Norton AntiVirus source code leaked to hackers?

Norton AntiVirus source code leaked to hackers?



A group of Indian hackers say they have obtained the source code for Norton AntiVirus software, as well as "confidential documentation," that they will share on websites for all to see.

The group, which calls themselves "The Lords of Dharmaraja," said it plans to publish the information on several different websites, "since we experience extreme pressure and censorship from US and India government agencies." It shared some of the information — some of which appears several years old — and a statement on the PasteBin file-sharing site. The original post was deleted, but a version is available to be seen via Google's cache of it."

Full story here:



http://technolog.msnbc.msn.com/_new...orton-antivirus-source-code-leaked-to-hackers

 

Hacker group threatens to release Symantec AV source code
Indian group has already posted documents on Symantec's AV technology


January 5, 2012 (Computerworld)

"Symantec is investigating an Indian hacking group's claims that it accessed source code used in the company's flagship Norton Antivirus program.

A spokesman for the company on Thursday said that one claim by the group was false, while another is still being investigated.

Meanwhile, the Indian group, which calls itself Lords of Dharmaraja, has threatened to publicly disclose the source code shortly.

On Wednesday, the group posted on Pastebin what it claimed was confidential documentation related to Norton AntiVirus source code. A review of the material showed what appears to be a description of an application programming interface (API) for Symantec's AV product.

The group also posted what it claimed was the complete source code tree file for Norton Antivirus. That document appears to have been taken down.

'Yama Tough,' the hacker who posted the documents, released at least two more on Google+ allegedly related to Symantec source code. One of the documents appears to be a detailed technical overview of Norton Anti-Virus, Quarantine Server Packaging API Specification, v1.0. The other document, from 2000, describes a Symantec Immune System Gateway Array Setup technology."

Full story here:

http://www.computerworld.com/s/arti...release_Symantec_AV_source_code?taxonomyId=17

 

" The group, which calls themselves "The Lords of Dharmaraja," said it plans to publish the information on several different websites, "since we experience extreme pressure and censorship from US and India government agencies." "


Leaking Norton source code.........the number one way to get back at the government.

 

Source: http://www.scmagazine.com/hackers-say-they-have-symantecs-norton-av-source-code/article/222003/

 

"The hacker group threatened to release the actual source code for the Norton AntiVirus software later on. “We are working out mirrors as of now,” the hackers wrote in their post."

http://bits.blogs.nytimes.com/2012/...t-source-code-for-symantecs-flagship-product/

 

I think a skilled enough hacker will be able to see the source code of any application if he/she puts his mind to it.

KAV source code was leaked years ago and it still floats around if you know where to look. But that doesn't seem to have affected it's protection.

Ultimately all these applications are developed using a mix of C/C++ and ASM instructions anyway, it's not impossible to see what's going on.

 

Yep....total government shutdown!

 

Tha leaked KAV source code was at least 3 years old. Because it is claimed the Norton source code was lifted from a military source, if these guys have it, it would be current. Many governments require that the provider of any software used must also deliver the current source code so that the government can make sure there is no method of spying on its systems contained in it:

"In January 2011, the source code for an older version of Kaspersky Antivirus was uploaded to a torrent site. The intellectual property was stolen in early 2008 by a former Kaspersky employee who attempted to sell it on the Internet. "

http://www.pcworld.com/businesscent...norton_antivirus_source_code.html#tk.rss_news

""As of now we start sharing with all our brothers and followers information from the Indian Militaty (sic) Intelligence servers, so far we have discovered within the Indian Spy Programme (sic) source codes of a dozen software companies which have signed agreements with Indian TANCS programme (sic) and CBI," Yama Tough said in one comment."

http://www.computerworld.com/s/arti...release_Symantec_AV_source_code?taxonomyId=17

 

Seems the article at Technolog has been updated:

What's not known is whether they have the source code for the database and scan engine as well.

