Symantec reveals source code extortion attempt

Symantec has revealed how it kept a hacker that compromised its source code in constant communication over three weeks while it attempted to glean enough information for law enforcement officers to pursue him.

A hacker operating under the handle YamaTough demanded $US50,000 ($A46,683) from Symantec to destroy stolen Symantec source code and make a public statement denying that he/she stole the data.

A string of emails posted to pastebin by the hacker revealed the exchange between a purported Symantec employee and YamaTough.

Symantec’s US headquarters said the exchange was part of a coordinated investigation with law enforcement to catch the extortionist.

The Gmail address used to contact the hacker was established and run by law enforcement authorities, Symantec said.

“Anonymous actually reached out to us, first, saying that if we provided them with money, they would not post any more source code. At that point, given that it was a clear cut case of extortion, we contacted law enforcement and turned the investigation over to them.

"All subsequent communications were actually between Anonymous and law enforcement agents – not Symantec. This was all part of their investigative techniques for these types of incidents.”

Symantec said it could not comment further because the police investigation was ongoing.

In the leaked email conversation, Symantec appeared to offer to wire the hacker $US1000 ($A933) as “a sign of good faith”, and pay the remaining $US50,000 in $US2500 ($A2333) instalments.

The purported Symantec employee told YamaTough the company could not wire the entire amount at once and promised to pay in installments so the hacker wouldn't publish the source code after being paid.

The hacker was promised that Symantec was “not in contact with the FBI” and that for the company, “protecting our company and property are our top priorities”.

“We can't pay you $50,000 at once for the reasons we discussed previously. We can pay you $2,500 per month for the first three months.

"In exchange, you will make a public statement on behalf of your group that you lied about the hack (as you previously stated). Once that's done, we will pay the rest of the $50,000 to your account and you can take it all out at once. That should solve your problem.

"Obviously you still have our code so if we don't follow through you still have the upper hand. “

The hacker claimed to have stolen the source code from Indian Government agencies in order to undermine the state.

Copyright © SC Magazine, Australia