Explore the latest news and trends  

Sign up for our weekly security newsletter

Be the first to receive important updates on security


Symantec Site Vulnerable to Cross-site Scripting Assaults

According to Nemesis/t3am3lite (name of a website), Symantec's site too is now open to XSS (cross-site scripting) attacks together with Iframe injections.

An XSS attack, according to security experts, launches when a web program collects vicious data from an end-user mostly via a hyperlink that carries malicious content inside it. Thus, as the end-user clicks on the hyperlink while on another site, or via any other mode of connection, the attacker compromises his data.

Similarly, the XSS flaw in Symantec's website could enable hackers to grab the cookies that Symantec places on the hard-drives of user's computers. The purpose of such cookies is to establish that a site user has already typed in a genuine password. Thus, the possibility of stealing the file is a result of a serious shortfall in Symantec's security. This means that Symantec could let the visitor view the file since it regarded him as a person who had previously accessed the site.

Besides, images from unrelated websites like imageshack.us were possible to insert, as per other exploits. t3am3lite, the hacking collective, claims that stringent hackers could take advantage of the flaw to inject malicious JavaScript, or other kinds of software that exploit un-patched security flaws or perform other sinister deeds. In short, it was possible to inject malware by exploiting this bug.

Meanwhile, there are other websites (apart from Symantec) that have experienced XSS attacks. These include antivirus vendors BitDefender and Kaspersky, online payment service PayPal, financial services American Express and prominent government agencies like the US Department of Homeland Security.

Security specialists have commented that the flaws could damage a site's reputation with the PCI (Payment Card Industry), or with other regulatory agencies. Therefore, Symantec, on learning about the recent XSS blow, is making all efforts to get rid of the vulnerability.

Ultimately, with Symantec also becoming a part of the group of other security companies that malware distributors have penetrated, it becomes evident that the perpetrators are doing everything possible to beat security vendors. Possibly, these perpetrators have established their malicious capability as they have successfully and easily attacked Symantec.

Related article: Sentence for American Contractor for Sabotaging Government Navy Computers

» SPAMfighter News - 4/25/2009

3 simple steps to update drivers on your Windows PCSlow PC? Optimize your Slow PC with SLOW-PCfighter!Email Cluttered with Spam? Free Spam Filter!

Dear Reader

We are happy to see you are reading our IT Security News.

We do believe, that the foundation for a good work environment starts with fast, secure and high performing computers. If you agree, then you should take a look at our Business Solutions to Spam Filter & Antivirus for even the latest version of Exchange Servers - your colleagues will appreciate it!

Go back to previous page