Feeds

Hackers: BitDefender site exposes private data (yet again)

Second time in seven days

Build a business case: developing custom apps

Updated Romanian hackers have discovered a security flaw in the website of anti-virus provider BitDefender. They said it was the second time in a week the company has inadvertently exposed a database that is supposed to remain private.

According to an item posted to HackersBlog, BitDefender's main website can be tricked into disclosing database contents by embedding commands into the BitDefender.com URL.

"This parameter gives access to the DB," a hacker by the name of Unu reported. "I will not publish too much now as I am waiting for the problem to be solved."

Unu went on to say he had reported the vulnerability to the site's webmaster but had received no reply. "Therefore, knowing they read our articles, I will let them know here that they have a vulnerable parameter," he wrote.

A BitDefender spokesman confirmed the site had an unchecked parameter that was fixed on Saturday. But he denied the flaw exposed any private information or resulted in an SQL injection.

Last week, HackersBlog reported a separate vulnerability in BitDefender.pt, the authorized seller of BitDefender software for Portuguese-speaking customers. It had the potential to expose names and email addresses of people who used the site. The company has yet to say whether any such information was accessed. The company only made matters worse when it released a statement distancing itself from the breach.

"This was an unfortunate event and while we sympathize with the sites that were affected, BitDefender was not one of those sites," the statement read. "None of the sites hacked are owned or operated by BitDefender."

BitDefender could learn a thing or two from competitor Kaspersky Lab. After an American support site was found to have exposed customer data for 11 days, the company hired an outside auditor to conduct a forensic analysis. He determined that while the information was accessible, hackers never actually succeeded in stealing the data.

Last week, F-Secure, another anti-virus provider, was also found to have SQL injection vulnerabilities on its website. The company said the only data exposed by the bug was publicly available information shown on its statistics page. ®

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?