Slashdot Mirror
McAfee's Website Full of Security Holes
Julie188 writes "The McAfee.com website is full of security mistakes that could lead to cross-site scripting and other attacks, researchers said in a post on the Full Disclosure site on Monday. The holes with the site were found by the YGN Ethical Hacker Group, and reported to McAfee on Feb. 10, YGN says, before they were publicly disclosed to the security/hacking mailing list. Embarrassing? Yes, especially given that the company aggressively markets its own McAfee Secure service that is supposed to assure consumers that McAfee has scanned a website and found it to be safe."
Eat it!
I've abandoned my search for truth; now I'm just looking for some useful delusions.
McAfee and Norton. Are these not the two worst software companies?
I'm not anti-social, I'm anti-idiot.
These are all minor security problems... some of which are so minor one could debate whether they should even be classified as security problems at all. Really, this is much ado about little. Any big website will have things like this. Even security experts make mistakes, and most of the staff at McAfee, as with all other big companies, aren't security experts.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
it seems to me that intel has their stuff together on most things (market domination, monopolistic practices, aggressive vendor bullying, and making decent chips once in a while)
i never cared for mcafee's products, but i thought about giving them another shot: if intel thinks it's worth money, maybe it is, right?
yet every time i hear the name it's something bad. it was just last year that the false-positive on svchost.exe took down hospitals, schools, and even a few thousand of intel's own PCs that were still running WinXP.
what is intel thinking, putting so much money into mcafee? what do they know that we don't?
Those 'holes' are intentionally left there. They are for demo purposes as McAfee needs to constantly improve their product. Trust me.
They learn a lot from what users good intentioned and bad do via their site.
McAfee markets products to scan websites. At least use them on your own site!
If the scans didn't turn up the vulnerabilities ... well it looks like you have a problem with your products.
If anyone has followed IT for these years they've learned how to sell protection. But where's the money in not?
Don't worry, I checked and the site is McAfee SECURE CERTIFIED
https://www.mcafeesecure.com/RatingVerify?ref=www.mcafee.com
EA David Gardner -"... but the consumers have proven that actually what they want is fun."
What this suggests is even supposedly safe pages/sites aren't always. if you have script blockers in your browser, for example NoScript in Mozilla firefox
then revoke permissions for this and other sites that are reported as dangerous.
@Nice: Norton frequently fell on their own swords at a local level when I had it installed on my laptop.... iy didn't even recognise not to block its own programs from working/connecting online for updates. #fail
...for the ritual shooting of the messenger.
the company aggressively markets its own McAfee Secure service that is supposed to assure consumers that McAfee has scanned a website and found it to be safe
There is a difference between whether a website is vulnerable to attacks and whether it's unsafe to view. If I'm going to open a page in my browser, I care whether or not the page is fact dangerous to view at that point in time, not whether it could potentially be made dangerous.
This is not to say I don't give a damn about XSS vulnerabilities and the like. It's simply a different (albeit related) topic.
Back about ten years ago, you used to be able to log into McAfee's FTP server and download their latest for-pay products. IIRC the username was something like "mcafee" and the password was "321". My former boss was a warez puppy and I gather this was commonly known on the scene.
Hail Eris, full of mischief...
E pluribus sanguinem
How do you know the McAfee home page is not one giant honeypot? After all they know hackers will be going after them. That's what I'd do if I were them...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
In hockey, the goaltender will intentionally "show" a spot as open, usually the five hole (the space between the legs). The player with the puck, seeing this, will often shoot for the five hole, only to have the prepared goalie close the five hole and stop the puck.
McAfee being what it is, could it be that they are "showing" these security holes in an attempt to goad the black hats into trying their latest tricks and toys on McAfee, who could in turn use that data to reenforce their protection software?
http://www.cgisecurity.com/xss-faq.html
About 5 years ago, I contributed to a paper that brought up a particularly brain-dead thing they did with the auto-update mechanism for their then-current consumer version of VirusScan:
http://www.usenix.org/events/hotsec06/tech/full_papers/bellissimo/bellissimo.pdf
Long story short -- their ActiveX control exported a wrapper around the Win32 ShellExecute API. What could possibly go wrong? The XSS thing in their help here seems to be of the same "do the simplest thing, damn the consequences" variety; it looks like they've tried to patch the XSS issue but it's pretty weak sauce. Hint to McAfee: Did you know most browsers will load "HTTP://example.com" as readily as "http://example.com"?
McAfee's business model has been "security through rendering your computer nearly inoperative" for over a decade now, anyway. Just wait until the website gets pwned and stops working, and it will have been successfully "protected".
...but I love the smell of irony in the morning...afternoon...whatever.
It kinda reminds me of that NOMEX factory that burned down...well, isn't that odd. I remember hearing about that at a safety meeting a couple of years ago, but now I can't find any links to post, none at all...was it all a dream? A deliciously ironic dream?
(I could only wish my dreams were more exciting than creating my own safety meetings in my head...*sigh*)
"I love animals! Some are cute, others are tasty, what's not to like?" - Betsy Schroeder, Jeopardy contestant
This is news? McAfee hasn't been secure or even any good at anti-virus since... like... the DOS days. If they ever were. Wern't they the ones who put out a DOS anti-virus kit? Or am I thinking of someone else? If it's someone else, then McAfee has always sucked.
This doesn't surprise me in the least. The latest McAfee virus scanners run with very high privileges, but don't turn on such basic protections as NXCOMPAT (the no execute bit) and ASLR (Address Space Layout Randomization). These protections are very cheap to enable, and make vulnerabilities much harder to exploit.
Not surprising since McAfee software is a joke, and so is Norton.
Embarrassing? Yes, especially given that the company aggressively markets its own McAfee Secure service that is supposed to assure consumers that McAfee has scanned a website and found it to be safe.
HBGary, is that you?
I'm not sure how you people live with this crap.. I get customers all the time whose prophylactic safety net has malfunctioned on them, leaving them without access to the web, or their email.. Yes, I guess not being able to surf and check your email is possibly the safest route for them anyway.. So now you got these dudes looking for problems that will make the next version of funware better, and more complicated, and prone to creating people who can't figure out how come they can't get to Facebook.. The whole security industry is a self perpetuating nightmare... So how do I live with it ? .. I live with it, but taking a chance that someday these hackers will waste their time on trying to make my unpopular OS the same living hell that the users of the popular OS's enjoy.. Someday, they'll get around to us.. but till we become "worth their time", I guess I just have to live with it.
waiting for ad.doubleclick.net
Ahahahah Server not Found
That only took a few Hours ^_^
...rot in hell McAfee.. after putting up with your crapware TPS at work all day.. f*ck you and f*ck your TPS garbage!
Don't tailgate - the end is near!
Sorry, with this last one I hope they go bankrupt....you should be held accountable for your actions, and when you say you are about security, and you do not do the work on your own website...i think it should bring their end. MHO