Feeds

Symantec Japan website bamboozled by hacker

Plaintext passwords revealed

Internet Security Threat Report 2014

A Symantec-run website was vulnerable to Blind SQL Injection problems that reportedly exposes a wealth of potentially sensitive information.

Romanian hacker Unu used off-the-shelf tools (Pangolin and sqlmap) to steal a glimpse at the database behind Symantec's Japanese website. A peek at the Symantec store revealed by the hack appears to show clear-text passwords associated with customer records. Product keys held on a Symantec server in Japan were also exposed by the hack.

Unu has previously exposed similar problems involving the websites of the UK's parliament and Kaspersky, among many others. The grey-hat hacker has published screenshots to back up his latest claims which, if verified, run deeper than shortcomings on the websites of Kaspersky, F-secure and other security firms previously reported by Unu.

Symantec said it was investigating the reported breach, which Unu claims gave him full disk and database access. The security giant said the vulnerability only affected a website used by consumer customers in the Far East. Symantec admitted there was a problem without commenting on how serious the snafu might be, pending the result of an investigation. The offending site - pcd.symantec.com - has been taken offline pending the addition of extra security defences.

A SQL injection vulnerability has been identified at pcd.symantec.com. The Web site facilitates customer support for users of Symantec's Norton-branded products in Japan and South Korea only. This incident does not affect Symantec customers anywhere else in the world.

This incident impacts customer support in Japan and South Korea but does not affect the safety and usage of Symantec's Norton-branded consumer products.

Symantec is currently in the process of updating the Web site with appropriate security measures and will bring it back online as soon as possible. Symantec is still investigating the incident and has no further details to share at this time.

SQL injection flaws lie at the heart of all the security problems reported by Unu. The class of vulnerability in general makes it possible to trick back-end databases into handing over potentially sensitive data in response to commands appended onto the end of URLs entered into a browser.

Attacks based on Blind SQL Injection can be labour intensive, reports Gunter Ollmann, VP of research at Damballa, whose blog entry explained that attacks hunting for these types of web security vulnerability are beginning to be automated by botnets. "[This] means that exploitation of these vulnerabilities and enumeration of the the database data can be conducted in a few minutes - way before a security team can actively respond to the attack and close down the breach and loss of confidential data," he explains. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.