Symantec secures its vulnerable "Hack is Wack" site

Share this article:
Security giant Symantec said it has secured its “Hack is Wack” contest website after researchers discovered it was riddled with vulnerabilities.

Last week, Symantec, with the help of famed rapper Snoop Dogg, began promoting its new “Hack is Wack” marketing campaign for its Norton anti-virus products. As part of the effort, budding rappers are invited to post a video about cybercrime for a chance to win Snoop concert tickets and to hang out with his management team.

But it did not take researchers long to discover the irony of the gimmick.

“… the 'Hack is Wack' site is chock full of holes,” security blogger Mike Bailey wrote on his Skeptikal.org blog on Thursday.

For example, the site contained a cross-site scripting (XSS) flaw that allowed it to be linked to an image of 1980s pop star Rick Astley — a common internet prank known as “rickrolling.” Additionally, the site allowed potentially sensitive data to be cached.

And, security problems with the video upload script made the site vulnerable to cross-site request forgery (CSRF) attacks, Bailey said. The flaw could have enabled someone to create image tags on another website to vote for a specific video on the Symantec site, essentially allowing for ballot stuffing.

Symantec, in a statement sent to SCMagazineUS.com on Tuesday, said it immediately took action to plug the holes.

“To date, we can confirm that no company or customer data has been compromised or exposed,” the company said in a statement. “Symantec takes the security of our website and microsites very seriously, and we have taken the necessary steps to resolve this issue.”

Share this article:

Sign up to our newsletters

More in News

Brazilian president signs internet 'Bill of Rights' into law

Brazilian president signs internet 'Bill of Rights' into ...

President Dilma Rousseff signed the legislation on Wednesday at the NetMundial conference in Sao Paulo.

Android trojan sends premium SMS messages, targets U.S. users for first time

Android trojan sends premium SMS messages, targets U.S. ...

An SMS trojan for Android, known as FakeInst, has been observed sending premium SMS messages to users all over the world, including, for the first time, the United States.

Report: DDoS up in Q4 2013, vulnerability scanners leveraged to exploit sites

Report: DDoS up in Q4 2013, vulnerability scanners ...

Researchers observed 346 DDoS attacks in the final quarter of 2013 and attackers used Vega and Skipfish vulnerability scanners to exploit web flaws at financial companies.