Feeds

McAfee 'Hacker Safe' cert sheds more cred

Rubber stamp factory exposed

High performance access to file storage

Comment More than three months after security bugs were documented in more than 60 ecommerce sites certified by McAfee as "Hacker Safe," a security researcher has unveiled a fresh batch of vulnerable websites.

Russ McRee, a security consultant for HolisticInfoSec.org, documented cross-site scripting (XSS) errors in five sites that prominently carry a logo declaring them to be Hacker Safe. As McRee documented in a blog post and accompanying video, the bugs make it possible for attackers to steal authentication credentials and redirect visitors to malicious websites.

All five of the sites subscribe to McAfee's HackerSafe certification service, which audits the security of websites on a daily basis to give visitors confidence they'll be safe when doing business there. Yet McRee was able to find the bugs by using advanced Google searches to pinpoint vulnerable web applications, and in at least one case, the XSS vulnerability has been on the customer's site since January.

"There's a responsibility to the consumer that really seems to be missing in that service," McRee told us. "The average consumer assumes that because I see that label I must be safe."

The five vulnerable sites include Alsto.com, Delaware Express, BlueFly, Improvements Catalog and Delightful Deliveries. We asked all five for comment but only one of them, Delightful Deliveries, responded. "As the #1 leading seller of Gift Baskets, security is a top priority to us and our customers, we will work with HackerSafe and our development team to resolve this issue," a representative said. He is unaware of any breaches affecting the site, he added.

A McAfee spokeswoman said the company rates XSS vulnerabilities less severe than SQL injections and other types of security bugs. "Currently, the presence of an XSS vulnerability does not cause a web site to fail HackerSafe certification," she said. "When McAfee identifies XSS, it notifies its customers and educates them about XSS vulnerabilities."

These are only the latest Hacker Safe sites to be outed. In January, researchers from XSSed.com, documented 62 websites subscribing to the service that were vulnerable to XSS vulnerabilities. A Hacker Safe spokesman told InformationWeek at the time the bugs couldn't be used to hack a server.

The vulnerabilities also raise the question of so-called payment card industry (PCI) requirements for businesses that process credit card payments. Websites that contain XSS vulnerabilities almost certainly don't comply, McRee says, and yet most of the sites continue to accept credit cards. But we'll leave deficiencies in that set of requirements for another day.

McAfee has had three months to fix the deficiencies of this program, but so far we see no evidence it's done so. We're all for services that help websites stay on top of rapidly moving security threats. But there's a term for programs that declare their customers Hacker Safe while failing to catch easily spotted XSS flaws. It's called a rubber stamping, and it's time it stopped. ®

Update

A Bluefly spokeswoman says the company is working to correct the problem on its website.

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.