Symantec's Norton AntiVirus source code exposed by hackers.

Symantec, the makers of Norton AntiVirus, has confirmed that a hacking group has gained access to some of the security product's source code.

An Indian hacking group, calling itself the Lords of Dharmaraja, has threatened to publicly disclose the source code on the internet.

So far, there have been two claims related to Symantec's source code.

First, a document claiming to be confidential information related to Norton AntiVirus's source code was posted on Pastebin. Symantec says it has investigated the claim, and that - rather than source code - it was documentation dated from April 1999 related to an API (application programming interface) used by the product.

And secondly, the hacking group shared source code related to what appears to have been the 2006 version of Symantec's Norton AntiVirus product with journalists from Infosec Island.

A hacker called "Yama Tough", who appears to be acting as a spokesperson for the gang, posted the content to PasteBin.

The content on PasteBin has since been removed, and Yama Tough's Google+ posts deleted. The hackers claim that it is working on creating mirror sites for its content, as it has felt pressured and censored by US and Indian government agencies.

It's important to underline that there is presently no reason to believe that Symantec's own servers have been breached.

Instead, it appears that the data leak may have occurred on Indian government servers - and the implication is that Symantec, and perhaps other software companies, may have been required to supply their source code to the Indian authorities.

Furthermore, it is not clear if the source code which was accessed is relevant to up-to-date installations of Symantec's anti-virus products and thus customers may not be at risk.

Even if it was up-to-date source code, it may be of limited use to hackers and be used more as a "trophy scalp" for a hacking group intending to generate publicity for its grievances with the Indian authorities.

It's hard not to feel sympathy for Symantec - who appear to have been caught in the crossfire between a hacking gang and the Indian authorities.

Although Symantec customers may not be at risk, it's easy to see how the software company will feel bruised by the publicity that the Lords of Dharmaraja have generated through their hack.

Read More

Who Was the First Hacker?

New Scientist has recently revealed the name of the world's first hacker, who managed to discover a security hole in Marconi's wireless telegraph and managed to show the inventor up.

It turned out that a stage magician named Nevil Maskelyn wrecked a public demo of Marconi's wireless telegraph over a century ago, in 1903, – he sent insults in Morse code down the wire. The crowd was really amused when the physicist John Ambrose Fleming has been adjusting arcane apparatus while preparing to show the long-range wireless communication system created by his boss, the Italian radio pioneer Guglielmo Marconi, who was several hundreds miles away trying to send the message.

However, before the show could start, the apparatus in the lecture theater started to tap out a message – it appeared to be a poem accusing Marconi of "diddling the public". Fleming's assistant found out that beaming powerful wireless pulses into the theater were strong enough to be able to interfere with the electric arc discharge lamp of the projector. The apparatus began spelling "Rats" repeatedly and after this ripped into the poem.

That’s how Maskelyn proved that Marconi's item was insecure, and the others could easily eavesdrop on private messages as well. Meanwhile, Fleming fired off a missive to the Times, calling the hack “scientific hooliganism” and asking the readers to help him find the hacker. Nevertheless, Maskelyn, whose family earned money by making "spend-a-penny" locks in pay toilets, outed himself 4 days later. He tried to justify his actions by the security holes it discovered for the public good. He used Morse code in his mind-reading tricks and managed to send wireless messages between a ground station and a balloon located 10 miles away. Nevertherless, Maskelyn was stuffed up by the fact that Marconi had patents on his technology but failed to develop it.

It later appeared that he was hired as a spy for the Eastern Telegraph Company that was worried that Marconi could stuff up its business.

The first hacker built a 50-metre radio mast somewhere on the cliffs in order to find out if he could eavesdrop on messages beamed by Marconi Company to vessels. As a result, Maskelyn pointed out that Marconi’s security was a doddle to hack. Although Maskelyne's name had been forgotten, he is now again in the history books as the world's first hacker.

Read More

How to Combine Rescue Disks to Create the Ultimate Windows Repair Disk.

