he possessed.
- jrockway 15y agoYou can't be convicted of a crime without evidence. It's pretty easy to obtain public content and look at it without leaving behind any evidence. Tor, full disk encryption, and anonymous remailers are your friend.
- stef25 15y agoHow did the source code end up on servers not belonging to Symantec?
- driverdan 15y ago5 year old code poses a security threat to PCAnywhere users? All the more reason to not use any of their products. Source code should never pose a security risk.
- incongruity 15y agoPerhaps – but it's certainly the case that if one wanted to find an exploit, it would likely be easier with the source code in hand. Now, this isn't an argument against open-source software – much to the contrary, in fact, because, I'd argue, OSS has, by virtue of being developed in the open, had much more opportunity for bugs to be seen by contributors and by those looking to crack/exploit it. As exploits are found, they get patched. Closed source, code, on the other hand, faces a lot of catch-up when its code is released into the wild. I'd argue that's a bit like what happens to one's immune system if it's not regularly challenged (particularly as a child). Frequent exposure to pathogens tends to make one's immune system better, whereas living in a bubble only works as long as nobody lets you out. Also, as much as codebases change, many parts stay the same, so yes, 5 year old code may well still be similar to currently shipping code that unexploited/unpatched issues may well still exist.
- driverdan 15y agoI understand your immune system analogy but it isn't really accurate. Symantec is a billion dollar international corporation which markets itself as being security oriented. They should be doing rigorous security testing, including 3rd party code review. They should be paying the best of the best to crack their code. If their not they're doing it wrong.
- jakejake 15y agoIn theory this could make their product even more secure, assuming whatever exploits are found are reported back to them. It would be interesting if Semantec would do something like start a bounty for reporting exploits. But of course that would be promoting use of their source code which I'm sure they would never do.
- nlh 15y agoI feel like episodes like this give Anonymous a bad name...[ sic ;) ]....not that their name/reputation is so stellar in the first place. But this isn't Hacktivism or whatnot. This is pure outright theft and extortion. It's not "fight the man" or "prevent censorship" or even WikiLeaks-style "information wants to be free". It's profit-motivated organized crime syndicates trying to extract some $$ from a company. They hacked Symantec because the virus-writers of the world want to be able to write more viruses so they can infect more machines and create more botnets and send more spam and/or do more phishing...and make more money. That's it. It's frustrating because part of the problem with a group like Anonymous is that you don't get to declare who is and who isn't a part (by definition). I suppose human nature is human nature - in the real world or online, the same scenarios play out time and time again....
- tlrobinson 15y agoIndeed, anarchy is a double edged sword. Anyone can do anything they like under the "Anonymous" name and no one can say "hey, they don't speak for us".
- etherael 15y agoActually they could, assuming that "they" exist as a single coherent entity that sets policy etc. Even without exposing their identities. All they would need to do is set up a pgp key which all official anonymous press releases would need to be signed with, end of story. That they don't do this is evidence to me that they're perfectly happy to have random acts of digital crime attributed to them.
- orenmazor 15y agowhen is it Anonymous and when is it just anonymous?
- slowpoke 15y agoYou're Anonymous if you say you're Anonymous, and anybody can do that. It's as simple as that.
- aledalgrande 15y agoAnonymous say it was Symantec trying to bribe them. https://twitter.com/#!/YourAnonNews/status/166898121341804544 https://twitter.com/#!/YourAnonNews/status/16689812134180454...
- joedev 15y ago@AnonymousFlorida says "Anonymous NEVER asked for money" Really? "How much do you consider ENOUGH to pay us in order to work all the issues out" "we shall give you our account number within the LR system and you send money from your LR acct to ours" Considering these snippets from the email exchange, what am I not understanding about the claim that they did not ask for money?
- rdtsc 15y agoThey are probably both stringing each other along and playing a game to see what the other side does. This is might be not unlike the HBGary incident. If Anon are at least mildly intelligent they'll figure out this is a sting operation. Slowly trickling in money then following it to the source is most likely an FBI setup. Now Anon could keep playing this and accept money but provide some random bank account just to see what Symantec does. Actually, to think about it, their best possible exit out of this is to ask this money to be sent to a charity, or a foundation. For example, "Donate $50k immediately to EFF and we'll promise we'll erase the source files". But then going by their previous patterns they'll probably release the source anyway. I don't know, but if this is an FBI sting they are not very ingenious. "We'll give you money in the course of 3 months as continuous payments... you'll have to provide proof you deleted files.. really?". A 10 year old can figure out what this is. Kind of disappointed at the quality of their work (and our tax money's use).
- starwed 15y agoI direct your attention to the name of the "organization"...
- robomartin 15y agoThese people need to be found and they need to go to jail for a very, very long time. The best possible response from the hacker community is to help dig these people out of their caves and turn them in. Why? Because this represents yet one more step towards the criminalization of the Internet. And this provides yet more fuel for politicians to get behind nonsense like SOPA. Keep this up and the Internet as you know it today will not be for long. There is no possible good outcome from these kinds of actions. Either we police our own ranks or they will do it for us. The difference is that politicians will use a sledge-hammer for surgery rather than a scalpel. Be the scalpel.
- robomartin 15y agoI find the downvotes interesting. It seems that some in the HN community are OK with crime and intellectual property theft. Sad.
- feralchimp 15y agoAnonymousFlorida's side of the story: - in 2006, anon members steal Symantec source for the lulz - Symantec contacts the FBI and sets up a pretty transparent attempt to sting those responsible - Anonymous punishes Symantec for the sting attempt, after some internal debate, by releasing the source as a torrent Has the ring of truth to it, IMHO.
- jshowa 15y agoHas anyone on here even looked at the source code?
- bravura 15y agoYamatough demanded that Symantec transfer the money via Liberty Reserve, a payment processor based in San Jose, Costa Rica. But Thomas appears reluctant, calling it "more complicated than we expected." Thomas instead suggests using PayPal to transmit a $1,000 test as "a sign of good faith." Yamatough rejects that offer, saying, "Do not send us any money (we do not use paypal period) Could someone comment on how it is possible to use Liberty Reserve to receive money anonymously? The stakes are really high for getting caught, and receiving the money is the weakest point for the hackers. So I'm curious why Liberty Reserve is the payment processor of choice for these cyber-criminals.