Multiple Vulnerabilities in BitDefender website

Multiple Vulnerabilities in BitDefender website
A Security Researcher from crackhackforum.com, Rynaldo, has discovered multiple Vulnerabilities in one of the Biggest Antivirus company called "BitDefender".

The researcher claimed that he sent several emails to BitDenfender's team, butthey haven't responded nor fixed the vulnerabilities neither.

"The website is having several reflected XXS vulnerabilities and the CSRF
vulnerability. Also I have found a way to cause DOS attack on the local
server to take BitDefender temporarely down." Rynaldo said.

CSRF attack : https://my.bitdefender.com/en_us/my/#page=account.index hacker is able to perform CSRF attack to change the details on the user's profile.CSRF tokens aren't implemented and password isn't required to change information on the profile.

http://www.ehackingnews.com/2013/01/multiple-vulnerabilities-in-bitdefender.html

 

Hmm..yesterday I was to resgister for an account in "MyBitDefender" and it could not push through. Then I wanted to register for the BitDefender forum but I could not also. It was a first attempt to try out BitDefender IS 2013 before taking the plunge. Even the update was taking too long for a 2mbps connection. I could not update to the 174mb first update. At around 10+mb it stops and then restarts. Restarted around 4x. After 6 hours, I gave up and reverted to a previous image with Avast IS. Definitely there's something going on there at the site.

 

Wondering how Bitdefender can protect us consumers when they can't protect their own website? Really disappointing.

 

Chances are the ones behind the product development aren't the same ones behind website development...

 

Chances are that the website development was done by an entirely different company.

 

I'll just copy here what myBD engineers told me:

"We released an update on Monday (4 Feb 2013) that fixes the XSS issues on the website. Without XSS it is not possible to conduct a CSRF attack on MyBitdefender as the attacker cannot get the authentication token and it is not read server side from the cookies.

Thank you for the warning and we assure you that we are focused on the security of the MyBitdefender portal and our users' private data."