Incident: Hacking Incident Exposes Symantec Source Code Vulnerabilities and Sales Practices

Published Date: 2012-01-06

Postmortem Analysis
Timeline 1. The software failure incident involving the hacking and theft of Symantec's source code for Norton Antivirus and other products occurred in 2006 [Article 9617]. 2. The software failure incident involving Hacking Team being hacked and having documents leaked showing sales to repressive regimes happened in July 2015 [Article 38028].
System 1. Symantec Norton AntiVirus source code security system [9606] 2. Symantec network security system [9617] 3. Symantec enterprise security products [9632] 4. Hacking Team security services and software [38028]
Responsible Organization 1. The hacker group 'Yama Tough' was responsible for causing the software failure incident by threatening to release the full source code of Symantec's Norton AntiVirus software [9606, 9617]. 2. The hacker group 'Lords of Dharmaraja' was responsible for causing the software failure incident by obtaining and releasing segments of Symantec's source code for its enterprise security products [9632]. 3. The hacker(s) who targeted and hacked Hacking Team were responsible for causing the software failure incident by leaking documents that revealed the company's activities, including selling software to repressive regimes [38028].
Impacted Organization 1. Symantec Corp - The software failure incident impacted Symantec Corp as their source code for flagship products like Norton Antivirus was stolen in a security breach [Article 9617]. 2. Hacking Team - The software failure incident impacted Hacking Team as they were the victim of a hack, leading to the exposure of sensitive documents and information about their operations [Article 38028].
Software Causes 1. The software failure incident was caused by a security breach in 2006 that led to the theft of source code for Symantec's flagship products, including Norton Antivirus Corporate Edition, Norton Internet Security, Norton SystemWorks, and PCAnywhere [Article 9617]. 2. Another software cause of the failure incident was the unauthorized access and theft of source code for Symantec's enterprise security products, specifically Symantec Endpoint Protection 11.0 and Symantec Antivirus 10.2, by hackers [Article 9632]. 3. The failure incident was also attributed to the hacking of the cybersecurity firm Hacking Team, resulting in the exposure of sensitive documents and information, including the sale of software to repressive regimes and potential unethical practices [Article 38028].
Non-software Causes 1. Lack of proper security measures leading to a security breach [9617, 9632, 38028] 2. Alleged involvement with repressive regimes [38028]
Impacts 1. The software failure incident involving Symantec's source code theft in 2006 led to the exposure of source code for several of its flagship products, including Norton Antivirus Corporate Edition, Norton Internet Security, Norton SystemWorks, and PCAnywhere [9617]. 2. The incident resulted in a potential security risk for users of Symantec's remote-access suite PCAnywhere, with Symantec notifying these users of the situation and providing remedies to protect their data [9617]. 3. The theft of source code could have allowed hackers to search for vulnerabilities in the products that may be unpatched and exploited, potentially impacting the security of Symantec's software [9632]. 4. The incident raised concerns about the possibility of Symantec's security software being circumvented by hackers who could have used the stolen source code to devise ways to bypass the software's defenses [9632]. 5. The software failure incident also led to a lawsuit filed against Symantec in the U.S., accusing the company of encouraging customers to buy their product with scare tactics, indicating potential reputational and legal consequences for the company [9606].
Preventions 1. Implementing robust cybersecurity measures such as regular security audits, penetration testing, and network monitoring to detect and prevent unauthorized access to sensitive source code [Article 9617]. 2. Enhancing third-party vendor security protocols to ensure the protection of source code stored by external entities [Article 9632]. 3. Strengthening internal security practices to prevent insider threats and unauthorized access to critical software source code [Article 9632]. 4. Implementing strict access controls and encryption mechanisms to safeguard source code repositories from unauthorized access [Article 9632]. 5. Educating employees and contractors on cybersecurity best practices to prevent social engineering attacks and unauthorized disclosures of sensitive information [Article 38028].
Fixes 1. Enhancing network security measures to prevent unauthorized access and data breaches [9617]. 2. Conducting thorough investigations to identify vulnerabilities and address them promptly [9617]. 3. Implementing stricter controls and monitoring of access to sensitive source code [9632]. 4. Regularly updating and patching software to address any known vulnerabilities [9632]. 5. Strengthening policies and procedures related to third-party entities handling sensitive information [9632]. 6. Enhancing communication and transparency with customers regarding security incidents and potential risks [9617]. 7. Collaborating with cybersecurity experts to assess and improve overall security posture [38028].
