Symantec admits source code published by Anonymous is genuine

Code for security products posted on Pirate Bay

Symantec is in an ongoing fight against hackers in the group Anonymous that last January attempted to extort a payment of around $50,000 (£30,000) from Symantec in exchange for not publicly posting stolen Symantec source code they had stolen for various older Symantec security products dating to 2006.

Late yesterday, hackers did release the source code for an older version of Symantec's pcAnywhere and Norton Internet Security by uploading it to The Pirate Bay. Symantec confirms this is legitimate Symantec source code, and Symantec spokesman Chris Paden says the concern now is that other code that Anonymous claims to have in its possession will soon be posted as well.

"Be advised, we also anticipate Anonymous to post the rest of the code they have claimed to have in their possession. So far, they have posted code for the 2006 version of Norton Internet Security and pcAnywhere. We anticipate that at some point, they will post the code for Norton Antivirus Corporate Edition and Norton Systemworks. Both products no longer exist."

Symantec says it foresees no immediate security issues if this source code is posted, since neither is supported any longer.

Symantec says it has been in contact with law enforcement since it received the extortion attempt. Some of what appears to be a sting operation was evident in an email string posted online by a person named Yamatough, a name similar to the an Indian hacker who is associated with the Lords of Dharmaraja group that earlier claimed to have source code to some Symantec products.

Email purporting to come from "Sam Thomas," appearing to be a Symantec employee but using a Gmail address, offered to pay $50,000 but wanted assurances that the hacker wouldn't release the source code after payment. "Sam Thomas" offered to pay $2,500 a month for the first three months, with payments starting next week.

Yamatough apparently rejected that offer stating, "our offshore people won't let us securely get the money because they won't process amounts less than 50K a shot". He gave "Sam Thomas" 10 minutes to decide whether to pay, and "Sam Thomas" relayed he needed more time. After that, the source code to the older versions of pcAnywhere and Norton Antivirus was publicly posted.

Symantec's Chris Paden says the email string posted by Anonymous was actually between them and a fake email address set up by law enforcement. Symantec says after it got the extortion attempt in January, it contacted law enforcement and turned the investigation over to them. So any email communications seen in the drama unfolding have actually been between Anonymous and law enforcement agents, not Symantec. "This was all part of their investigative techniques for these type of incidents," Paden says.

The threat from Anonymous to post the pcAnywhere source code has had Symantec in high gear the last few weeks, releasing patches since January 23 "to protect users against attacks that might transpire as a result of the code being made public," the security firm says.

"We have been conducting direct outreach to our customers since January 23rd to reiterate that, in addition to applying all relevant patches that have been released, we've also counseled customers to ensure that pcAnywhere version 12.5 is installed, and to follow general security practices."

Symantec says it has not yet determined how the hackers exactly obtained the cache of older source code they now have.

"It is part of an original cache of code for 2006 versions of the products," Paden states. "We still have not determined how Anonymous came into possession of the 2006 source code." He adds the investigation by both Symantec and its partners in the law enforcement community (which it declines to name) is still ongoing.

By Ellen Messmer | Network World US

Java beats C in Tiobe index of language popularity

Java has been buoyed by Android's success, but C continues to close the popularity gap.

Java is hanging on to its ranking as the most popular programming language, but only by a thin margin. It edged out C in this month's Tiobe index of programming language popularity.

Released at the weekend, the February Tiobe Community Programming Index had Java being used by 17.05% of developers.

A year ago, 18.48% of developers used it, while 17.48% of developers used Java a month ago. C was slotted right behind Java, used by 16.52% of developers in the latest release of the index - up from 14.98% the same time last year, but down from the 16.98% using it in last month's index.

"Java has a chance to remain number one now that Android is the most frequently used mobile platform," said Paul Jansen, Tiobe's managing director. "On the other hand, lots of small devices (and there appear to be more and more of these in this world) are still being programmed in C. I expect that Java will remain number 1 for at least the next six months."

Ranking behind Java and C were: C#, used by 8.65%; C++, at 7.85%; Objective-C, at 7.06%; and PHP, used by 5.64%. But Objective-C, which is gaining popularity because of its association with Apple iOS application development, and PHP, for server-side web development, are going in opposite directions.

While Objective-C gained nearly 4.5% in a year, having been used by just 2.57% of developers a year ago, PHP saw its usage drop from 6.97% during the same time last year to 5.64% in the latest survey.

Tiobe pointed out that Visual Basic.Net, the follow-up to Microsoft's legacy Visual Basic language, is gaining in popularity as Visual Basic loses steam. Visual Basic was used by 4.32% of developers, down from nearly 5% that used it a year ago, while VB.Net increased from 0.59% a year ago to nearly 0.80%.

But Visual Basic is the seventh-ranked language, while VB.Net is ranked 16th. It had been ranked 22nd a year ago, though. "It might be a coincidence, but while classic (Visual) Basic is slowly going off radar, VB.Net is still gaining in popularity each month. VB.Net now enters the top 20," Tiobe said.

Jansen, however, said he did not think there was a correlation between the decline of Visual Basic and the rise of VB.Net. "Visual Basic has no major vendor (except for a couple of smaller companies) anymore, so it will slowly die. VB.Net is not really promoted by Microsoft; it is way behind C# and C++. Even F# sometimes gets more attention of Microsoft than VB.Net. So I don't expect VB.Net to rise any further."

