Symantec secures its vulnerable "Hack is Wack" site
Security giant Symantec said it has secured its “Hack is Wack” contest website after researchers discovered it was riddled with vulnerabilities.Last week, Symantec, with the help of famed rapper Snoop Dogg, began promoting its new “Hack is Wack” marketing campaign for its Norton anti-virus products. As part of the effort, budding rappers are invited to post a video about cybercrime for a chance to win Snoop concert tickets and to hang out with his management team.
But it did not take researchers long to discover the irony of the gimmick.
“… the 'Hack is Wack' site is chock full of holes,” security blogger Mike Bailey wrote on his Skeptikal.org blog on Thursday.
For example, the site contained a cross-site scripting (XSS) flaw that allowed it to be linked to an image of 1980s pop star Rick Astley — a common internet prank known as “rickrolling.” Additionally, the site allowed potentially sensitive data to be cached.
And, security problems with the video upload script made the site vulnerable to cross-site request forgery (CSRF) attacks, Bailey said. The flaw could have enabled someone to create image tags on another website to vote for a specific video on the Symantec site, essentially allowing for ballot stuffing.
Symantec, in a statement sent to SCMagazineUS.com on Tuesday, said it immediately took action to plug the holes.
“To date, we can confirm that no company or customer data has been compromised or exposed,” the company said in a statement. “Symantec takes the security of our website and microsites very seriously, and we have taken the necessary steps to resolve this issue.”
