Symantec Site Vulnerable to Cross-site Scripting Assaults

According to Nemesis/t3am3lite (name of a website), Symantec's site too is now open to XSS (cross-site scripting) attacks together with Iframe injections.

An XSS attack, according to security experts, launches when a web program collects vicious data from an end-user mostly via a hyperlink that carries malicious content inside it. Thus, as the end-user clicks on the hyperlink while on another site, or via any other mode of connection, the attacker compromises his data.

Similarly, the XSS flaw in Symantec's website could enable hackers to grab the cookies that Symantec places on the hard-drives of user's computers. The purpose of such cookies is to establish that a site user has already typed in a genuine password. Thus, the possibility of stealing the file is a result of a serious shortfall in Symantec's security. This means that Symantec could let the visitor view the file since it regarded him as a person who had previously accessed the site.

Besides, images from unrelated websites like imageshack.us were possible to insert, as per other exploits. t3am3lite, the hacking collective, claims that stringent hackers could take advantage of the flaw to inject malicious JavaScript, or other kinds of software that exploit un-patched security flaws or perform other sinister deeds. In short, it was possible to inject malware by exploiting this bug.

Meanwhile, there are other websites (apart from Symantec) that have experienced XSS attacks. These include antivirus vendors BitDefender and Kaspersky, online payment service PayPal, financial services American Express and prominent government agencies like the US Department of Homeland Security.

Security specialists have commented that the flaws could damage a site's reputation with the PCI (Payment Card Industry), or with other regulatory agencies. Therefore, Symantec, on learning about the recent XSS blow, is making all efforts to get rid of the vulnerability.

Ultimately, with Symantec also becoming a part of the group of other security companies that malware distributors have penetrated, it becomes evident that the perpetrators are doing everything possible to beat security vendors. Possibly, these perpetrators have established their malicious capability as they have successfully and easily attacked Symantec.

Related article: Sentence for American Contractor for Sabotaging Government Navy Computers

» SPAMfighter News - 4/25/2009