 

Very Good!!!
Now what would be the next step?
I think they should make an anti-virus (with different name- There is already an AV name N360 in the indian market) with that source code & direct the update definition to norton update servers...lol
And if they sell it with cost lower than Norton, They could be millionaires...
No need to publish it!!!!
Just imaging , don't take me seriously
And don't worry nobody's gonna publish Norton source code!!!!

 

If the code is really 4+ years old it's just irrelevant. Parts of it might still be interesting but for the most part the stolen data is pretty much useless.

 

I am so glad I use Microsoft's antivirus. They would NEVER let this happen.

lol, kidding.

Yeah, this could happen to any of them pretty much. This is the whole security thru obscurity isn't security, but over popularity can lead to more attack attempts.

 

I have heard that but would tend to disagree. I'm sure some of the code is reused for years. There is no way they completely start over every year, or even every 2. You'll notice how the same definitions apply to many different years of their product.

 

if they had gotten hold of the code I am sure they would have been resourceful enough to have figured a way to release it by now,probably a ploy by a competitor to cause a few paranoid users to dump it and possibly move to their product

 

4 years ago, Norton was still on weekly updates basically. Heuristics were mediocre, there was no SONAR or file reputation tech, nothing.

 

"Symantec Gets Pwn3d: The Fallout" : http://www.infosecisland.com/blogview/19202-Symantec-Gets-Pwn3d-The-Fallout.html

by Kevin McAleavey

 

if the code is old, then its worth nothing.

else, it could be a huge damage.

 

R.I.P. Norton!!!

 

I still wouldn't dismiss it so quickly. From the following link: http://www.infosecisland.com/blogview/19182-Update-3-Hackers-May-Leak-Norton-Antivirus-Source-Code.html

If there was code from 1998 in source code from 4 years ago you can be guaranteed that there is still some of this code in the current product. As has been mentioned on their own forums Norton Utilities 15 (the current version) uses vb6. Tell me that doesn't have old code in it. http://community.norton.com/t5/Other-Norton-Products/Norton-Utilities-15-will-not-run-on-W7-Pro-64-bit/m-p/442186#M33905

Claiming it is irrelevant because it is old would be like saying a leak of the Windows XP source code today wouldn't matter because it is 11 years old. I'm not trying to slam Norton here as much as I think we should all be realistic about the fact that if ANY source code was leaked for any of their products that were capable of running on an OS that is still available and in use (XP, Vista) we should be concerned instead of just blowing it off. Their damage control will be to invalidate this story. It is what I would do.

 

I see you're using kaspesky:-same claim was made by hackers about their source code a couple of years back,that claim turned out to be wrong/exaggerated,we all know how these hacker groups like to boost their ego's and kudos amongst their peers:-if this group had managed to get what they claim and it was relevant to current products it would be all over the net by now,current norton products work in an entirely differnt way to anything pre 2009(the 2010 range)

 

I new someone would go there and I didn't take that claim lightly either. For the record I also own a current 3 user license for Norton Internet Security. Sandboxie and SRP are your friends. Or at least mine.

 

wasn't using fact that you're using kaspersky to mean therefore you'll be knocking Norton was just saying a similar claim was made about their products not long back,and I dare say similar claims will be made in the future about most of the popular anti-malware vendors,its the kudos thing that so called hackers crave more than the actual effect/damage they cause

 

What are you basing this on?

We don't know how Norton's heuristic detection works on a code level. It could very well be similar to how it has always worked or worked for the last few years.

What makes you think that there has been some big rewrite to the code?

And it's already been confirmed that the code was stolen.

 

well for start off insight!! Norton nowadays is more of an "in the cloud" product than a stand a alone product where all the protection components are on the users PC

 

Hacker group is planning to release source code for Symantec's PCAnywhere software. YamaTough, the spokesperson for this group has tweeted.

source: http://betteratsecurity.blogspot.com/2012/01/hacker-to-release-symantecs-pcanywhere.html
and full story: http://www.infosecisland.com/blogview/19399-Hacker-to-Release-Symantecs-PCAnywhere-Source-Code.html