Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Symantec Tells Customers To Stop Using pcAnywhere

timothy posted more than 2 years ago | from the but-I-gotta-use-it-somewhere dept.

Security 149

Orome1 writes "In a perhaps not wholly unexpected move, Symantec has advised the customers of its pcAnywhere remote control application to stop using it until patches for a slew of vulnerabilities are issued. If the attackers place a network sniffer on a customer's internal network and have access to the encryption details, the pcAnywhere traffic — including exchanged user login credentials — could be intercepted and decoded. If the attackers get their hands on the cryptographic key they can launch remote control sessions and, thus, access to systems and sensitive data. If the cryptographic key itself is using Active Directory credentials, they can also carry out other malicious activities on the network."

Sorry! There are no comments related to the filter you selected.

Way ahead of you, Symantec (5, Funny)

elrous0 (869638) | more than 2 years ago | (#38828147)

Most /.er's stopped using your products a long time ago.

Next up, Intel CEO admits "McAfee is just bloatware that doesn't actually do anything. To be honest, most of it just runs loops that eat up CPU, so people think it's doing something and want to buy a faster Intel CPU. It hasn't stopped an actual virus since the mid-90's."

Re:Way ahead of you, Symantec (0)

Anonymous Coward | more than 2 years ago | (#38828217)

Next up, Intel CEO admits "McAfee is just bloatware that doesn't actually do anything. To be honest, most of it just runs loops that eat up CPU, so people think it's doing something and want to buy a faster Intel CPU. It hasn't stopped an actual virus since the mid-90's."

Honestly, I wouldn't be suprised at all.

Re:Way ahead of you, Symantec (1)

postmortem (906676) | more than 2 years ago | (#38831123)

Yep, from behavior of McAfee scanning compressed files, implementation has to be something like this:
int scan_zipped_file(char * file, int file_size)
{
      int i=0;
      int j=0;
      while (j < file_size)
      {
            while (i < 0x7FFFFFFF)
            {
              i++;
            }
            j++;
      }
      return 1;
}

Re:Way ahead of you, Symantec (5, Funny)

Baloroth (2370816) | more than 2 years ago | (#38828375)

t hasn't stopped an actual virus since the mid-90's."

I wouldn't say that, it seems to do a pretty good job shutting down Windows.

Re:Way ahead of you, Symantec (1)

Anonymous Coward | more than 2 years ago | (#38829141)

You can't hack a hardlocked machine.

Re:Way ahead of you, Symantec (-1)

Anonymous Coward | more than 2 years ago | (#38828437)

yes, but having said that, most /.er's haven't stopped sucking steve jobs' rotten pecker, despite the fact that the evil fuck has been dead for several months!

Re:Way ahead of you, Symantec (0)

Anonymous Coward | more than 2 years ago | (#38831017)

Most /.er's never started that nasty habit thankfully. It's only the Apple (tm) toadies and lickspittles (r) that do that.

Re:Way ahead of you, Symantec (1)

beachcoder (2281630) | more than 2 years ago | (#38828541)

Most /.er's stopped using your products a long time ago.

Quite. We used PC Anywhere around a decade ago. 'PC Anyone' we called it. I honestly didn't think it was still an active product.

Re:Way ahead of you, Symantec (1)

Anonymous Coward | more than 2 years ago | (#38829993)

Symantec software is bloated, buggy and rapes the wallet.

There are plenty of free (or at least much cheaper) and competent alternatives out there.

Even Norton Ghost, an admirable software in its own right, has seen its quality dropped in recent years. Acronis True Image is much better.

Re:Way ahead of you, Symantec (1)

mcavic (2007672) | more than 2 years ago | (#38830359)

We have a server at our office running a PCAnywhere host, but it's on a custom port that's normally closed at the firewall.

But of course (1)

Magada (741361) | more than 2 years ago | (#38828151)

this has nothing to do with the leaked source code. Right?

Re:But of course (4, Informative)

Anonymous Coward | more than 2 years ago | (#38828277)

I'm pretty sure that they made this clear in their disclosure?

http://www.symantec.com/connect/sites/default/files/pcAnywhere%20Security%20Recommendations%20WP_01_23_Final.pdf

First two paragraphs from their Introduction:

Upon investigation of the claims made by Anonymous regarding source code disclosure, Symantec believes that the disclosure was the result of a theft of source code that occurred in 2006. We believe that source code for the 2006-era versions of the following products was exposed: Norton Antivirus Corporate Edition; Norton Internet Security; Norton SystemWorks (Norton Utilities and Norton GoBack); and pcAnywhere.

With this incident pcAnywhere customers have increased risk. Malicious users with access to the source code have an increased ability to identify vulnerabilities and build new exploits. Additionally, customers that are not following general security best practices are susceptible to man-in-the-middle attacks which can reveal authentication and session information. General security best practices include endpoint, network, remote access, and physical security, as well as configuring pcAnywhere in a way that minimizes potential risks.

Re:But of course (1)

mcgrew (92797) | more than 2 years ago | (#38830017)

If it had been open sourced the bugs would have been found and fixed years ago. How do you know some blackhat didn't find the holes without the source long before it was leaked? Security through obscurity is about as dependable as the TSA groping children in the airport is at keeping terrorists out.

