Hacker releases Symantec source code
(Reuters) - A hacker released the source code for antivirus firm Symantec's pcAnywhere utility on Tuesday, raising fears that others could find security holes in the product and attempt takeovers of customer computers.
Context & Ripple Effects
The release follows a January arc: a hacker first threatened to publish full Norton Antivirus code (the release threat), and Symantec then confirmed the material traced back to a 2006 breach it says it did not detect at the time (Symantec's 2006-breach disclosure). Tuesday's publication makes good on that threat with pcAnywhere, a remote-access utility whose exposure matters more than antivirus code because it sits on customer machines with privileged access.
The story travelled unusually wide on day one — Reuters pickups at The Verge, VentureBeat, Gawker, Slashdot and four other outlets — reflecting how directly it touches enterprises that rely on pcAnywhere for remote administration.
First-order effects
- Organizations running pcAnywhere face immediate takeover risk if attackers audit the published code for exploitable holes, since the utility holds privileged access to customer computers.
- Symantec must now audit six-year-old code it did not know was stolen, patch whatever the leak exposes, and advise customers while the source circulates publicly.
Second-order effects
- Enterprise buyers of remote-administration tools will pressure vendors to disclose whether their own source has been compromised, turning breach-disclosure candor into a competitive differentiator among security firms.
- Rival security vendors gain a marketing opening against Symantec's flagship trust position, since a company selling protection admitting undetected 2006 theft undercuts its core pitch.
Third-order effects
- If stolen-source leaks keep surfacing years after the original breach, source code becomes a long-tail attack asset — forcing the industry toward assuming code secrecy is temporary and designing products to survive public disclosure.
- The pattern pushes regulators and enterprise procurement toward stricter vendor-breach notification requirements, since Symantec's own account shows a theft can go unnoticed inside the victim company for years.
The trend: Security vendors are learning that source code, once stolen, stays weaponizable indefinitely — shifting the industry from secrecy-based defense toward disclosure-resilient engineering.