IT Jobs
Seven reasons websites are not secure
Many sites you visit are laden with malware. Here is advice on how to protect your systems.
By Bill Brenner | CSO
Published: 15:59 GMT, 14 September 09
Conventional wisdom is that Web wanderers are safe as long as they avoid sites that serve up pornography, stock tips, games and the like. But according to recently gathered research from security firm Sophos, sites we take for granted are not as secure as they appear.
Among the findings in Sophos' threat report for the first six months of this year, 23,500 new infected Web pages - one every 3.6 seconds - were detected each day during that period. That's four times worse than the same period last year, said Richard Wang, who manages the Boston lab. Many such infections were found on legitimate websites.
In a recent interview with Techworld sister publication CSOonline, Wang outlined seven primary reasons legitimate sites are becoming more dangerous.
1. Polluted ads
Many legitimate sites rely on paid advertisements to pay the bills. But Wang said recent infection statistics gathered by his lab show that they are often hiding malware, without the knowledge of the website owner or the user.
"A lot of sites supported by advertisers, rather than contracting directly with the advertiser, work through ad agencies and network affiliates," Wang said. "Some of these affiliates are less than diligent in reviewing content for flaws and infections."
Ads that incorporate Flash animation and other rich media are often rife with security holes attackers can exploit. When the user clicks on the ad, the browser can be (and often is) redirected to sites that download malware in the background while the user is reading the legitimate site. Someone in the ad-providing supply chain can be the culprit, though tracing a compromise back to them can be exceedingly difficult, Wang said.
Whatever the case may be, a downloaded Trojan is then free to gather up usernames, passwords and other sensitive banking data.
2. SQL injection attacks
SQL injection attacks are among the most popular of tactics and have been used in several high-profile incidents in the last couple of years.
SQL injection is a technique that exploits a flaw in the coding of a Web application or page that uses input forms. A hacker might, for example, input SQL code into a field that is intended to collect email addresses. If the application doesn't include a security requirement to validate that the input is of the correct form, the server may execute the SQL command, allowing the hacker to gain control of the server.
"The hacker essentially takes advantage of flaws related to shoddy site development," Wang said.
3. User-provided content
It doesn't take a genius to write a comment to a blog posting or something they see on a social networking site like Facebook or Twitter. The bad guys know this and are therefore taking the opportunity to pollute discussion threads and other sources of user-supplied content with spam-laden links.
Add your commentComments