Come on (5, Insightful)

jayhawk88 (160512) | more than 2 years ago | (#38828165)

If the attackers place a network sniffer on a customer's internal network...

You've got a hell of a lot bigger problems than pcAnywhere.

Finish that sentence! (0)

Anonymous Coward | more than 2 years ago | (#38828365)

... and have access to the encryption details ...

Um.. yes. Combine those two things, and you might as well consider Ethernet cables to be inherently insecure.

I don't understand the concern here at all.

Re:Finish that sentence! (5, Funny)

alittle158 (695561) | more than 2 years ago | (#38829543)

...you might as well consider Ethernet cables to be inherently insecure...

Shh...don't let the people at monster cable know that. They might find a new source of revenue in "encrypted ethernet cables"

Re:Come on (5, Insightful)

cduffy (652) | more than 2 years ago | (#38828369)

If the attackers place a network sniffer on a customer's internal network...

You've got a hell of a lot bigger problems than pcAnywhere.

Au contraire -- if your infrastructure isn't robust against this class of attack (all internal traffic authenticated and encrypted, particularly during password exchange), you're Doing It Wrong.

Moreover, the concept of "defense in depth" applies -- a hard outer shell with a soft inner core means that when the eventual successful attack does happen (and it will!), the damage is that much worse. You can't have decent security if you design all the internal components assuming that the outer layer will protect them.

Re:Come on (3, Insightful)

SpanglerIsAGod (2052716) | more than 2 years ago | (#38828599)

I find it interesting how many enterprise software companies don't understand that. When we run scans against their software and tell them we need them to fix vulnerabilities it's amazing how often they come back with, "This product is designed to be used internally." Like that matters, if your company is bigger then 10 people you shouldn't be surprised to have internal users trying to hack your system.

Re:Come on (2)

NotBorg (829820) | more than 2 years ago | (#38829497)

It's worse than that. You don't have to have a "guy on the inside" for many sites. There's this myth that if you throw up a big firewall then all the applications behind it are protected. It doesn't take a genius to see that a single compromised machine on the "secured" side of the wall (not uncommon) effectively exposes all those "protected" (internal) applications to risk. Unless you're sure you can keep all your user's workstations free from compromise (good luck with that), you should just start with the assumption that your "protected" (internal) applications are exposed.

Re:Come on (0)

Anonymous Coward | more than 2 years ago | (#38829545)

It doesn't take a genius to see that...

That's the problem. On the level of the people making those decisions, anyone who can understand that is effectively a "genius".

Re:Come on (1)

fish_in_the_c (577259) | more than 2 years ago | (#38829813)

some estimates are that more then 50% of attacks come from inside the firewall.. ( disgruntled employees , corporate espionage , or sometimes people just trying to see things they without permission ( curiosity) ). ( that was what the marketing people at the firewall company I worked for claimed).

Of coarse if you can detect such things , you can always fire those people, part of the problem is most medium and small companies don't have the money it takes to pay some one to act full time as a security officer , which is really what is needed to set up , secure, optimize a network with more then 20 machines and heterogeneous software.

Small business ( under 20 ) probably don't need it because hopefully you can trust everyone , and when you are taking out your own trash probably can't afford full time security. However most medium sized businesses take a long time to move away from that mentality.

Re:Come on (4, Insightful)

Dishevel (1105119) | more than 2 years ago | (#38828783)

On the other hand your hard inner shell can cost the company massive amounts in lost productivity. The harder the core is the more people hate to go to work.
You really need specific defenses set up. We have a mostly open wifi network connected to the internet. (Personal Devices, Visitors and the like) We also have a highly filtered connection to the internet for company systems. Servers are set on the local network behind a firewall that drops anything not expected and also drops anything that is expected if it is not coming from the place that it is expected to come from. Really critically confidential stuff is (Credit card data, personnel crap and the like are set nested behind an even more secure firewall.
You can not expect everything to be secure. You have to pick and choose your battles. Workers must have some freedoms. Most of the stuff they do should be easy. Difficulty should be reserved for where it is really needed. I hate seeing a system that has 54 character passwords that are reset every 28 days and must include lower case, uppercase, numbers and punctuation so that a call taker can log into the system to take calls. That is stupid shit.

Re:Come on (-1, Troll)

the_B0fh (208483) | more than 2 years ago | (#38829391)

This is a REALLY FUCKING STUPID ATTITUDE. Why the fuck should rlogins still be allowed when SSH is all over the place? Just because it's internal?

Re:Come on (1)

Dishevel (1105119) | more than 2 years ago | (#38829535)

The use of capitals is really nice. Not sure where I stated that I was allowing rlogin to anything on my network. But if you want to assume that I do ...
What part of my network would I be using them on? Rlogin over wifi to personal devices? Rlogin from a relatively untrusted segment of my local network to my credit card database? Rlogin over a naked connection from the internet directly to my servers? One I care not about, one are a very bad idea, and one would fit your capitals.
Am I doing any of them?
If I were to point out a really fucking stupid attitude it would be the attitude of some fucking tool that dreams of being "The BOFH".
BOFH had great reading comprehension. You ... Not so much.