References 1. Symantec Corp [9606, 9617, 9632] 2. Yama Tough (hacker) [9606, 9617] 3. Lords of Dharmaraja (hacker group) [9632] 4. Hacking Team [38028] 5. Anonymous (hacker group) [9617]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - Symantec experienced a security breach in 2006 that led to the theft of source code for some of its flagship products, including Norton Antivirus and other security software [9617]. - Prior to this incident, Symantec had confirmed that hackers obtained source code to two of its enterprise security products in 2006 [9632]. - The breach in 2006 was attributed to hackers infiltrating Symantec's own networks, leading to the theft of source code for various Symantec products [9617]. (b) The software failure incident having happened again at multiple_organization: - Hacking Team, a cybersecurity firm, was also a victim of a hack where documents were posted showing it sold software to repressive regimes [38028]. - Gamma International, another security firm, had suffered a similar hack in 2014, revealing information about its clients, capabilities, and pricing [38028]. - The hacker behind the Gamma International hack claimed responsibility for the Hacking Team leak as well [38028].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the articles [9606, 9617, 9632]. These articles discuss how hackers were able to obtain source code for Symantec's flagship products, including Norton Antivirus, due to security breaches that occurred in the past. The incidents highlight a failure in the design of the system's security measures, allowing unauthorized access to sensitive source code. (b) The software failure incident related to the operation phase is evident in articles [38028]. The article reports on how the cybersecurity firm Hacking Team was hacked, leading to the exposure of sensitive documents and information about the company's operations, including selling software to repressive regimes. This failure in the operation phase resulted from the misuse of the company's systems and services, ultimately leading to a significant security breach.
Boundary (Internal/External) within_system (a) within_system: - The software failure incident related to the theft of Symantec's source code for some of its flagship products, including Norton Antivirus, was due to contributing factors that originated from within the system. Symantec confirmed that hackers had infiltrated its own networks in 2006, leading to the theft of source code [9617]. - Symantec acknowledged that segments of source code for its enterprise security products were accessed by hackers, which could potentially allow hackers to devise ways to circumvent the security software [9632].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - Article 9617 reports a security breach in 2006 that led to the theft of source code for Symantec's flagship products, including Norton Antivirus, attributing the incident to hackers infiltrating Symantec's own networks [9617]. - Article 9632 confirms that hackers obtained source code to Symantec's enterprise security products in 2006, indicating that Symantec's network was not breached but rather that of a third party entity [9632]. (b) The software failure incident occurring due to human actions: - Article 9606 mentions a lawsuit filed against Symantec in the U.S., accusing the company of encouraging customers to buy their product with scare tactics by issuing misleading information about the health of their computers [9606]. - Article 38028 discusses how the cybersecurity firm Hacking Team was hacked, revealing documents suggesting the company sold software to repressive regimes, potentially bypassing export controls and working with governments criticized for aggressive surveillance of citizens, activists, and journalists [38028].
Dimension (Hardware/Software) software (a) The articles do not provide information about a software failure incident occurring due to contributing factors originating in hardware. (b) The software failure incidents reported in the articles are primarily related to software issues. These incidents include the theft of source code for Symantec's flagship products like Norton Antivirus, Norton Internet Security, and PCAnywhere [9617], [9632]. The theft of source code led to concerns about potential vulnerabilities in the software that could be exploited by hackers [9632]. Additionally, the articles mention how the cybersecurity firm Hacking Team was the victim of a hack, with documents revealing the sale of software to repressive regimes being posted online [38028]. These incidents highlight failures in software security and integrity.
