06 July 2007 | 3,234 views

Apparently 8/10 High Traffic or ‘Big’ Websites are Vulnerable

Prevent Network Security Leaks with Acunetix

It seems after a brief scan that about 80% of sites contain common flaws that allows them to be compromised in some way, most often to create phishing sites, steal data and hijack info about clients.

An amazing 30% contain a serious vulnerability.

Eight out of ten Web sites contain common flaws that can allow attackers to steal customer data, create phishing exploits, or craft a variety of other attacks, a security company reported today.

WhiteHat Security regularly scans hundreds of “very popular, very high-traffic sites” for its online business customers, says Jeremiah Grossman, the company’s founder. “More than likely, you have shopped there, or bank there,” he says. Thirty percent of scanned sites contain an urgent vulnerability, such as one that allows direct access to a company database with customer information, he says.

Two out of three scanned sites have one or more cross-site scripting (XSS) flaws, which take advantage of problems with sites’ programming and are increasingly used in phishing attacks. A recent eBay scam used a now-fixed XSS hole on the auction site to direct anyone who clicked on a phony car auction to a phishing site.

I guess this should be a stern lesson for anyone shopping online or using online facilities from any companies/banks or financial institutions.

About a third of scanned sites are at risk for some sort of information leakage, which often means the providing of programming data about the site that can facilitate an attack. And about one out of four sites allows content spoofing, another potential phishing risk, according to WhiteHat’s vulnerability report.

A type of database vulnerability that allows SQL injection attacks — “one of the nastier issues out there” — is becoming less common, Grossman says. Fewer than one out of five sites contain this type of vulnerability, but a successful incident can give a sophisticated attacker access to everything in a company’s database, he says.

The irony is those geeky sites which hold the least important information about people are usually the most secure, where as the big sites built by important companies often have the most vulnerabilities and are leaking the most important data.

Source: Computer World



Recent in Exploits/Vulnerabilities:
- Sony Pictures Hacked – Employee Details & Movies Leaked
- Gruyere – Learn Web Application Exploits & Defenses
- Critical XSS Flaw Affects WordPress 3.9.2 And Earlier

Related Posts:
- Major Web Vulnerability Effects Yahoo, MSN, Google and More
- Hacking Tor – A Flaw Appears?
- Cyberwar Efforts Step-Up – NASA Sites Hacked

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 228,444 views
- AJAX: Is your application secure enough? - 119,238 views
- eEye Launches 0-Day Exploit Tracker - 85,109 views

Low-cost VPS Hosting

5 Responses to “Apparently 8/10 High Traffic or ‘Big’ Websites are Vulnerable”

  1. Bogwitch 6 July 2007 at 5:32 pm Permalink

    It comes as no suprise that a Whitehat Security is reporting such high figure – it is in their interest to.

    “About a third of scanned sites are at risk for some sort of information leakage, which often means the providing of programming data about the site that can facilitate an attack.” – Isn’t that condoning security through obscurity??

    Fewer than one in five of the high traffic websites are vulnerable to SQL injection attacks? That’s still an incredibly high rate.

    Bogwitch.

  2. CK76 6 July 2007 at 6:30 pm Permalink

    Most information on the internet isn’t secure. SUPRISE!

  3. gyaresu 7 July 2007 at 4:40 am Permalink

    Yeah. It’s like credit card companies paying millions in compensation for scams because the system is essentially flawed and scams still only account for a minor portion of total transactions.
    Where is the incentive to secure your site? I never seem to hear of any repercussions when thousands users data is ‘lost’/stolen etc.

    Just look at the American FBI for how not to spend a stupid amount of money on a computer system.

    There’s really no accountability for high security practices and even then vulnerabilities will always exist.

    It’d be funny if it didn’t potentially effect me.

    /me crosses fingers to avoid identity theft.

  4. Patrick Ogenstad 7 July 2007 at 9:40 am Permalink

    It reminds me of the time when we had all those directory traversal issues in IIS. I once took a phone directory and went through the alphabet for companies offering computer services. Of the companies running IIS more than 80% were vulnerable, of course those were other times. :)

  5. SN 9 July 2007 at 8:01 pm Permalink

    no way … that much traffic.