Re:Come on (2)

cduffy (652) | more than 2 years ago | (#38829569)

You can not expect everything to be secure. You have to pick and choose your battles. Workers must have some freedoms. Most of the stuff they do should be easy. Difficulty should be reserved for where it is really needed.

I'm talking about end-to-end encryption -- your jump into password policies is just bringing up the Mordok the Preventer strawman.

Using TLS for your internal services doesn't make users' lives worse; for that matter, a number of technologies offering end-to-end encryption and authentication make users' lives better by offering single-sign-on capabilities (see: Kerberos) while doing host- and service-level authentication and encryption in the background. Having your hard core kerberized means no additional hoops to jump through on login, but ensures that your backend services are able to determine that their access is eventually tied back to an active and valid session.

Fighting any and all attempts at defense-in-depth because some people do it horribly wrong is simply misguided.

Re:Come on (4, Insightful)

jimicus (737525) | more than 2 years ago | (#38830083)

You can not expect everything to be secure. You have to pick and choose your battles. Workers must have some freedoms. Most of the stuff they do should be easy. Difficulty should be reserved for where it is really needed. I hate seeing a system that has 54 character passwords that are reset every 28 days and must include lower case, uppercase, numbers and punctuation so that a call taker can log into the system to take calls. That is stupid shit.

You're not talking about security, you're talking about policies that are thrown together piecemeal in the form of a constantly-updated list of "Things that have been described as insecure in the latest issue of "IT Security for - and written by - PHBs Magazine"". You know how it goes:

Month 1: "Are your users using passwords that are too short?"
EEKS! PANIC! From now all, all passwords must be at least 8 characters long!

Month 2: "Are your users using easily guessable passwords?"
PANIC! From now on, all passwords must be at least 8 characters long and consist of letters and numbers!

Month 3: "Are your users using passwords that are too long? Yes, it's possible. Read our article..."
SHIT! SHIT! SHIT! From now on, all passwords must be at least 8 characters long, no greater than 15 characters long and consist of letters and numbers!

Month 4: "Do you change your passwords often enough?"
PANIC! From now on, all passwords must be at least 8 characters long, no greater than 15 characters long and consist of letters and numbers, and must change every 30 days!

Month 5: "Are your users abusing your policy by typing in the same password every time they're prompted to change it? Read our exclusive report...."
ACTION STATIONS! From now on, all passwords must be at least 8 characters long, no greater than 15 characters long and consist of letters and numbers, must change every 30 days and you can't use the same password twice in a year! We'll keep records of your last 12 passwords to enforce this!

Month 6: "Are you secure against dictionary attacks? Read our article about this SHOCKING new attack method!"
AAARGH! Right, from now on, all passwords must be at least 8 characters long, no greater than 15 characters long, consist of letters and numbers, not appear in any dictionary even if common number/letter substitutions are accounted for, must change every 30 days and you can't use the same password twice in a year! We'll keep records of your last 12 passwords to enforce this!

Month 7: "Did you know? 70% of people use a simple password like 'aaaaaaaaa' or '1234567890123' (not particularly surprising if you've been following everything we've said) Turn to page 12 for our exclusive report!"
DAMN! From now on, all passwords must be at least 8 characters long, no greater than 15 characters long, consist of letters and numbers, not appear in any dictionary even if common number/letter substitutions are accounted for, must not contain the same character repeated more than twice, must not contain sequential letters or numbers, must change every 30 days and you can't use the same password twice in a year! We'll keep records of your last 12 passwords to enforce this!

Month 8: "New research suggests 30% of people use their own telephone number as a password!"
OH NO YOU DON'T! From now on, all passwords must be at least 8 characters long, no greater than 15 characters long, consist of letters and numbers, not appear in any dictionary even if common number/letter substitutions are accounted for, must not contain the same character repeated more than twice, must not contain sequential letters or numbers, will be checked against the phone number we have on record for you to ensure it's not that, must change every 30 days and you can't use the same password twice in a year! We'll keep records of your last 12 passwords to enforce this!

I think you've got the idea by now....

Re:Come on (1)

liquidweaver (1988660) | more than 2 years ago | (#38830201)

I wonder if all your negative responders have ever managed a network.
By the way, I get what you are saying. Even thinking you can lock down everything on a network and believing it will still be useful is naive.
You can create an internal certificate structure for all your employees, IPSec everything end-to-end, full disk encryption, etc... you will still have break in's from social engineering. Beyond Joomla/wordpress/insert spaghetti code php script here, it's becoming far far and few in between where some black hat sitting in bumfuckistan remote exploits his way in without talking to a single person. The best and highest profile hacks of all time were through humans, not by defeating your naive everything-is-encrypted-hard-inner-core circle jerk.

Yeah, I'm working hard for a flamebait tag, but I see this all the time, it's annoying as hell.

Re:Come on (1)

cduffy (652) | more than 2 years ago | (#38830457)

The best and highest profile hacks of all time were through humans, not by defeating your naive everything-is-encrypted-hard-inner-core circle jerk.

And you're right, of course, but that's not an excuse for being sloppy.

