Symantec Online Store Hacked


Recommended Posts

A self-proclaimed grey-hat hacker has located a critical SQL injection vulnerability in a website belonging to security giant Symantec. The flaw can be leveraged to extract a wealth of information from the database including customer and admin login credentials, product serial numbers, and possibly credit card information.

The flaw was found by a Romanian hacker going by the online handle of Unu, according to whom an insecure parameter of a script from the pcd.symantec.com website, allows for a blind SQL injection (SQLi) attack to be performed. In such an attack, the hacker obtains read and/or write permission to the underlying database of the vulnerable website.

During a regular SQLi attack, the result of a rogue SQL query is displayed inside the browser instead of the normal web page output. Meanwhile, in a blind SQL injection, the query executes, but the website continues to display normally, making it much more difficult to extract information.

The content of the pcd.symantec.com website is written in Japanese, but from what we could determine, it serves a product called Norton PC Doctor. Accessing most of the website's sections requires authentication, and in order to exploit the blind SQLi vulnerability, the hacker had to use a few specialized tools. The Web server appears to be running Windows Server 2000 as operating system, Microsoft IIS 6.0 with ASP support and Microsoft SQL Server 2002 as database back-end.

From the screen shots released by Unu there are many potentially interesting databases, but the one he chose to look at is called "symantecstore." One of the tables in this database is named "PaymentInformationInfo" and contains columns such as BillingAddress, CardExpirationMonth, CardExpirationYear, CardNumber, CardType, CcIssueCode, CustomerEmail, CustomerFirstName, CustomerLastName or SecurityIndicator.

Unu claims that his interest is only to point out security issues and not misuse any data. Therefore, according to him, he did not attempt to extract any information from this table. Instead, he focused on another one called TB_MEMBER, which contains 70,356 records.

For demonstration purposes, he extracted 6 of these entries at random, revealing customer names and login credentials with the passwords stored in plain text; a major security oversight. The hacker also notes that passwords for the accounts in a different table called TB_EMPLOYEE are also stored in a similar insecure way.

More information on Softpedia

Link to comment
https://www.neowin.net/forum/topic/848672-symantec-online-store-hacked/
Share on other sites

Romanian? Nice...

Windows 2000 & SQL 2002? You've got to be kidding me... :blink:

L.E.: Unu hacked allready 'Bitdefender', 'kaspersky', and 'Linden Lab's second life' websites back in february...

It seems that a lot of websites have SQL injection vulnerabilities.

But it's sad that a security company get to be hacked... Security is gone, now it's just company! :p

Edited by MafiotuL

Symantec also offer high quality security-oriented solutions for the business user and personal user alike! :woot:

LOL @ using products with not even critical patch support from Microsoft on production servers. There's a fine line between being economic and stupid. Symantec crossed that line.

It does seem odd for a big company like Symantec that they are using Windows 2000 and SQL Server 2002...that is kinda old software, but it doesn't surprise me, I still see alot of companies using Windows 2000 server. The minimum I would use is 2003 these days (2008 for new installs w/o compatibility issues), but meh...their decision for whatever (or no) reason. :)

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Will be surprised if there isn't a new ver of youtube just for labelled educational content
    • UK to ban under-16s from social media following a six-week trial with teenagers by Paul Hill Credit: Pexels A few months ago, Neowin reported that the UK was trialing a social media ban with 300 teenagers for six weeks, that testing has come to an end, and Prime Minister Keir Starmer has announced that the country will ban under-16s from social media. Starmer said that this technology is making children unhappy and making it easier for bullies to harass and abuse them. He continued to talk about the addictive nature of social media, saying that it uses an infinite scroll designed to lock users in for hours. He said this interferes with children doing their homework, reading, playing with friends outside, and going to bed on time. Tackling the idea that nothing can be done about social media, Starmer said: The government’s action won’t stop at social media either, the PM said. It plans to take action on gaming services and livestreaming platforms. Right now, he said, strangers can contact any child unchecked. He said this wouldn’t happen in real life, and the government is going to stop it from happening online, too. The Labour government has overseen the introduction of the Online Safety Act, a big change to the internet which includes age verification on adult websites. This has led to a fair bit of backlash, but overall, the government is pushing ahead with these changes.
    • Still using Hexchat every day but i would not consider it Retro 😛
    • HONOR Robot Phone unveils first Cinematic Video at Shanghai International Film Festival by Steven Parker Global AI device ecosystem company HONOR announced on June 13 that its revolutionary HONOR Robot Phone made its professional imaging debut at the 28th Shanghai International Film Festival (SIFF), demonstrating the result of its mobile videography capabilities for the first time. As the official mobile photography and videography partner of the 28th Shanghai International Film Festival, HONOR empowers this premier cinematic event with cutting-edge mobile imaging technology. Marking the global debut of the first cinematic video it captured, Robot Phone breaks down the boundaries between mobile imaging and professional filmmaking, ushering in a new paradigm for the deep integration of technology and cinematic art. In the video published on HONOR’s official channel (above), Robot Phone was used byELLEMEN to capture cinematic video portraits for the SIFF jury members. With its exceptional stability and cinema-grade imaging capabilities, the device redefines the art of portrait filmmaking, faithfully reproducing the rich tonal gradations and nuanced color transitions associated with film photography. The result is a new level of visual sophistication, creating high-end cinematic imagery that seamlessly blends atmosphere with narrative tension. The video released for the Robot Phone showcases the powerful stabilization capabilities of its built-in gimbal system, delivering exceptionally smooth handheld camera movement while preserving full image quality. By minimizing reliance on electronic image stabilization, the device effectively avoids the image cropping and quality loss typically associated with digital stabilization methods. Representing an innovative leap in form factor, the HONOR Robot Phone features the industry's smallest titanium alloy gimbal, delivering ultra-precision, extreme flexibility, and superior stability. Driven by high-performance motors, the gimbal rises dynamically, breaking free from the physical limitations of traditional camera modules. Combined with advanced AI algorithms that enable intelligent object tracking and various movements with stable shots, the device significantly simplifies video creation and reshapes both the equipment choices and creative habits of modern users. Notably, the Robot Phone will be the first product that features the results of HONOR's strategic technological partnership with ARRI, the world-renowned designer and manufacturer of professional camera technology for cinematic storytelling. From Cannes to Shanghai, the HONOR Robot Phone continues to lead the mobile imaging industry into an entirely new stage of development. Moving forward, HONOR will leverage cutting-edge AI and mobile imaging technologies to unlock new creative possibilities and extend cinematic standards for visual expression from the world of high-end filmmaking to the next generation of content creators. Learn more about the HONOR Robot Phone here: https://www.honor.com/global/events/honor-robot-phone/
    • I'll wait for the root cause analysis. Looks like it's HP, Lenova, and certain configurations that are askew, hardly "all of windows." Time will tell.
  • Recent Achievements

    • Week One Done
      Jeroen Wilms earned a badge
      Week One Done
    • Week One Done
      rolfus earned a badge
      Week One Done
    • One Month Later
      Leroy Jethro Gibbs earned a badge
      One Month Later
    • Conversation Starter
      flexorcist earned a badge
      Conversation Starter
    • One Month Later
      AndreaB earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      510
    2. 2
      +Edouard
      200
    3. 3
      PsYcHoKiLLa
      137
    4. 4
      ATLien_0
      90
    5. 5
      Steven P.
      84
  • Tell a friend

    Love Neowin? Tell a friend!