Hacker posts Symantec source code after ransom demand fails

[bemildred]

A hacker has released stolen source code from Symantec Corp., one of the largest computer security firms, after a phony set of ransom negotiations failed, according to the company.

The source code is part of a Symantec product called pcAnywhere, which allows users to log into and control home or work computers from remote locations. Access to the code could in theory give hackers insight into how to seize computers that use the software.

Symantec said the source code was for 2006 products that had since been updated with newer code. Even so, the company said, it had contacted customers in recent weeks to get them to apply software upgrades that could address known security problems.

The hacker, going by the name Yamatough, appeared to release a tranche of the code onto the controversial file-sharing site Pirate Bay on Tuesday, just as Symantec disclosed that ransom talks with the hacker were conducted by law enforcement personnel posing as a Symantec employee.

http://www.latimes.com/business/technology/la-hackers-post-source-code-from-symantec-remote-login-software-20120207,0,3686964.story

[Pab Sungenis]

1. One question.

Even so, the company said, it had contacted customers in recent weeks to get them to apply software upgrades that could address known security problems.

Uhhhh... if they knew about these security problems why did they only push upgrades after someone threatened to post source code that could reveal them? Shouldn't they have pushed the patches long before?

This calls a lot of question into Symantec's "security" software, too, if you ask me.

[drm604]

2. It's likely that they did push the upgrades previously.

They're probably doing it again in case there are people who didn't bother to upgrade previously.

[BadgerKid]

5. See 'security through obscurity'. n/t

[bemildred]

6. +1. nt

[hobbit709]

3. Good thing I don't use any Symantec bloatware.

[bemildred]

4. Generally, the first thing I remove, if it's going to be a Windoze box.

If not, you can just clobber the whole disk. Much quicker.