Re:Come on (1)

hairyfeet (841228) | more than 2 years ago | (#38830455)

Not to mention those places with BOFH password policies are usually less secure than no passwords at all! I'll never forget a story one of my teachers told me about taking some kids on a tour of a place with a BOFH that just kept droning on and on about how is super asshole password policies made them so super secure, finally mike got tired of it and said 'i bet you $100 and a steak dinner that you let me loose in this place for just 20 minutes i'll be in the system' and of course Mr BOFH wanted to show he was hot shit in front of the kids and so took the bet. Sure enough not 15 minutes later mike hands him a list of no less than a half a dozen passwords and usernames, all good. When the BOFH demanded to know how he did that mike just led him to the cubicles and started flipping over keyboards and sure enough the passwords were sticky noted all over the place!

like that old XKCD bit [xkcd.com] all those insane passwords do is make for really confused and frustrated users.

Re:Come on (1)

Dishevel (1105119) | more than 2 years ago | (#38830763)

Yup. If you make things too difficult for user they will try and figure out a way to make it easier. I am sure that my easy way is much more secure than their easy way.
Though I will state again. There are some things that must be as secure as you can make them. If you treat everything that way though your security will end up for shit.

Re:Come on - you are of coarse correct (1)

fish_in_the_c (577259) | more than 2 years ago | (#38829721)

you are of coarse correct , unfortunately 90% or so of offices in the U.S are 'doing it wrong'

Re:Come on (0)

Anonymous Coward | more than 2 years ago | (#38830007)

this is a bullshit strawman, anyone with a mobile device can sniff the internal network if it has an ethernet port; seriously, its not like insiders are ever a threat either....

Security through obscurity? (5, Insightful)

Sockatume (732728) | more than 2 years ago | (#38828179)

What the story doesn't mention is that the pcAnywhere source was nicked. It sounds like Symantec was aware of the weaknesses, and chose not to act until the source was stolen and the security weaknesses became public.

http://www.channelregister.co.uk/2012/01/18/symantec_leak_latest/ [channelregister.co.uk]

Re:Security through obscurity? (5, Interesting)

jesseck (942036) | more than 2 years ago | (#38828443)

The source was stole in 2006. This means that they corrected the problems in their other products which had stolen source, but not pcAnywhere. For 5-6 years, Symantec has been selling software which was potentially compromised.

The current reported theft happened recently, but that source code came from a theft (unreported by Symantec, but known) back in 2006. That means, since 2006, Symantec has known the pcAnywhere source was stolen, knew of vulnerabilities, and chose not to fix that product. It sounds like they patched the rest of their products, though.

Re:Security through obscurity? (0)

Anonymous Coward | more than 2 years ago | (#38828631)

I haven't kept track of this story all that well; while I know the source was yoinked in 2006, was Symantec AWARE of that fact since 2006? If not, it's believable they didn't fix the problems in their other products until now.

Re:Security through obscurity? (1)

SlippyToad (240532) | more than 2 years ago | (#38828691)

For 5-6 years, Symantec has been selling software which was potentially compromised.

This does not surprise me. Symantec is the shit-king of shit software.

And, like many others here, I certainly threw all my weight into helping get that crap outta MY house several years ago. In fact, I personally headed up and executed our Windows XP rollout several years back to get rid of Win2k, and a major selling point in my cost-benefit analysis was dumping PCAnywhere, and all of the headaches, security holes, and bullshit with RDP and Remote Assistance.

What I unfortunately didn't count on was how slowly the business would move . . . but we are moving in the right direction, even if it has taken 5 years to get there.

Re:Security through obscurity? (1)

cpu6502 (1960974) | more than 2 years ago | (#38831711)

>>>Symantec has known the pcAnywhere source was stolen,

How is this different from any open-source anti-virus software? The source is "out there" and compromised in both cases.

Ooops. I guess I should not have said that.

Re:Security through obscurity? (1)

EETech1 (1179269) | more than 2 years ago | (#38830087)

The (stolen with our source code and now quite useless but we'll still try to make them sound like their secure and somehow useful) encryption details...

FTFS

Cheers

Re:Security through obscurity? (2)

knarf (34928) | more than 2 years ago | (#38830165)

There is another possibility here: pcAnywhere, being closed-source commercial software made by a vendor who is keen to sell as many copies to as many countries as possible, might contain one or more backdoors to enable Those_Who_Make_The_Rules (or those who pay enough) to access any pcAnywhere installation out there. These backdoors might not have changed since 2006, especially if they are based on some 'secret' certificate or another 'secret' sauce. With the source leaked, these secrets might not be so secret anymore - and might have not been so for the past 6 years. This being pcAnywhere, made by a commercial vendor who is keen to sell as much as possible while doing as little as possible, the fact that they knew the secret to be out there might not have bothered them all that much as long as it was not published in CEO magazine.
Is this tin foil territory? It might sound like it, until you contemplate what mobile communications vendors regularly do to get access to controlled markets.

Obligatory XKCD (-1)

Anonymous Coward | more than 2 years ago | (#38828233)

Re:Obligatory XKCD (1)

RyuuzakiTetsuya (195424) | more than 2 years ago | (#38829095)

Eventually there's going to be a story about IPv4 address space going scarce again. When that happens what copypaste drivel are you going to paste? Or are you willing to risk being on topic for once?

