Printable View
Source: http://www.rawstory.com/rs/2012/01/0...-code-exposed/
The story itself is not a news. Understandible that there is no 100% solution against data leak. Many enterprises faced such things from time to time. The question is what to do when a data (in this matter source code) alredy leaked away? My thoughts is to prtect source code itself to harden itsreversing and analysis. It could give some time to conduct preventive measures.
Hi nerva, and welcome to AO :)
The best protection for your intellectual property (source code) is to employ a team of good Patent Lawyers. Then a competitor can gain no advantage from the knowledge.
As for criminals, I doubt if they would be that interested. They know how security software works in principle, and design their malware to avoid it in general, rather than for a specific vendor. If they worked on the source code, they would fall into the trap of designing and writing for a specific product.
You write your malware then test it against security software. You then look at how any that detected your application found it, and amend your code accordingly.
Otherwise you would need the source code for all security products and you would automatically be behind in the race rather than in front.
Remember that AV vendors talk to each other, and it only takes one of them to identify your malware and the game is over.
If you have to hand out source code to third parties, I would recommend two fundamental precautions you should take:
1. Only give them that part that is relevant to them, and as up to date as is relevant.
2. Uniquely "watermark" it so that you can immediately trace the source of any leak.
;)
So, nihil, you think that the fact of code leaking in this circumstances is not a problem for Symantec?
Hi there nerva,
I think that there are two aspects to your question.
1. It is embarassing for Symantec, in that they are sellers of security products and have been seen to have a leak in their own security.
IT professionals will not pay much attention to this, as the problem happened at a third party, and was a matter of physical security, rather than the effectiveness of Symantec's products.
We all know that once data leaves your premises it is out of your control and at risk. This is why we encrypt data in transit.
2. From a technical viewpoint it should not be a problem either, as the code was old, and of no real interest to competitors anyway.
3. If Symantec's competitors are truly in competition, they have their own way of doing things, and don't really care about anybody else's detailed solutions. What the competitors claim to be able to achieve is far more important than how they actually do it.
It is really all about marketing these days, as traditional security products are pretty much obsolete other than in the private user sector.
**** may just start to get interesting come Tuesday. :drink:
Quote:
A hacker who goes by the name of 'Yama Tough' threatened Saturday to release next week the full source code for Symantec Corp's flagship Norton Antivirus software.
"This coming Tuesday behold the full Norton Antivirus 1,7Gb src, the rest will follow," Yama Tough posted via Twitter.
In the past week Yama Tough has released fragments of source code from Symantec products along with a cache of emails. The hacker says all the data was taken from Indian government servers.
I'm sitting on the fence on this, i think the kid is trying to gain more of the spotlight, as the 1st mention of there intrusion was forgotten about pretty darn quickly.
But another part of me thinks maybe just maybe he did get lucky. :confused:
Yeah, it sounds rather like the work of a disgruntled ex-employee trying to embarass the Indian government or parts of it?
If I were a malware author I don't think I would be interested in AV source code as much as I would be in the signature files.
Most AV still relies very much on signature or pattern matching, so knowing what they are looking for would be of more use in obfuscating your code than knowing how it looks for it.
Similarly, which files are being monitored for on the fly changes, which Registry entries and so on. You already know what it does so how it does it isn't that interesting, compared to what it will and won't detect?
A lakh of rupees for ze man who breengs me ze 'ead of Alfredo Singh.......................................
Ok guys. I undesrstood that i definately need to rise my knowladge in the foeld of information security. Can you advise me couple of events in Europe and USA like InfoSecurity London, but more conference based style? To attend, listen and discover what's going on around?
Kinda scary......Zero Days are already in the wild.....Glad I stayed away from these fools years ago.......just sayin'! Then again, code is being Reversed, Sourced, and Bypassed every minute....quite frankly, this won't matter much....but it will matter....IMHO
Well, if you look at security products, they have two basic elements:
1. The static part, core, or "engine". This is defined in the source code and changes very infrequently, typically every year, or no more frequently than 6 months.
2. The dynamic part. This comprises current detection routines and the traditional patterns or code strings. Patterns can change hourly, and are invariably updated at least daily. The detection processes change less frequently but would typically be several times a month.
The source code is irrelevant to a malware author, it is the dynamic part that determines whether his product will be detected or not, and that is assuming that he hasn't disabled or totally circumvented it.
The days of hard coding variables, and monolithic architectures have long gone, so the source code is pretty much irrelevant. ;) The source code will not contain the source of dynamic executables, only the calls to them.
You know there may be some good coming from this!
Maybe someone can read the Source Code and find a way to actually un-install that ****.
Hahahahaha......SO VERY VERY TRUE gore!!!
Hmmm , if they are crap then why are they pipping us (Panda) :). We still have customers clinging to their Symantec AV ...
That's easy Cider,
It's called "MARKET INERTIA", which is what happens when people stick with products that are well known, or they know rather than making a more objective purchasing decision.
"Norton" were around when there really only was them and McAfee to chose from.
Also they market more aggressively than you do....... I must have seen literally dozens of OEM boxes that had a 3 month trial pre-installed. You also find it bundled with motherboards and video cards......................
Some update : http://www.it-online.co.za/?p=53913?...mpaign=article
Quote:
Security software vendor Symantec has issued a warning that users of its pcAnywhere product could be vulnerable following the disclosure by Anonymous that source code could have been compromised.
and yet another update
http://www.bbc.co.uk/news/technology-16927660
lol - extortion has begun! who needs kidnapping anymore??? Just crack some code and sell it back.
Like Mosaic and Internet Explorer? lol ;)Quote:
Originally Posted by Cider
Hmmm, this doesn't look good for Symantec as a corporation to be trusted?
The only real issue is PCAnywhere, as that product puts users at direct risk.
If this data theft occurred in 2006 and Symantec obviously knew about it, why have they only just issued patches for PCAnywhere in the last couple of weeks. They MUST have known of the implications and just didn't give a damn...................:rolleyes:
Its all about how much they can get away with too save money. We are the same. We just let go over 100 people a while back and you have to see the ridiculous things that are happening due to money constraints.