A Romanian hacker site said on Wednesday it was able to breach the Web site of Helsinki-based security firm F-Secure just as it had gained access to the sites of two other security companies earlier in the week.
F-Secure is "vulnerable to SQL Injection plus Cross Site Scripting," an entry on the HackersBlog site said. "Fortunately, F-Secure doesn't leak sensitive data, just some statistics regarding past virus activity."
A spokesperson for F-Secure in the United States did not immediately return a call seeking comment.
HackersBlog publicized on its site that it had breached the U.S. Web site of Moscow-based firm Kaspersky last week and the Portugal site of BitDefender on Monday using the same attack techniques.
Kaspersky said on Monday that no sensitive or customer data had been exposed in the breach and that it would ask a database expert to audit its systems. BitDefender said the site that had been breached belonged to an unnamed partner and no customer data was stolen.
SQL injection attacks, in which a small malicious script is inserted into a database that feeds information to the Web site, have become very popular exploit methods. Cross-site scripting vulnerabilities, which allow for injection of malicious code in Web pages, also are common.
This article was first published as a blog post on CNET News.
Play video
There are currently no comments for this post.