Objective (Malicious/Non-malicious) malicious (a) The objective of the software failure incident was malicious: 1. Article 9606 reports that a computer hacker named 'Yama Tough' threatened to release the full source code for Symantec Corp's flagship Norton AntiVirus software, indicating a malicious intent to harm the system by exposing sensitive information. 2. Article 9617 reveals that hackers infiltrated Symantec's networks in 2006 and stole source code for several of its flagship products, including Norton Antivirus, indicating a deliberate act to compromise the security of the software. 3. Article 9632 discusses how hackers obtained source code to Symantec's enterprise security products in 2006 and released portions of it online, potentially allowing competitors to exploit vulnerabilities in the software, demonstrating a malicious intent to undermine Symantec's security measures. (b) The objective of the software failure incident was non-malicious: Unknown
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) poor_decisions: - Article 9606 reports on a lawsuit filed against Symantec accusing them of encouraging customers to buy their product with scare tactics, issuing misleading information about the health of their computers to persuade them into buying the software. - Article 9617 mentions that Symantec initially blamed a 2006 security breach on a third party but later acknowledged that hackers had infiltrated their own networks, indicating a poor decision in initially attributing the theft of source code to an external party. - Article 38028 highlights how Hacking Team, a cybersecurity firm, was hacked, revealing documents that suggest they may have been selling software to repressive regimes despite denying such actions publicly, indicating poor decisions in their business practices. (b) accidental_decisions: - Article 9632 mentions that Symantec confirmed hackers obtained source code to two of its enterprise security products, and the theft was attributed to a third party entity, suggesting an accidental decision in allowing a third party to be compromised, leading to the theft of the source code.
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident occurring due to development_incompetence: - Article 9617 reports that Symantec initially blamed a 2006 security breach on a third party but later acknowledged that hackers had infiltrated its own networks, leading to the theft of source code for some of its flagship products. This incident highlights a failure in security measures and professional competence in safeguarding sensitive source code [9617]. (b) The software failure incident occurring due to accidental factors: - Article 9632 mentions that Symantec confirmed hackers obtained source code to two of its enterprise security products and released portions of it online. The breach was attributed to a third party entity, indicating an accidental exposure of the source code due to vulnerabilities in the third party's network [9632].
Duration permanent (a) The software failure incident in the articles can be categorized as permanent. The source code theft incidents involving Symantec's products, such as Norton AntiVirus, Norton Internet Security, and PCAnywhere, occurred in the past (2006) and the stolen source code was released to the public [9617]. Additionally, the incident involving Hacking Team also resulted in the leak of sensitive documents and information about the company's activities, clients, and services [38028]. These incidents have long-lasting consequences and implications for the affected companies and their customers, making them permanent failures.
Behaviour crash, omission, other (a) crash: - Article 9617 reports a security breach at Symantec in 2006 that led to the theft of source code for some of its flagship products, including Norton Antivirus. This incident can be considered a crash as the system lost its source code, impacting its ability to perform its intended functions [9617]. (b) omission: - Article 9632 mentions that hackers obtained source code to two of Symantec's enterprise security products and released portions of it online. This can be seen as an omission failure where the system omitted to protect its source code, allowing hackers to access and potentially exploit it [9632]. (c) timing: - There is no specific information in the articles that directly relates to a timing failure where the system performs its intended functions but at the wrong time. (d) value: - The incidents reported in the articles do not directly indicate a value failure where the system performs its intended functions incorrectly. (e) byzantine: - The behavior of the software failure incidents reported in the articles does not align with a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. (f) other: - The software failure incidents reported in the articles involve security breaches, theft of source code, and potential risks to users' data. These incidents could also be categorized as a security vulnerability or breach, where the system fails to protect sensitive information adequately, leading to potential risks and unauthorized access [9606, 9617, 9632, 38028].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence, other (a) unknown (b) unknown (c) unknown (d) [9617] Symantec acknowledged a security breach in 2006 that led to the theft of source code for some of its flagship products, including Norton Antivirus. This incident impacted people's data security and privacy as their material goods and data were compromised. (e) unknown (f) unknown (g) [9617] Symantec mentioned that due to the age of the exposed source code, most customers were not in any increased danger of cyberattacks. This implies that there were no significant observed consequences of the software failure on users. (h) unknown (i) [38028] The hacking incident involving Hacking Team revealed that the company had been working with repressive governments and selling surveillance technology to them. This could have led to consequences such as human rights violations, surveillance of citizens, activists, and journalists, and potentially endangering individuals targeted by these regimes.
Domain information (a) The failed system was related to the information industry, specifically cybersecurity. The incidents involved breaches and theft of source code from security software companies like Symantec and Hacking Team, impacting their ability to protect information and systems from cyber threats [9606, 9617, 9632, 38028].

Sources

Back to List