On the face of it, it would make you think “What kind of Security Software is this?” when actually it wasn’t Norton’s fault at all. That’s when this one starts to unravel like a John le Carré spy novel.
The code (or part of it) was stolen from a “third party”. The Indian Army. I guess they really do need some beefing up of their security, by a group called (insert dramatic name here) “Lords of Dharmaraja”. The good news? This doesn’t affect Norton customers’ financial info on their website (whose software do they use?). The code that was stolen was four years old (with updates) and was its “Symantec Endpoint Protection” (which protects leakage of data being sent from place to place). Great. I’m relieved.
Now, it turns out that other countries and armies routinely get to look at the code in security software as well as Russia getting to inspect the source code of Windows, and this has been going on since 2003. Why? To verify no “backdoor” nor “spyware” being present. A reasonable concern.
That made me wonder about maybe code being stolen from these prospective customers (or maybe sold?) and that being maybe being part of the wave of malware, and how the criminals analyzed where to attack Windows and other software.
The graph below comes from academic research http://pages.cs.wisc.edu/~pb/comsnets09.pdf and shows two peaks. The one in 1996 is coincidental with MS Word’s advent and shows the app related malware written in MS Word which became available in that year.
The second exponential “takeoff” starts in 2003. The graph shows the timeline of the five largest malware families.
Kaspersky confirms 2003 as a watershed in that:
“A professional malware market started to emerge at the very end of 2003, gained ground during 2004, and was well established by the beginning of 2005. Therefore, 2004 could be called the year in which the Internet became comprehensively criminal. Data based on Kaspersky Virus Lab statistics clearly demonstrates this trend.” - http://www.securelist.com/en/analysis?pubid=167798878
I’m not saying that Russia is guilty for the malware of all sorts which has made life so profitable for the deviants out there. It would not be justified to do so based on the few things I went looking for.
I am saying that Microsoft, Apple and other software’s vulnerabilities might well be coming from their efforts to sell it, and popularize it. They need to verify the security around their software and to maintain it. Windows 8 will be more secure than Windows 7.
Client security leaks, and greed might be possible motives, but no big conspiracy theory here, folks. Don’t start sending tin foil hats. I just got curious, and I’m not saying I’m right. I’m probably wrong.
Sources:
http://www.reuters.com/article/2012/01/06/us-symantec-code-idUSTRE80523W20120106?feedType=RSS&feedName=internetNews&rpc=76
http://pages.cs.wisc.edu/~pb/comsnets09.pdf
http://www.securelist.com/en/analysis?pubid=167798878
and several more read, but not used.