Symantec AV will kill your PC (1)

na1led (1030470) | more than 2 years ago | (#38828235)

I can't understand why people still put Symantec on their PC. It's a bloated piece of crap that blocks everything without intelligently deciding if it's a good idea. When I had Symantec installed on my laptop, the CPU was at 100% and I had to manually turn off the firewall just to browse the web.

Re:Symantec AV will kill your PC (3, Insightful)

couchslug (175151) | more than 2 years ago | (#38828999)

Because they don't know how the magic box works, that's why.

Yes, really.

Re:Symantec AV will kill your PC (2)

lwriemen (763666) | more than 2 years ago | (#38829321)

This is the same reason Windows has a monopoly on the PC. (Along with the illegal use of monopoly power, natch.)

Re:Symantec AV will kill your PC (2)

jason777 (557591) | more than 2 years ago | (#38829011)

I'm required to at work. And yes it brings the system to a crawl.

Re:Symantec AV will kill your PC (1)

Anrego (830717) | more than 2 years ago | (#38829679)

I think much like McAfee, they don't.

Dell or whoever they buy the computer from does it for them, and makes it insanely painful to remove.

Re:Symantec AV will kill your PC (1)

DrXym (126579) | more than 2 years ago | (#38829913)

Might be different for corporates but for individuals I don't see any reason to use anything more than the MS Security Essentials app. It's free, it provides good protection, gets new virus definition updates all the time, it doesn't hog the cpu or nag you. That's all one can hope for from antivirus software. It's a refreshing change from the days of MS DOS 6.0 where MS Antivirus was so broken that it was worse than useless.

For enterprises perhaps there is merit in some antivirus to be centrally controlled since they often do more than just detect viruses.

Re:Symantec AV will kill your PC (1)

timbo234 (833667) | more than 2 years ago | (#38830331)

Because they don't know that there's free antivirus software out there that does the job just as well, and even if they did they wouldn't trust it - and rightfully so given the amount of malware out there posing as 'anti-virus' and 'anti-spyware' software.

My parents went throuh this painful cycle. First they got duped by some flashing ad on the internet into downloading one of the malware 'anti-virus' programs, then they went to a local big-name store (Australia's infamous Harvey Norman) who were more than happy to sell them an expensive yearly subscription to Symantec's bloated anti-virus to try and fix it up. When I visited them after that I put MS Security Essentials on and everything's fine since.

I wish MS would just have Security Essentials installed and on by default and end this game where both malware authors and big-name 'respectable' firms rip off non-technical computer users?

Symantec white paper (2)

Azarman (1730212) | more than 2 years ago | (#38828243)

Had to deal with this issue this morning

Extra information http://www.symantec.com/connect/sites/default/files/pcAnywhere%20Security%20Recommendations%20WP_01_23_Final.pdf [symantec.com]

Presently if you use PCanywhere for WAN access disable now, if you use it in a closed network should be ok, unless someone is already on the network but if that is the case, you already have a problem better than this.

I think Symantec handled this ok, when Anon stated they had the source code last week Symantec issued a statement about what they had, mainly 2006 code. Anon yesterday declared they had a few zero days Symantec issued a statement dealing with it last night.

Re:Symantec white paper (1)

jesseck (942036) | more than 2 years ago | (#38828477)

I think Symantec handled this ok, when Anon stated they had the source code last week Symantec issued a statement about what they had, mainly 2006 code.

Personally, I would feel better if Symantec could come out and say, "You know, Anon does have the source code that was stolen from us in 2006, but we've patched those vulnerabilities over the last 5 years. All of our products, including pcAnywhere, are secure and reliable."

I know that Symantec says the rest of the products are safe- I just wonder why it couldn't be "all" products.

Who still uses PCAnywhere? (5, Informative)

ArcherB (796902) | more than 2 years ago | (#38828321)

I remember the first time I used it. It was a Godsend. It was so nice to simply take control and do it rather than sit there on the phone saying, "Click Start. Start. It's on the bottom left. S-T-A-R-T! No, don't type it. Click the button labeled 'Start'. No, it's not on your keyboard. No, wait. Hit CTRL-ESC. Control Escape. It's on your keyboard. Press and hold control and then press and release escape. Keyboard. It's on your keyboard. Nevermind. Do you see Start on your screen?" Even though we were connecting via dialup, it was lightyears better than trying to imagine the screen the use was describing and then describing elements of it it back to them.

But those days are long gone. Now we have RDP, VNC, WebEx, and a host of other remote desktop utilities and protocols. There is no longer a need for PCAW.

There was never a need anyway if you used unix (1, Informative)

Viol8 (599362) | more than 2 years ago | (#38828399)

This isn't another juvenile does-it-run-on-linux rant, but I think its reasonable to point out that remote full screen GUI access via X windows has been around since the mid 80s. A LONG time before any remote GUI windows app or even Windows itself existed.

Re:There was never a need anyway if you used unix (0)

Anonymous Coward | more than 2 years ago | (#38828467)

Windows 1.0 released November of 1985. X was developed in 1984.

Re:There was never a need anyway if you used unix (1)

Anonymous Coward | more than 2 years ago | (#38828845)

Windows 1.0 released November of 1985. X was developed in 1984.

Exactly, a LONG time. I mean, in that amount of time, fifteen versions of Firefox could've been released!

