Viruses/Worms News

Six AV vendor websites open to XSS attacks

Wednesday, May 13, 2009

A hacker with the handle Methodman has posted proof of concept of cross-site scripting (XSS) exploits on the websites of six major anti-virus vendors, including some of the biggest names in the web security business.

Methodman, a member of a group called Team Elite, pointed out on that group's website that some of these companies have run into similar vulnerabilities before.

"We have found several bugs in the past few months, always on the same websites," Methodman wrote. "So now still vulnerable and people still under threat? no doubt!"

Security experts said these companies, who sell products to protect websites from the same type of attacks, should do a better job of fixing the holes - if no other reason than to protect their brands.

Many security vulnerabilities are introduced by software not doing proper input checking of online forms, which can be exploited through code injection or XSS.

In the case of one major security firm, security experts found an online form that allowed users to enter HTML characters such as quotation marks, less than and greater than symbols in fields expecting only numerical input.