Symantec secures its vulnerable "Hack is Wack" site

Share this article:
Security giant Symantec said it has secured its “Hack is Wack” contest website after researchers discovered it was riddled with vulnerabilities.

Last week, Symantec, with the help of famed rapper Snoop Dogg, began promoting its new “Hack is Wack” marketing campaign for its Norton anti-virus products. As part of the effort, budding rappers are invited to post a video about cybercrime for a chance to win Snoop concert tickets and to hang out with his management team.

But it did not take researchers long to discover the irony of the gimmick.

“… the 'Hack is Wack' site is chock full of holes,” security blogger Mike Bailey wrote on his blog on Thursday.

For example, the site contained a cross-site scripting (XSS) flaw that allowed it to be linked to an image of 1980s pop star Rick Astley — a common internet prank known as “rickrolling.” Additionally, the site allowed potentially sensitive data to be cached.

And, security problems with the video upload script made the site vulnerable to cross-site request forgery (CSRF) attacks, Bailey said. The flaw could have enabled someone to create image tags on another website to vote for a specific video on the Symantec site, essentially allowing for ballot stuffing.

Symantec, in a statement sent to on Tuesday, said it immediately took action to plug the holes.

“To date, we can confirm that no company or customer data has been compromised or exposed,” the company said in a statement. “Symantec takes the security of our website and microsites very seriously, and we have taken the necessary steps to resolve this issue.”

Share this article:

Sign up to our newsletters

More in News

EFF intros wireless router software to boost industry standard

EFF intros wireless router software to boost industry ...

This weekend, the digital rights group released a "hacker alpha" version of its Open Wireless Router software.

Breaches driving organizational security strategy, survey indicates

Breaches driving organizational security strategy, survey indicates

CyberArk interviewed 373 IT security executives and other senior management in North America, Europe and the Asia-Pacific as part of its eighth annual Global Advanced Threat Landscape survey.

Siemens industrial products impacted by four OpenSSL vulnerabilities

The vulnerabilities can be exploited remotely, and fairly easily, by an attacker to hijack sessions and crash the web server of the product.