Feeds

Anti-virus vendor trio plug website flaws

XSS marks the spot

5 things you didn’t know about cloud backup

White-hat hackers have uncovered vulnerabilities on the websites of anti-virus firms that created a phishing risk.

Cross-site scripting (XSS) bugs of varying severity were found on the websites of Symantec (here), Eset (here) and Panda Security (here) by Team Elite, the white-hat hackers who discovered the flaws. We notified all three firms of the issue and all three responded by plugging the flaws in good time.

Coding errors that give rise to cross-site scripting flaws are endemic in web development. This class of vulnerability might, for example, allow a hacker to present content from third-party sites (pop-ups, malicious scripts etc.) as if it came from a site a surfer was trying to visit and that site alone. As such these flaws are very handy for phishing attacks that attempt to trick the unwary into handing over their credentials to untrusted sites.

A XSS flaw on Twitter's website was exploited by the infamous onMouseover worm last month, a point security firms were jumping over themselves to comment on. The XSS flaws on anti-virus firms websites were not exploited and no harm was done.

Nonetheless Symantec et al should be especially careful to set a good example in web security. That's what these firms sell after all, but experience shows that XSS problems are commonplace even in the information security vendor market.

And because groups such as Team Elite go looking for them these problems regularly get a public airing. Even though there's evidence of miscreants exploiting these vulnerabilities that's no reason to dismiss them, as one Team Elite member explain in an email to El Reg.

"XSS vulnerability is a high level vulnerability which could allow an attacker to steal sensitive data such as login information and other credentials," he said. "I can assure you that our team does not do such things, we don't hack any websites, we simply deliver the proof of concept, spread the knowledge of existing vulnerability so the companies can correct those bugs for the good of their own."

"I've noticed that all three security vendors have fixed the bugs on their websites, which is very positive," he added. ®

Next gen security for virtualised datacentres

More from The Register

next story
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.