Network breach led to Norton code theft

Security giant Symantec pointed to a network breach in 2006 that eventually led to the source code for its Norton antivirus software to be stolen last week, reversing its earlier statement that the code was stolen from a third party, Reuters reported.

In a report on Tuesday, the company corrected its statement regarding the source code theft of its flagship Norton software after an investigation found that its own networks had been infiltrated. "Upon investigation of the claims made by Anonymous regarding source code disclosure, Symantec believes that the disclosure was the result of a theft of source code that occurred in 2006," the statement said.

The unknown hackers had obtained the blueprint for software such as Norton Antivirus Corporate Edition, Norton Internet Secutiry, Norton Utilities, Norton GoBack and pcAnywhere, during the attack earlier this month, added Symantec spokesperson Chris Paden in the Reuters article. 

"We really had to dig way back to find out that this was actually part of a source code theft," he said. "We are still investigating exactly how it was stolen."

Customers should pay attention
The hackers had also released the code to a 2006 version of Norton Utilities, and said they plan to do the same for the code to Symantec's antivirus software on Tuesday.

However, Paden said the 2006 network breach presented no threat to customers using the most recent versions of Symantec's software as these are "protected against any type of cyberattacks that might materialize as a result of this code".

He did point out that customers of pcAnywhere, a program which facilitates remote access of PCS, may face "a slightly increased risk" due to the code exposure. Symantec is reaching out to these customers to make them aware of the situation and provide remediation steps to help protect their devices and information, the spokesperson noted.

Laura DiDio, an analyst at Information Technology Intelligence Consulting (ITIC), did not share the same confidence as Paden, though. She told Reuters that Symantec's customers should be concerned about the possibilty that hackers can use the code to figure out how to defeat the antivirus software.

"What we're seeing from Symantec is 'let's put the best public face on this'," she stated. "Unless Symantec wrote all new code from scratch, there are going to be elements of source code in there that are still relevant today."