Re:There was never a need anyway if you used unix (4, Insightful)

Sockatume (732728) | more than 2 years ago | (#38828519)

It's not exactly relevant to the subject at hand, is it? His point is that it was really, really handy to be able to do that with Windows. Nobody even brought up Unix, or who did it first.

Re:There was never a need anyway if you used unix (1)

Anonymous Coward | more than 2 years ago | (#38828577)

But if someone did bring it up, UNIX did it first.

Re:There was never a need anyway if you used unix (1)

Sockatume (732728) | more than 2 years ago | (#38828645)

My point is that it pretty much by definition has to be a juvenile does-it-run-on-linux rant, if it's wedged in apropos of nothing to a conversation on a different topic.

Re:There was never a need anyway if you used unix (1)

Viol8 (599362) | more than 2 years ago | (#38828781)

The OP was saying that people no longer have to use PCAW these days because of VNC etc. My point is we never had to use PCAW anyway if we used unix or linux on a PC. If that explanation still isn't simple enough for you let me know and I'll mail you one drawn in crayon.

Re:There was never a need anyway if you used unix (1)

Sockatume (732728) | more than 2 years ago | (#38829097)

Well, that must've been very nice for you.

Re:There was never a need anyway if you used unix (2)

ArcherB (796902) | more than 2 years ago | (#38830225)

The OP was saying that people no longer have to use PCAW these days because of VNC etc. My point is we never had to use PCAW anyway if we used unix or linux on a PC. If that explanation still isn't simple enough for you let me know and I'll mail you one drawn in crayon.

The problem was that I was working for a digital imaging company that installed photo imaging kiosks in photo labs. Now, this was before digital cameras became popular so the majority of our business was from customers scanning images using flatbed scanner or negative scanner. Our software allowed for customers to manipulate their images in a number of ways and reprint them in minutes using the dye sublimation printer.

Now, I would have loved to used Linux or Unix but we had some issues. First, was finding drivers for the scanners we used. SANE sucked at the time. Next was finding drivers for the dye sub printers. The drivers simply didn't exist. Finally, there would have been issues finding drivers for the touchscreen interface for the CRT monitors we used at the time. Again, none were available.

So, yeah. It would have been nice to use a *n?x solution, but it simply was not an option.

Oh, and this was before most businesses had an Internet connection, so throw in modem drivers as well. Remember in 1999, Winmodems were all the rage and Linux drivers, again, did not exist.

Finally, Kodak, our competition, did use Sun machines that ran a version of Unix, but they had millions to throw at the project and had the machines, drivers and software custom designed by Sun. We had 30 employees and had to use off the shelf components and modify them ourselves if need be.

Re:There was never a need anyway if you used unix (1)

mrclisdue (1321513) | more than 2 years ago | (#38828643)

I don't know what you classify as a 'long' time, but I was using a remote solution for Windows as early as 3.1 (1991-92?); called PC Commute, which iirc was made by Winsim, who also had something to do with AccPac. Pretty sure vnc for windows freeware was around then, as well...perhaps a precursor to RealVNC. I think Close-up was bundled with a major software package by about '95.

Anyhow, I *do* subscribe to the *nix fanboy newsletter, (slackware ftw!)...just sayin'

cheers,

Re:There was never a need anyway if you used unix (1)

Viol8 (599362) | more than 2 years ago | (#38828875)

I'd say 7 years is a long time in the computer world! :o)

Anyway , all these old remote packages - and even some around today - simply streamed whatever the graphics card was displaying (instead of setting up an independent network desktop which X win did from the start) which is franky just retarded and useless for any serious remote usage.

Re:There was never a need anyway if you used unix (0)

Anonymous Coward | more than 2 years ago | (#38828733)

This isn't another juvenile does-it-run-on-linux rant,

Yes it is. No one gives a shit that Unix did it "first" (by the way your estimates are totally wrong, lmao) and you spend time posting just to tell us that, something no one cares about.

Re:There was never a need anyway if you used unix (1)

RCL (891376) | more than 2 years ago | (#38829069)

I think you haven't actually tried using X windows over internet, let alone on a dialup connection.

Re:There was never a need anyway if you used unix (1)

Viol8 (599362) | more than 2 years ago | (#38829931)

LOL , yeah , if you say so. I guess I must have been dreaming when I used it to connet to company networks over ISDN in the early 90s.

Re:There was never a need anyway if you used unix (2)

pak9rabid (1011935) | more than 2 years ago | (#38829473)

This isn't another juvenile does-it-run-on-linux rant, but I think its reasonable to point out that remote full screen GUI access via X windows has been around since the mid 80s. A LONG time before any remote GUI windows app or even Windows itself existed.

Yeah, and unless you're connecting over a LAN connection, it's 100% terrible. That's why projects like FreeNX [berlios.de] and x2go [x2go.org] exist...to clean up the massive bloat and waste the X11 protocol introduces.

Re:There was never a need anyway if you used unix (2)

Skuld-Chan (302449) | more than 2 years ago | (#38829573)

Scraping what someone actually see's on their X-Serv for support reasons is a bit different problem - one that most people solve with VNC oddly enough.

PC-Anywhere had support for modem's too - I remember using it to support backwater glass shops on MS-Dos applications...

