|
 |
|
Shop
You are here: News > News > McAfee not so free from security bugs
| » IT Security NEWS |
| » 05 May 2009 |
| McAfee not so free from security bugs |
| Who said antivirus and Internet security providers are all-powerful? They get hit by bugs too. McAfee's very ownwebsite was targeted by no less than three bugs. These bugs made McAfee's users easy target for various scams, including phishing. As of the moment, at least one of these bugs are still active. The news was announced over 24 hours ago. Paradoxically, the gravest threat targeted McAfee Secure. This resource accredits e-commerce websites based on their security state. Other websites that handle important undertakings are also target customers of Secure. According to Mike Bailey (Skeptikal.org), the McAfee website was attacked by a cross-site request forgery (CSRF). The CSRF may provide the attackers the ability to manage the accounts of McAfee's clients. Although the company has already patched the bug, Bailey noticed that over the five weeks he watched the website, the McAfee Security logo remained glowing in its pages. This observation has elicited dissatisfaction over such guarantee. And why not? McAfee Secure was created to identify exactly these threats. At the same time Bailey's account was told, another weakness on McAfee's website was dug out. This time, it was the website's management of customer rebates that was at risk. Lance James, joint founder of the Secure Science Corporation and author of Phishing Exposed, made a proof-of-concept link to illustrate the way phishers may take advantage of such weakness to design genuine-looking pages that are just like the ones in the real McAfee website. These pages would also contain the McAfee domain name as well as secure sockets layer certificate. With this set-up, the phishers could easily lead users to give their personal details unsuspectingly. |
 |
 |
Awards & Reviews | |||||
|
||||||
|
|
Subscribe to our Mailing List |
|
|
|
|
Customer References | |
|
||
