pcAnywhere Code on the Internet

Image via CrunchBase

On the Pirate Bay torrent tracker, a 1.3GB RAR archive has been published which contains the source code of the PC remote control software pcAnywhere. Symantec has already confirmed the authenticity of the code which was stolen in an incident in 2006 when unknown parties gained access to the source of various Symantec products.

The source code of Norton Utilities is already in circulation according to the company. Symantec expects that the source code of Norton AntiVirus (Corporate Edition) and Norton Internet Security will, sooner or later, also be posted online.

Pirate Bay torrent Tracker - Photo of the files

The publication is presumably the work of Yamatough, a hacker who claims to be part of the loose hacktivist collective Anonymous. Excerpts from an email exchange between Yamatough and Symantec employees have also appeared on the internet. The emails concerned a proposed payment of $50,000 to the hacker in order to prevent the publication of the source code.

Both the hacker and the company say their participation was a ruse, with Yamatough always planning to publish and Symantec saying they were being directed by a law enforcement agency. Yamatough told Reuters that “We tricked them into offering us a bribe so we could humiliate them”. Which side actually proposed the deal is currently unclear because the leaked emails do not contain the start of the negotiations.

The alleged Symantec employee, named Sam Thomas, pretended to want to take on the deal and was able to hold out for three weeks. A Symantec spokesman told Forbes that Sam Thomas was a false name used by the investigating authorities who wanted to find out the hacker’s identity.

Symantec used the extra time to patch known security holes and issue security warnings of an increased threat to customers, but it only did the latter after the hacker had published a snippet of the stolen code online. In the meantime, the company has even gone as far as to explicitly discourage the use of pcAnywhere.

Hackers release Symantec pcAnywhere source code (cbsnews.com)
Hackers fail to extort $50,000 from Symantec, as pcAnywhere source code is published (nakedsecurity.sophos.com)
Hackers Publish Symantec’s Source Code After $50,000 Extortion Attempt Fails [Hackers] (gizmodo.com)

February 8, 2012 | Categories: Anonymous, Enterprise, Exploit, General Security, Hacking, Network Security, Patching, PCAnywhere, Security, Security Advisory, Vulnerabilities, Zero-Day | Tags: Norton AntiVirus, norton antivirus corporate edition, Norton Internet Security, Norton Utilities, pc remote control software, PcAnywhere, Pirate Bay, pirate bay torrent, rar archive, remote control software, Source code, Symantec, symantec products, Yamatough | Leave a comment

In the round file cabinet goes; PCAnywhere

Critical flaw discovered in Symantec’s pcAnywhere

Symantec has issued a warning about a critical vulnerability in pcAnywhere, the remote control application for PCs. The vulnerability could allow an attacker to remotely inject code into a system running pcAnywhere and then run it with system privileges. This attack works because a service on TCP port 5631 allows user input during the authentication process which is not adequately checked.

Image via CrunchBase

According to Symantec, this port should, under normal conditions , only be reachable by authorised network users, so an attacker would have to first gain access to the network or another computer on the network to compromise other systems. In practice though, overly lax firewall configurations mean that such ports are always available somewhere on the internet.

Symantec is also correcting a vulnerability which meant that files installed during pcAnywhere’s installation process were marked as writable by everyone. This would allow an unprivileged user with local access to overwrite these files, possibly with code which could grant elevated privileges.
LoJack for Laptops Standard, boxed software, 1 year – 20% OFF. Was $39.99 – Now $31.99 Click Here
Further details of the two holes are still being kept under wraps by Symantec and exploits are reportedly not in circulation. As the flaws were reported by security researchers Tad Seltzer (via ZDI) and Edward Torkington (of NGS Secure) it is probable that the discovery of the flaws is not related to the recent theft of source code for an older version of pcAnywhere.

pcAnywhere 12.5.x is vulnerable to the flaws, as are versions 7.0 and 7.1 of the company’s IT Management Suite Solution. Symantec has released a hotfix which can be installed either manually or automatically with Symantec’s LiveUpdate system.

Symantec has admitted that blueprints for current versions of its pcAnywhere software were stolen in 2006 and that all users are at risk of attack and should pull the plug.

That includes users of both current and past iterations as well as those bundled with Altiris and the pcAnywhere Thin Host packaged with backup and security products.

The theft came to light when an Indian hacking group calling itself the Lords of Dharmaraja threatened to publish the source code.

The gang’s apparent spokesperson, who goes by the name of “Yama Tough,” posted code from the 2006 version of Symantec’s Norton AntiVirus to PasteBin and subsequently wrote about the breach on Google+.

It was originally unclear whether the breached source code was relevant to up-to-date installations of Symantec’s anti-virus products.

The confusion has lifted, showing that the danger to users of current products is all too real.

Symantec revealed the news in a white paper[PDF] published on Wednesday, along with a customer advisory on its website.

Symantec’s investigation so far hasn’t found increased risk of exposure to customers using any product, with the marked exception of pcAnywhere, which allows for direct PC to PC communication.

Here’s what the security firm had to say about the pcAnywhere-specific risks, as paraphrased from its white paper:

The encoding and encryption elements within pcAnywhere are vulnerable, making users susceptible to man-in-the-middle attacks, depending on the configuration and use of the product. If a man-in-the-middle attack should occur, the malicious user could steal session data or credentials.

A secondary risk: If a malicious user obtains the cryptographic key, they can launch unauthorized remote control sessions and thus access systems and sensitive data.

If the cryptographic key itself is using Active Directory credentials, it is also possible for attackers to perpetrate other malicious activities on the network.

In an internal pcAnywhere environment, if a network sniffer was in place on a customer’s internal network and the attacker had access to the encryption details, the pcAnywhere traffic could be intercepted and decoded. This implies that a customer either has a malicious insider who planted the network sniffer or has an unknown Botnet operating in their environment. As always, security best practices are encouraged to mitigate this risk.

Since pcAnywhere exchanges user login credentials, the risk exists that a network sniffer or Botnet could intercept this exchange of information, though it would still be difficult to actually interpret the data even if the pcAnywhere source code is released.

For environments with remote users, this credential exchange introduces an additional level of exposure to external attacks.

Company spokesman Cris Paden told Reuters that Symantec has fewer than 50,000 customers using the stand-alone version of pcAnywhere, which, Reuters reported, was still on sale on its website for $100 and $200 as of early Wednesday afternoon.

Symantec recommends in the white paper that customers disable the product until the company can release a set of updates to deal with the currently known vulnerability risks.