Symantec secures its vulnerable "Hack is Wack" site

Share this article:
Security giant Symantec said it has secured its “Hack is Wack” contest website after researchers discovered it was riddled with vulnerabilities.

Last week, Symantec, with the help of famed rapper Snoop Dogg, began promoting its new “Hack is Wack” marketing campaign for its Norton anti-virus products. As part of the effort, budding rappers are invited to post a video about cybercrime for a chance to win Snoop concert tickets and to hang out with his management team.

But it did not take researchers long to discover the irony of the gimmick.

“… the 'Hack is Wack' site is chock full of holes,” security blogger Mike Bailey wrote on his Skeptikal.org blog on Thursday.

For example, the site contained a cross-site scripting (XSS) flaw that allowed it to be linked to an image of 1980s pop star Rick Astley — a common internet prank known as “rickrolling.” Additionally, the site allowed potentially sensitive data to be cached.

And, security problems with the video upload script made the site vulnerable to cross-site request forgery (CSRF) attacks, Bailey said. The flaw could have enabled someone to create image tags on another website to vote for a specific video on the Symantec site, essentially allowing for ballot stuffing.

Symantec, in a statement sent to SCMagazineUS.com on Tuesday, said it immediately took action to plug the holes.

“To date, we can confirm that no company or customer data has been compromised or exposed,” the company said in a statement. “Symantec takes the security of our website and microsites very seriously, and we have taken the necessary steps to resolve this issue.”

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

As EMV deadline looms, industry looks to next ATM attack front

As EMV deadline looms, industry looks to next ...

Next year, EMV migration in the U.S. will inevitability change fraudsters' attack methods.

Kevin Mitnick to sell zero-day exploits

Kevin Mitnick's new venture will develop and procure zero-day exploits, then sell them for $100,000 or more.

FBI warns of potential cyber attacks launched by ISIS hacktivists

Following U.S. military airstrikes in the Middle East, the FBI has issued a warning regarding possible cyber threats aimed at U.S. networks and critical infrastructure by hacktivists in support of ISIS.