Hacker site claims breach of third security firm Web site in a week

A Romanian hacker site said on Wednesday it was able to breach the Web site of Helsinki-based security firm F-Secure just as it had gained access to the sites of two other security companies earlier in the week.

F-Secure is "vulnerable to SQL Injection plus Cross Site Scripting," an entry on the HackersBlog site said. "Fortunately, F-Secure doesn't leak sensitive data, just some statistics regarding past virus activity."

An F-Secure spokesman said the company had taken the affected server down and that it was a low-level server that was not critical to the company and had no sensitive or customer data on it, just statistical data for marketing purposes.

"It is slightly embarrassing as a security company that we have had the breach," David Frazer, a spokesman in F-Secure's San Jose, California office, said in a phone interview. "We certainly, as a security company, want to ensure that all of our servers are patched to the levels that they should be."

HackersBlog publicized on its site that it had breached the U.S. Web site of Moscow-based firm Kaspersky on Saturday and the Portugal site of BitDefender on Monday using the same attack techniques.

Kaspersky said on Monday that no sensitive or customer data had been exposed in the breach and that it would ask a database expert to audit its systems. BitDefender said the site that had been breached belonged to an unnamed partner and no customer data was stolen.

SQL injection attacks, in which a small malicious script is inserted into a database that feeds information to the Web site, have become very popular exploit methods. Cross-site scripting vulnerabilities, which allow for injection of malicious code in Web pages, also are common.

Updated 3:25 p.m. PST with F-Secure comment.

[gggg sssss]

and I doubt f-Secure was running the dreaded MS SQL server, so how can that be?

[ajhoughton]

SQL injection attacks aren't specific to SQL Server. They happen when people pass un-checked input through to the SQL side without escaping special characters.

[n3td3v]

F-Insecure

[Noneyabeeswax]

This really isn't funny, but it is.

I guess Microsoft isn't the only one with problems, heh.

I wonder what kind of effect this will have on their sales numbers?

I know I'd certainly think twice about buying security software from a vendor that can't even keep their website secure.

I wonder who's next, or if the other vendors started scrambling to double check everything?

[random truth]

How does this relate to Microsoft?

[sn0rf]

Apparently these guys don't know how to assess the security risks properly. Even if there's no sensitive data on their sites, such incidents can hurt their brands significantly. That's why it's weird that they don't have at least simple application firewall installed.

[DevSensible]

Firewalls have little if nothing to do with SQL Injections. This was done against a public-facing website. The injection was done via the query string and the input was not escaped/cleansed.