If 2011 was the year of the RSA breach, 2012 may well be the year of the Symantec breach (NASDAQ:SYMC). Symantec has recently acknowledged that its source code for multiple products was stolen in 2006 after "Yama Tough", a member of a hacker crew called "The Lords of Dharmaraja", posted a portion of it on Pastebin. It's unlikely in my opinion that the Lords of Dharmaraja were responsible for the original breach. They don't appear to know exactly what they have yet since YT posted that he's delaying the release of the rest of the code until they create some Zero-days for it. If they had it for six years, he wouldn't need the extra time to find ways to exploit it. So some of the questions yet to be answered are who breached Symantec's network in 2006 and how did Yama Tough gain access to it? His claim about stealing it from Indian government servers was clearly a lie.
The worst part is that Symantec, the world's largest security software company, was clueless about the theft of its own source code for almost six years; which means that its thousands of customers were clueless as well. A software company's source code is its crown jewels; both because it's the "brains" behind the company's proprietary software line and because if an adversary had access to it, they could quickly write new malware (known as a "Zero-Day") that would silently compromise any protections that the software offered to its legitimate customers. If the compromised application is security software, like it is in this case, then the impact of the stolen source code is much worse. Since the malware author is writing exploits for heretofor unknown weaknesses in the code, the Symantec customer will probably never know that he's been compromised. If Symantec is this careless about securing and monitoring their Norton code repository, how can they state with confidence that any of their products are safe from compromise? It appears that they can't. Notice the wording in their latest posting at their website (January 24, 2012, 22:50 PST) which refers to a non-Norton product: "The Symantec Endpoint Protection 11 product – which was initially released in the fall of 2007 – was based upon a separate code branch that we do not believe was exposed." (emphasis added)
If my company was a Symantec customer, and we aren't, I wouldn't want to know what Symantec "believes". I'd want to know what Symantec "knows". If they can't say definitively that Symantec Endpoint Protection is safe to use, then my advice to Taia Global clients and others is to not use it. The products that Symantec has acknowledged are compromised in the afore-mentioned notice on its website are:
Add to Cart
View detail
The worst part is that Symantec, the world's largest security software company, was clueless about the theft of its own source code for almost six years; which means that its thousands of customers were clueless as well. A software company's source code is its crown jewels; both because it's the "brains" behind the company's proprietary software line and because if an adversary had access to it, they could quickly write new malware (known as a "Zero-Day") that would silently compromise any protections that the software offered to its legitimate customers. If the compromised application is security software, like it is in this case, then the impact of the stolen source code is much worse. Since the malware author is writing exploits for heretofor unknown weaknesses in the code, the Symantec customer will probably never know that he's been compromised. If Symantec is this careless about securing and monitoring their Norton code repository, how can they state with confidence that any of their products are safe from compromise? It appears that they can't. Notice the wording in their latest posting at their website (January 24, 2012, 22:50 PST) which refers to a non-Norton product: "The Symantec Endpoint Protection 11 product – which was initially released in the fall of 2007 – was based upon a separate code branch that we do not believe was exposed." (emphasis added)
If my company was a Symantec customer, and we aren't, I wouldn't want to know what Symantec "believes". I'd want to know what Symantec "knows". If they can't say definitively that Symantec Endpoint Protection is safe to use, then my advice to Taia Global clients and others is to not use it. The products that Symantec has acknowledged are compromised in the afore-mentioned notice on its website are:
- Norton Antivirus Corporate Edition
- Norton Internet Security
- Norton SystemWorks (Norton Utilities and Norton GoBack)
- Norton pcAnywhere
- Norton Antivirus Corporate Edition
- Norton Internet Security
- Norton SystemWorks (Norton Utilities and Norton GoBack)
- pcAnywhere 12.0, 12.1 and 12.5
- Symantec Endpoint Protection v11.0, which is four years old
- Symantec AntiVirus v10.2, which is five years old code (discontinued)
