Holes in McAfee...

May 2009

McAfee blasted for having holes in its Web sites. Security vulnerabilities on McAfee sites, including one designed to scan customers’ sites for flaws, exposed certain customer accounts and could have been used for phishing attacks in which malware disguised as McAfee software could be distributed, security experts say. McAfee said on April 5 that most of the vulnerabilities were fixed, except for one part of the Web site that was taken offline to be fixed. The McAfee sites were found to be vulnerable to cross-site scripting (XSS) attacks and cross-site request forgery attacks that could lead to phishing attacks on customers who think they are visiting the security vendor’s site, according to an article on ReadWriteWeb. Ironically, one of the vulnerable sites was McAfee Secure, which scans customer sites to determine if they are vulnerable to such attacks. The problem would signal that either McAfee does not run McAfee Secure across all of its own sites or the product does not work well, the report said. To fall victim to a cross-site request forgery attack on that site, targets would have to be logged into their McAfee accounts and browse to a malicious Web site that exploits the vulnerability, according to the Risky.biz site. Such attacks on sites of antivirus vendors are particularly dangerous because they enable attackers to create fake versions of security products that install Trojans or other malware and customers will trust it, the co-founder of Secure Science Corporation told ReadWriteWeb.