Tiobe rankings are based on the number of skilled engineers worldwide and third-party vendors using a particular language, with rankings determined by assessments of search engine results in Google, Bing, and Yahoo along with other sites, including Wikipedia, Amazon, YouTube, and Baidu. The index, Tiobe said, is not about the number of lines of code written or about the best programming languages.

By Paul Krill | InfoWorld

DNSChanger has infected half of Fortune 500 firms

Machines will be cut off from the web next month, say experts

Half of all Fortune 500 companies and major US government agencies own computers infected with the "DNSChanger" malware that redirects users to fake websites and puts organisations at risk of information theft, a security company warned yesterday.

DNSChanger, which at its peak was installed on more than four million Windows PCs and Macs worldwide - a quarter of them in the US alone - was the target of a major takedown organised by the US Department of Justice last November.

The takedown and accompanying arrests of six Estonian men, dubbed "Operation Ghost Click," was the culmination of a two-year investigation, although some security researchers have been tracking the botnet since 2006. As part of the operation, the FBI seized control of more than 100 command-and-control (C&C) servers hosted at US data centres.

According to Tacoma, a Washington-based Internet Identity (IID, which provides security services to enterprises, half of the firms in the Fortune 500, and a similar percentage of major US government agencies, harbour one or more computers infected with DNSChanger.

IID used telemetry from its monitoring of client networks, as well as third-party data, to claim that at least 250 of the Fortune 500 companies and 27 out of 55 major government agencies had at least one computer or router infected with DNSChanger as of early this year.

The still-infected machines pose several problems, said experts.

"Initially, DNSChanger was worrisome because it could redirect you from a safe location to a dangerous one controlled by criminals," said Rod Rasmussen, the chief technology officer of IID. "However, the FBI temporarily fixed that. Now, the big worry is that machines that are still infected face a second vulnerability - they are left with little if any security."

That's because DNSChanger also blocks software updates - the patches vendors like Microsoft issue to fix flaws - and disables installed security software.

Others, however, have pointed out that computers still infected with DNSChanger have only weeks before they will be crippled.

As part of Operation Ghost Click, a federal judge approved a plan where clean DNS servers were deployed by the Internet Systems Consortium (ISC), the non-profit group that maintains the popular BIND DNS open source software. Without that move, infected systems would have been immediately cut off from the internet when the FBI seized the criminals' domain servers.

But the ISC was authorised to maintain the alternate DNS servers only for 120 days, or until early next month.

"The ISC will shut down the DNS servers in March and anybody who is still using those servers will then lose access to the Internet," said Wolfgang Kandek, chief technology officer of Qualys.

Qualys has added DNSChanger detection to its free BrowserCheck tool that runs on Windows PCs, while the umbrella organization DNSChanger Working Group - of which IID is a member - has created a website that steps users through the process of detecting and infected PCs and Macs.

By Gregg Keizer | Computerworld US

Facebook hackers use fake attack on Iran to spread malware

Mailicious news links spreading through social network

A "worrying number" of Facebook users are sharing a link to a malware-laden fake CNN news page reporting the US has attacked Iran and Saudi Arabia, security firm Sophos claims.

If users who follow the link then click to play what purports to be video coverage of the attack, they are prompted to update their Adobe Flash player with a popup window that looks very much like the real thing. Those who accept the prompt unwittingly install malware on their computers.

Within three hours of the scam's appearance, more than 60,000 users had followed a link to the spoofed CNN page, according to Sophos Senior Security Advisor Chester Wisniewski. Facebook removed that link, but others are still being shared.

"The bad guys are rotating through scam pages trying to stay ahead of Facebook," Wisniewski said.

In a statement, Facebook said it was "in the process of cleaning up this spam now, and remediating any affected users."

Wisniewski said there are a number of ways that status updates could appear without users' knowledge. Their Facebook accounts could have been hacked, allowing a third party to update their status. It is also possible for scammers to exploit weaknesses in the social networking platform itself or in web browsers to post a status update using JavaScript.

A representative status update shown in a screenshot on the Sophos blog reads, "US Attacks Iran and Saudia Arabia. F**k :-( [LINK] The Begin of World War 3?"

Users who accepted the Flash player update prompt installed a fake antivirus tool on their computers. That tool would then alert them that their computer is infected with malware that can be eliminated for a fee. Such scams are one of the most lucrative, Wisniewski said, noting the irony that they net far more money than the legitimate security products Sophos and other security companies peddle.

In addition to exercising a healthy dose of skepticism that the US would attack its ally Saudi Arabia, Facebook users can avoid the scam and others like it by updating Flash only from Adobe's own website rather than from popups.

By Cameron Scott 

Using wget to mirror a FTP site

Heres another article on wget. wget is a non-interactive network downloader. It can also be used to completely mirror a ftp site.

wget -m --user=ftpuser --password='mypass' ftp://ftp.mysite.com/ 

-m or --mirror turns on options suitable for mirroring. This option turns on recursion (-r) and time-stamping (-N), sets infinite recursion depth and also keeps FTP directory listings (--no-remove-listing). It will create a structure of directories beginning with the site name like ftp.mysite.com. To disable generation of this host-prefixed directories use the option -nH or --no-host-directories

wget -nH -m --user=ftpuser --password='mypass' ftp://ftp.mysite.com/