Symantec Drops the Ball on pcAnywhere Attack

I just barely passed calculus in college, but my addition and subtraction skills are pretty good. And when you subtract 2006 from 2012 you get six. Six years that is; and that’s how long it took Symantec to warn users that they were at risk because the code of a number of security products — including pcAnywhere, which it has advised customers not to use —  was stolen back in ’06.

I’m certainly not saying anyone is lying when the company says it didn’t know about the breach. But I am saying that the company’s confused and confusing response to a serious threat makes me and lots of users queasy. After all, if you can’t trust one of the oldest and best-known brands in the security business, who can you trust?

In case you missed some of the story, here’s a brief recap: Symantec says it recently discovered that source code to a number of its products were stolen in 2006. The statement was apparently prompted by threats from a gang of hackers to publish the code and give it to other hacking groups, including Anonymous, which has participated in a number of politically motivated attacks.

I don’t like to parse language, but Symantec’s statements over the last week are full of ambiguities and contradictory advice. When I spoke with a Symantec spokeswoman today, she repeated the claim that Symantec did not know of the 2006 breach until very recently. But in a posting on January 24, Symantec said this: “Since 2006, Symantec has instituted a number of policies and procedures to prevent a similar incident from occurring.”

If the company didn’t know about the breach, why would it make changes directed at plugging the leak? Maybe it meant that in general Symantec has tightened up its internal security. If that were the only squishy statement, I wouldn’t feel so wary. But there are more.

In the same posting it says: “Our current analysis shows that all pcAnywhere 12.0, 12.1 and 12.5 customers are at increased risk, as well as customers using prior versions of the product.” That’s pretty clear. But in the same paragraph it says: “Symantec also recommends that customers only use pcAnywhere for business critical purposes.”

Excuse me? My company is at risk if I use this, so I should only use it for important stuff? That makes no sense at all.

In early January, Symantec spokesman Cris Paden said that the hacker made off with source code of Symantec Endpoint Protection 11.0 and Symantec Antivirus 10.2, enterprise products between five and six years old.  At the time, Paden downplayed the seriousness of the theft. He said users of pcAnywhere might face “a slightly increased security risk” as a result of the exposure. Hmm, slight increase. What does that mean? I don’t use the product, but I suspect that I wouldn’t have worried much. But I sure would now.

Two weeks later, Paden said that source code of Norton Antivirus Corporate Edition, Norton Internet Security, Norton Utilities, Norton GoBack and pcAnywhere, had been stolen. And yesterday (Jan. 25) it warned customers not to use pcAnywhere.

The company also reiterated its previous guidance that users of its other software titles are not at heightened risk because of the breach in 2006. “The code that has been exposed is so old that current out-of-the-box security settings will suffice against any possible threats that might materialize as a result of this incident,” it said on its website.

OK, that makes sense. But if Symantec’s warning about the level of threat to pcAnywhere users could escalate so quickly, how do we know that the company won’t suddenly decide that users of other products are now at serious risk.

I don’t like this a bit. And I think that Symantec, a company that has millions of users who depend on it and trust it, should learn some serious lessons about how to handle a crisis.

As a service, I’m going to reprint part of an email I got from the company with some specific tips on how to handle this issue.

What we’re actually asking customers to do is, first, upgrade to pcAnywhere 12.5 and make sure all available patches are installed. Symantec released a new patch on Monday, January 23, and will continue to release updates to the product that are important to apply immediately. Second, it’s important that customers run pcAnywhere on a secure, and protected network (ie. behind the company firewall or via a virtual private network).

Lastly, customers should make sure that all of the machines that they’re communicating with via pcAnywhere have endpoint protection; in other words, each machine needs to have endpoint security, malware protection, intrusion detection, data loss prevention, be password protected, etc. All of which are general security best practices.