To create the rescue disk, you’re going to want a USB flash drive with a decent amount of space—for our purposes, 2 GB is the minimum size, but you’d be better off with something a little bigger if you want to put a lot of repair disks on it, especially the larger ones.


Once you’ve picked out your drive, the first thing you’ll need to do? Format your drive as FAT32. That’s right, the software we’re going to use requires the FAT32 file system, so right-click on the drive and select Format from the menu.


Choose FAT32 from the drop-down menu under File system, and then click Format.


To create the custom drive, we’ll use a small piece of software called SARDU, which combines a bunch of functionality into a single package—you can use it to download the ISO images, write everything to the USB drive, or create an ISO image that you could burn to an optical disc—though obviously you’re space-limited in that case.

Once you download and extract SARDU, you can simply start clicking on any of the buttons to trigger a download of that rescue disk.

There’s a whole bunch of utilities included, including really useful ones like Gparted and the System Rescue CD, Ophcrack, and others.

And you can use it to directly download Ubuntu as well.

Or you can download the ISO images separately and put them into the ISO folder (you’ll have to restart the application once you’re done).

All done? click the Make a USB button over on the right-hand side…

And everything will be created and copied to the drive.

Just plug the disk into an available port, and choose the option to boot from USB—you may have to take a trip into the BIOS settings to enable booting from removable drives, or you might have to hit a key during bootup to display the boot options menu, where you can choose the device to boot from.

Once you do successfully boot from the flash drive, you’ll see a menu like this:

Select any of the categories, and you’ll see all the rescue disks or other disks that you’ve put on your drive:

Just like that, you’re booting your rescue disk.
Enjoy your awesome rescue disk.

Read More

Facebook hands out White Hat debit cards to hackers.

This is the Visa debit card Facebook is giving to some security researchers for reporting bugs.

A few companies pay money to bug hunters. But Facebook is giving out something more unique than just a check. Some security researchers are getting a customized "White Hat Bug Bounty Program" Visa debit card.
The researchers, who can make thousands of dollars for reporting just one security hole on the social-networking site, can use the card to make purchases, just like a credit card, or create a PIN and take money out of an ATM. As the researchers find more bugs, Facebook can add more money to the account.

Facebook wanted to do something special for the people who are helping the company shore up its software and keep hackers and malware out.
"Researchers who find bugs and security improvements are rare, and we value them and have to find ways to reward them," Ryan McGeehan, manager of Facebook's security response team, told CNET in a recent interview. "Having this exclusive black card is another way to recognize them. They can show up at a conference and show this card and say 'I did special work for Facebook.'"

Besides holding cash value, the White Hat card may proffer other advantages. "We might make it a pass to get into a party," for instance, McGeehan said. "We're trying to be creative."
Facebook launched its bug bounty program in July, following in the steps of Mozilla and Google. The minimum a researcher can make for reporting a bug that is eventually confirmed is $500, and there is no maximum. Researchers have to follow Facebook's Responsible Disclosure Policy and not go public with the vulnerability information until the hole has been fixed.


The most Facebook has paid out for one bug report is $5,000, and it has done that several times, according to McGeehan. Payments have been made to 81 researchers, he said.
Recently, "someone came to us with a bounty-worthy ticket and they said they didn't want the bounty," he said. Instead, the researcher wanted the money--$2,500--to go to a charity and for Facebook to match it. Facebook agreed, McGeehan said.

Brian Krebs, who first wrote about the White Hat Visa, reports that recipients have included Szymon Gruszecki of Poland and Neal Poole, a junior at Brown University who will be an intern at Facebook next summer. 

And Charlie Miller, a researcher at Accuvant better known for finding holes in iOS 5 and Safari than Facebook, also has received a White Hat card. "Facebook whitehat card not as prestigious as the SVC card, but very cool ;) Fun way to implement no more free bugs," he tweeted.
Facebook has plans to leverage the knowledge and skills of the researchers beyond just providing the bug 
 bounty incentive.

"Whenever possible we're going to try to load-in White Hat researchers into products early--as soon as (they are) in production," McGeehan said. Thus Facebook "will get an early warning on anything they find."

Read More