Symantec secures its vulnerable "Hack is Wack" site

Share this article:
Security giant Symantec said it has secured its “Hack is Wack” contest website after researchers discovered it was riddled with vulnerabilities.

Last week, Symantec, with the help of famed rapper Snoop Dogg, began promoting its new “Hack is Wack” marketing campaign for its Norton anti-virus products. As part of the effort, budding rappers are invited to post a video about cybercrime for a chance to win Snoop concert tickets and to hang out with his management team.

But it did not take researchers long to discover the irony of the gimmick.

“… the 'Hack is Wack' site is chock full of holes,” security blogger Mike Bailey wrote on his Skeptikal.org blog on Thursday.

For example, the site contained a cross-site scripting (XSS) flaw that allowed it to be linked to an image of 1980s pop star Rick Astley — a common internet prank known as “rickrolling.” Additionally, the site allowed potentially sensitive data to be cached.

And, security problems with the video upload script made the site vulnerable to cross-site request forgery (CSRF) attacks, Bailey said. The flaw could have enabled someone to create image tags on another website to vote for a specific video on the Symantec site, essentially allowing for ballot stuffing.

Symantec, in a statement sent to SCMagazineUS.com on Tuesday, said it immediately took action to plug the holes.

“To date, we can confirm that no company or customer data has been compromised or exposed,” the company said in a statement. “Symantec takes the security of our website and microsites very seriously, and we have taken the necessary steps to resolve this issue.”

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

Company news: New hires at Accuvant, ZeroFox and ThreatStream

New hires at Accuvant, ZeroFOX and ThreatStream, while a divestiture at Juniper and an acquisition for BlackBerry.

News briefs: The latest on Sony, Android, Backoff malware and more.

News briefs: The latest on Sony, Android, Backoff ...

This month's news briefs cover a preliminary settlement Sony will bear for the exposure of 77 million customers, and more.

CryptoWall surpasses CryptoLocker in infection rates

CryptoWall surpasses CryptoLocker in infection rates

A threat analysis from Dell SecureWorks CTU says that CryptoWall has picked up where its famous sibling left off.