In a PDF outlining the impact of its proprietary source code being stolen, Symantec recommends disabling pcAnywhere until the next update is issued. This warning includes users who are running pcAnywhere 12.0, 12.1 and 12.5, which is the latest version. Aside from being a stand-alone product, the software also comes bundled with Altiris so companies may be particularly at risk.
pcAnywhere, a software designed to give users access to remote computers, is a particularly sensitive piece of software to have fully exposed. Developers often rely on "security through obscurity", but releasing a commercial product's proprietary source code into the wild defeats the effectiveness of this strategy.
Symantec has given mixed statements regarding the incident, but the company most recently told Reuters that the leaked source code was stolen during a prior security breach of Symantec's own servers in 2006. This is in contrast to a claim by hackers earlier this month that they had managed to pilfer the company's source code during a supposed intrusion of India's military network.
If what Symantec says is true, this raises the disturbing possibility that pcAnywhere has been quietly compromised for nearly six years. The 2006 security breach was thought to have been performed by members of Anonymous.
Subsequent to claims of infiltrating India's military, supposed internal intelligence memos were leaked – documents which implied the Indian government was engaging in espionage against the U.S. and China. India stated the documents were fabricated, but that did not stop the U.S. from launching an investigation into the matter.
The investigatory probe has since suggested Chinese hackers were responsible for the attacks, not Indian hackers. The real target of the attacks was the National Foreign Trade Council, a U.S.-based, non-governmental organization that supports free trade and commerce.