Symantec breach: Data breach basis of Norton source code leak

Symantec is downplaying the importance of a breach of its systems in 2006 that led to the source code leak of its Norton Antivirus Corporate Edition, SystemWorks and pcAnywhere software.

We can definitively say users of [September 11 and SAV 10.2] face no cybersecurity risk from any attacks that may be generated by the code stolen in 2006

Cris Paden, senior manager of Symantec

The security giant said this week that the Symantec source code theft of the 2006-era software poses no risk to current Norton customers. End result of the Symantec breach, the corporate is reaching out to pcAnywhere users with “remediation steps” to preserve the security in their devices and data.

“Due to the age of the exposed source code, except as specifically noted below, Symantec customers â€" including those running Norton products â€" shouldn't be in any increased danger of cyberattacks due to this incident,” said Cris Paden, senior manager of Symantec Corporate Communications.

The age of the source code severely limits the type of attack that may be generated, Paden said. New safety features in both Symantec and Norton products protect customers from any attack stemming from the old code.

Earlier this month, Symantec confirmed an India-based group suspected of getting close ties with Anonymous obtained the source code to Symantec Endpoint Protection 11 and Symantec Antivirus 10.2. The corporate is backtracking due to further evidence that the gang is in possession of Norton source code, because it claimed in a post at the Pastebin website; the post has since been removed. Symantec initially thought the source of the leak was the pc systems of a "third party" and that its systems had not been penetrated.

“We can definitively say users of [9-11 and SAV 10.2] face no cybersecurity risk from any attacks that will be generated by the code stolen in 2006,” Paden said, acknowledging that the company's earlier information was invalid.

Investigators revisit breach in hunt for wrongdoer
Paden told SearchSecurity.com that an initial computer forensics investigation was inconclusive in 2006. The revelation of the early source code has caused Symantec to reopen the breach investigation. The corporate doesn't know if a rogue employee was accountable for the leak or if the company was penetrated by an external attacker.

“We revisited our records and logs from that point period according to the indisputable fact that each of the code that Anonymous claimed they'd was for 2006 versions of software. From there, we were ready to connect the dots that code actually was taken,” Paden said. “We have also not confirmed how the code came into the possession of Anonymous.”

Since the 2006 breach, Symantec said it has bolstered the safety of its internal network by adding network monitoring, endpoint security and extra data loss protection technologies and controls.  “We also removed many non-essential legacy domains to be certain our overall network security and redeveloped our internal security awareness and coaching processes,” Paden said, stressing that the safety improvements weren't based on the 2006 breach.

Dig Deeper

• Folks that read this also read...