Source code from the antivirus firm Symantec has been held hostage for the last month in a tense negotiation between the Anonymous hackers who stole that code and law enforcement agents who impersonated Symantec execs to set up a sting operation aimed at tracking down the data thieves. Now it seems the negotiations are over, and the hostage is dead.
Hackers associated with the group Anonymous known as the Lords of Dharamaja leaked what appears to be another 1.27 gigabytes of source code from Symantec Monday night, what they claim is the source code of the Symantec program PCAnywhere. The leak comes as little surprise: Symantec had previously revealed that the hackers had obtained 2006 versions of that code along with other Symantec products from the same time period, and warned users of PCAnywhere to disable its functionality until they patched the program earlier this month.
More interesting is another release from the same hackers: An email chain that shows what appears to be a Symantec staffer offering the hackers $50,000 to not release the code and to publicly state that they didn't possess it. "We can pay you $2,500 per month for the first three months," the email from someone at Symantec named Sam Thomas reads. "In exchange, you will make a public statement on behalf of your group that you lied about the hack (as you previously stated). Once that's done, we will pay the rest of the $50,000 to your account and you can take it all out at once. That should solve your problem."
"You won't believe it but Symantec offered us money to keep quiet," a hacker from the group who uses the name YamaTough wrote on Twitter. "And quess what they couldn't make it over 50k for the whole range of their src shit, therefore the show starts as of tuday."
In fact, Symantec says it never made any offer to meet the hackers' extortion demands. "Sam Thomas," Symantec spokesperson Cris Paden told me in an interview late Monday night, was the false name created by law enforcement agents who pretended to pursue the negotiations only to attempt to trace the hackers. The entire conversation had been a ruse.
"Anonymous has been talking to law enforcement, not to us," Paden says. "No money was exchanged, and there was never going to be any money exchanged. It was all an effort to gather information for the investigation."
The Lords of Dharamaja have publicly claimed since early January to have access to the source code from a range of Symantec products, and Symantec confirms the hackers leaked the source code of the 2006 version of Norton Internet Security code on January 13. According to Paden, Symantec began to receive emails from the hackers a few days later, in which the group demanded money not to publish the portion of Symantec's source code it hadn't yet released.
When they came to us with what was for all intents and purposes extortion, we went to law enforcement," says Paden. "From that point on, we turned over the investigation to them." Paden says he can't comment on which law enforcement agencies are involved, as the investigation is ongoing.
Over the next weeks, the law enforcement agencies engaged in protracted negotiations with the hacker YamaTough, captured in the leaked email chain. At one point the agent pretending to represent Symantec offered $50,000 in small increments, but YamaTough insisted the fee be paid in one lump sum to its Liberty Reserve account, refusing to accept a PayPal transfer. At another point, YamaTough accused Symantec of working with the FBI to trace him, and Symantec denied they had contacted the FBI.
Finally on February 6th, YamaTough seems to have grown impatient, and decided to post the code, which is now available on bittorrent.
Symantec's Paden says that the company is still analyzing the leaked code, but that given that it was years out of date, the company's recent patches for PCAnywhere should protect its customers. "We’re able to say with high confidence, any type of cyber attacks generated by this attack would have old characteristics and look like an attack from 2006 that can easily be stopped using current versions of our solutions," he says. "Our customers are protected." Meanwhile, Paden says he can't comment as to whether law enforcement's attempted sting operation yielded any success in tracking down the hackers, and he adds that the investigation into the theft of Symantec's code continues. "As to what happens next," he says. "We’re not really sure."
Read the entire leaked email chain between the hacker YamaTough and the law enforcement agent pretending to be a Symantec exec here.
15 comments