Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Extortion Plot Behind Anonymous Release Of pcAnywhere: Symantec

Symantec says Anonymous hackers tried to carry out an extortion plot before releasing source code to pcAnywhere; law enforcement agencies involved in sting and ongoing investigation.

Anonymous: 10 Facts About The Hacktivist Group
Anonymous: 10 Facts About The Hacktivist Group
(click image for larger view and for slideshow)

Anonymous appears to have released the source code to a 2006 version of the pcAnywhere remote access software from Symantec.

The AnonymousIRC channel on Twitter, a reliable source of Anonymous-related information, said late Monday that the group had indexed a copy of the pcAnywhere source code on The Pirate Bay, a Swedish site that indexes BitTorrent files available for download. The torrent file in question, billed as "Symantec's pcAnywhere Leaked Source Code" downloads a 1.27 GB file named "pcanywhere.rar." In comments on the download page, people said the RAR file extracted to 2.75 GB of data.

A message on the download page reads: "'Symantec has been lying to its customers. We exposed this point thus spreading the world that ppl need' - #AntiSec #Anonymous #AntiSec_Ops." Interestingly, the so-called AntiSec operation--formed by LulzSec and Anonymous--was meant to target security firms, on the grounds that they scared people into purchasing their wares. In reality, however, most AntiSec operations appeared to target governments and especially police departments. Now, however, AntiSec appears to have tackled one of the world's largest security vendor.

In an emailed statement to InformationWeek, Symantec confirmed that it had initially communicated with one or more hackers that claimed to possess its source code. "In January an individual claiming to be part of the 'Anonymous' group attempted to extort a payment from Symantec in exchange for not publicly posting stolen Symantec source code they claimed to have in their possession," said the company. "Symantec conducted an internal investigation into this incident and also contacted law enforcement given the attempted extortion and apparent theft of intellectual property. The communications with the person(s) attempting to extort the payment from Symantec were part of the law enforcement investigation."

Indeed, according to a collection of emails posted Monday to Pastebin under the account name "Sam Thomas," Yama Tough Monday issued an ultimatum, demanding that Symantec wire $50,000 into an offshore account within 10 minutes, or else "two of your codes fly to the moon PCAnywhere and Norton Antivirus totaling 2350MB in size." In addition, he said, "this time we've made mirrors so it will be hard for you to get rid of it."

The emails show Yama Tough contacting a Symantec employee named "Sam Thomas" beginning January 17, 2012. But Yama Tough had to switch from emailing Symantec directly, to emailing a Gmail account in Sam Thomas's name, since the file attachments he sent--to prove that he's really in possession of the stolen source code--don't seem to have gotten through Symantec's email server.

Subsequently, Symantec offered to pay Yama Tough, but not the amount that he'd requested. "We can't pay you $50,000 at once for the reasons we discussed previously," the emails read. "We can pay you $2,500 per month for the first three months. In exchange, you will make a public statement on behalf of your group that you lied about the hack (as you previously stated). Once that's done, we will pay the rest of the $50,000 to your account and you can take it all out at once. That should solve your problem."

According to Symantec, it was working with law enforcement officials when it communicated with Yama Tough. "The e-mail string posted by Anonymous was actually between them and a fake e-mail address set up by law enforcement," according to an emailed statement from Symantec. "Anonymous actually reached out to us, first, saying that if we provided them with money, they would not post any more source code. At that point, given that it was a clear cut case of extortion, we contacted law enforcement and turned the investigation over to them. All subsequent communications were actually between Anonymous and law enforcement agents--not Symantec. This was all part of their investigative techniques for these types of incidents." Symantec declined to detail the law enforcement agencies involved, saying their investigation was ongoing.

Negotiations aside, Yama Tough--who said he'd already shared the source code with Anonymous--apparently stuck by his ultimatum with the Monday release of the source code. Furthermore, the pcAnywhere release will apparently not be the last such disclosure. A Tuesday post to the Twitter channel "LoD"--for Lords of Dharmaraja, the self-described "Anonymous Avengers of Indian Independence Frontier"--promised that the source code to Norton AntiVirus would be released later in the day.

Yama Tough is the leader of Lords of Dharmaraja, which also claimed to possess memos between the Indian government and smartphone manufacturers, proving that the device makers had traded secret all-access codes to their hardware--backdoors--in exchange for access to India's telecommunications market. Many experts, however, think those memos were faked.

But other information stolen by the self-described hacktivist group appears to be real. That includes source code for an older Symantec's Norton antivirus product, as well as its pcAnywhere remote-access software.

Symantec at first dismissed claims that hackers possessed such source code. But it later recanted and said it had discovered that a 2006 security incident had resulted in the theft of some of its security software source code, including the complete source code--circa 2006--for pcAnywhere. That led Symantec to issue a rare security bulletin warning that all installations of pcAnywhere should be disabled or deleted unless absolutely needed, and then only used after locking down machines to help prevent the software from being exploited.

Subsequently, Symantec released an updated version of pcAnywhere that was patched against unknown vulnerabilities, but questions persist about whether malicious actors may yet unearth unknown--or zero-day--vulnerabilities that they could surreptitiously exploit in the latest version of the software.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8860
PUBLISHED: 2020-02-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S10 Firmware G973FXXS3ASJA, O(8.x), P(9.0), Q(10.0) devices with Exynos chipsets. User interaction is required to exploit this vulnerability in that the target must answer a phone call. ...
CVE-2020-8861
PUBLISHED: 2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue...
CVE-2020-8862
PUBLISHED: 2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from the...
CVE-2020-9330
PUBLISHED: 2020-02-21
Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices (e.g., by using default credentials) can change the LDAP connection IP a...
CVE-2020-9327
PUBLISHED: 2020-02-21
In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.