Re:Who still uses PCAnywhere? (2, Funny)

Zocalo (252965) | more than 2 years ago | (#38828469)

"Click Start. Start. It's on the bottom left. S-T-A-R-T! No, don't type it. Click the button labeled 'Start'. No, it's not on your keyboard. No, wait. ...

And that's where you went wrong. The correct procedure for any self respecting BOFH at this point would be:

"Turn off the PC at the power switch, turn it back on and call back when you have logged back in. Bye." *Hang up phone* "I'm going on my coffee/cigarette break guys. See you in twenty!

Re:Who still uses PCAnywhere? (0)

Anonymous Coward | more than 2 years ago | (#38829255)

And that's where you went wrong. The correct procedure for any self respecting BOFH at this point would be:

"Turn off the PC at the power switch, turn it back on and call back when you have logged back in. Bye." *Hang up phone* "I'm going on my coffee/cigarette break guys. See you in twenty!

Hah, the jokes on you. With all the spyware and viruses installed, theres no way you can reboot and login in less than 20 minutes.

Re:Who still uses PCAnywhere? (0)

Anonymous Coward | more than 2 years ago | (#38830645)

.......that was the point.....?

Re:Who still uses PCAnywhere? (1)

LordLimecat (1103839) | more than 2 years ago | (#38829303)

RDP requires port forwarding, which requires access to the firewall, which is not always available; it also will not work if your ISP NATs you. Ditto with VNC, unless you use a repeater or know for sure what ip you will be connecting from (so you can do a reverse VNC). WebEx is not free.

There ARE good, free alternatives-- TeamViewer, ShowMyPC, hamachi+rdp, LogMeIn, CrossLoop, etc.

Re:Who still uses PCAnywhere? (0)

Anonymous Coward | more than 2 years ago | (#38830761)

In fact, the problem is that there are so many different solutions (both free and non-free).
For every software supplier we have, we need to use a different program.
As users are not allowed to install software (or run software they download), each of them has to be installed and kept uptodate.
This is becoming an ever bigger headache.
It'd really like to see a standard protocol used by all remote assistance software, so a single installed piece of software can
be used with all remote assistance.

Re:Who still uses PCAnywhere? (1)

thereitis (2355426) | more than 2 years ago | (#38829665)

That's enough to drive someone to drink! I could never do phone support.

Re:Who still uses PCAnywhere? (1)

MachineShedFred (621896) | more than 2 years ago | (#38831055)

Unfortunately, Symantec just finished purchasing and absorbing the Altiris Client Management Suite.

Guess what one of the changes was in the latest major version (7.1)? You guessed it: a wholesale replacement of the existing remote control applet with PCAnywhere.

Once again, Symantec buys a functional company that makes a decent product, and then proceeds to ruin it until no one buys it anymore, then they go acquire what everyone moved to so they can ruin that too.

It's like financial speculators, only worse: They add no value to the commodity; in fact, they subtract value from it.

Good Job Symantec (4, Interesting)

rudy_wayne (414635) | more than 2 years ago | (#38828363)

According to this article [cnet.com] , the source code for PCANywhere was stolen from Symantec's network in 2006. That's right . . . . 2006. Good work Symantec. It only took you 6 years.

Re:Good Job Symantec (5, Funny)

elrous0 (869638) | more than 2 years ago | (#38828461)

It only took you 6 years.

They would have gotten an email out sooner, but Norton was REALLY slowing their computers down.

Re:Good Job Symantec (2)

GrBear (63712) | more than 2 years ago | (#38830115)

Parent modded "Funny", but exasperates why Slashdot needs a "Sad But True" mod tag.

Re:Good Job Symantec (2)

L4t3r4lu5 (1216702) | more than 2 years ago | (#38828507)

The disclosure of the breach was drafted in 2006, but the tech at the time decided to start a virus scan before sending it.

The mail server only just started responding again.

Best: stop using Symantec and MS-Windows products. (-1)

Anonymous Coward | more than 2 years ago | (#38828401)

The best solution for the problem lies not with Symantec, nor McAfee, nor any anti-viruses floating around. Dump your MS-Windows, any version of it, and install a free fresh and clean Linux! Yes, you can have a real operation system for free, immune to viruses.

Re:Best: stop using Symantec and MS-Windows produc (2)

jeremyjo (1857008) | more than 2 years ago | (#38828597)

Are you kidding? If we're supposed to stop using pcAnywhere because the source code is out there, just think how unsecure Linux is! It's source code has been out there way longer.

Re:Best: stop using Symantec and MS-Windows produc (1)

Anonymous Coward | more than 2 years ago | (#38830297)

Availability of source code isn't a problem if you don't depend on "security by [source] obscurity." The problem is that Semantec not only relies on source obscurity but didn't do anything (for years) when the weak security was defeated by exposing the source.

The goal of security is not to hide the security method but to make it clear that not having something (e.g. a key or lock combo) will make it very difficult to penetrate. Essentially you want put it all on the user. You make it so hard to break the security that it makes compromising the user easier. You steal his keys even though you know how the key was cut with a laser and how its RFID tag works. You steal his private encryption keys even though you have the encryption algorithm. If a vault is good enough, you'll have to attack the owner until he gives up the vault's combination.

If you want to obscure your design details to add one more hurdle, go for it. Just don't depend on it keeping you safe. Layer's folks. Security by obscurity is a single layer. You shouldn't let it be a single point of failure.

Sniffers are so *EASY* to avoid (1)

mark-t (151149) | more than 2 years ago | (#38828473)

Just use a secret encrypted key exchange, like Diffie-Hellman, to set up a secure communication channel on the wire. While Diffie-Hellman may be susceptible to MitM attacks, it is about the closest thing you can get to foolproof protection against any form of eavesdropping on any type of broadcast channel, be that over radio, or on local ethernet line (unless the sniffer is a quantum computer, and would be thus break the encryption). To prevent MitM attacks, you need another type of system built on top of that, of course, but this article clearly states that the system in question is vulnerable to sniffers placed on the customer's physical LAN, and not MitM.

Re:Sniffers are so *EASY* to avoid (1)

dkf (304284) | more than 2 years ago | (#38829171)

Just use a secret encrypted key exchange, like Diffie-Hellman, to set up a secure communication channel on the wire.

Or use SSL, which uses protocols like DH (depending on configured protocol suite) to set up a secure communication channel. And it's a heck of a lot simpler than writing all that stuff yourself; both the protocols used and the implementation even get independently audited from time to time.

No, you don't actually need to use a CA to use SSL. Or rather, you can easily run with an explicit list of trusted certificates or operate a private CA. Those are in fact a highly secure option (if harder work to scale up).

Symantec is a little slow on the uptake here (2)

IGnatius T Foobar (4328) | more than 2 years ago | (#38828517)

Most of us have been advising people not to use pcAnywhere for more than a decade now. :)

Re:Symantec is a little slow on the uptake here (1)

ConceptJunkie (24823) | more than 2 years ago | (#38830103)

I stopped using it in the late 90s when I discovered VNC was free _and_ worked about 10 times faster.

New name (1)

Rik Sweeney (471717) | more than 2 years ago | (#38828881)

(Your) pcEverywhere

If.... (1)

LordLimecat (1103839) | more than 2 years ago | (#38829259)

The researchers continued, "If the Active Directory credentials were used as part of an DoD Exchange tie in, the attackers could get access to incriminating government official emails. If they got access to incriminating DoD emails, they could extort nuclear launch codes out of the officials. If they extorted launch codes out of the officials, they could start a nuclear holocaust."

The researchers concluded, "and that is why you never give a mouse a cookie."

Re:If.... (1)

silverglade00 (1751552) | more than 2 years ago | (#38830559)

I will spend the rest of the day imagining the parts in between the cookie and obtaining the Active Directory credentials. My boss will hate you. I will not.

M0R0N5! (1)

aglider (2435074) | more than 2 years ago | (#38829675)

So I understand that Symantec is either using very poor cryptography or even exchanging authentication credentials in plain text!
Have they had any chance to read a few basic documents about, say, ssh?
M0R0N5!

Re:M0R0N5! (1)

aglider (2435074) | more than 2 years ago | (#38829689)

... and please, yes, troll me down!

Re:M0R0N5! (1)

MachineShedFred (621896) | more than 2 years ago | (#38831099)

Or, maybe a Diffie-Hellman Exchange? I mean, that's only been around since 1976...

http://en.wikipedia.org/wiki/Diffie [wikipedia.org] –Hellman_key_exchange

Typical for the Windows world (-1)

dskoll (99328) | more than 2 years ago | (#38829847)

Because of Windows' lack of decent remote access options, Windows ISVs continue to reinvent SSH badly.

Re:Typical for the Windows world (2)

dave420 (699308) | more than 2 years ago | (#38830439)

Microsoft's terminal services are pretty decent. It seems you've not used them.

Re:Typical for the Windows world (1)

Local ID10T (790134) | more than 2 years ago | (#38830933)

There is no reason for remote access to a desktop PC in a business environment.

I can understand remote access to data and remote application sessions (citrix/terminal services/remote desktop server/etc), but what is the business case justification for remotely logging in to the PC on your desktop at work?

Re:Typical for the Windows world (0)

Anonymous Coward | more than 2 years ago | (#38831117)

Work from home ?

Not a bug... (0)

Anonymous Coward | more than 2 years ago | (#38829877)

but rather a 'feature'. Software package to be renamed to pcAnyone.

Class Action Suit (1)

Anonymous Coward | more than 2 years ago | (#38830345)

Class-action suit in 3 .. 2 .. 1 :-)
No really a company that pretends to sell security is compromised in 2K6, refuses to inform anyone about it. So technically, if someone is able to provide some sort of proof that systems are compromised because the source code is out in the wide open as of 2K6 and $$$ got lost, then it's up to Symantec to pay for it.
This is the stuff that I really intensively hate about the ICT sector, them 'take the money and run' companies that don't give a damn about anything, as long as the sales figures are going up.

Hah. (1)

wiedzmin (1269816) | more than 2 years ago | (#38830389)

if the attackers place a network sniffer on a customer's internal network

...that customer has much bigger problems to worry about than Symantec applications.

Meanwhile (1)

Local ID10T (790134) | more than 2 years ago | (#38830805)

"Symantec Tells Customers To Stop Using pcAnywhere" ...IT staff have been begging users to stop using pcAnywhere for years.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?