Story image

42% of Alexa-ranked websites are open invites for attackers

07 Feb 18

Many of the internet’s supposedly safe websites could actually be a breeding ground for risk – or at least that’s what Menlo Security’s third annual State of the Web report says.

Of the 100,000 top websites on the web as ranked by Alexa, 42% of those either use software that leaves them wide open to attack, or they are already compromised.

Many of those vulnerabilities are due to background sites that present online media such as video clips and online ads. The average website connects to 25 background sites for this content, Menlo Security says.

The company believes that most security administrators don’t have the resources or tools to monitor these connections, which leaves them vulnerable to backdoor attacks.

“This report confirms what most CISOs already know: that a false sense of security is a dangerous thing when using the web,” comments Menlo Security CEO Amir Ben-Efraim.

 “Despite website operators' best efforts, cyber-criminals can now exploit widespread vulnerabilities to compromise even the most trusted brands on the web." 

Sorting sites into ‘good’ or ‘bad’ sites doesn’t necessarily work, particularly as hackers are using trusted hosting services to set up genuine-looking phishing sites with safe-looking URLs.

The report found that 4600 phishing sites used legitimate hosting services and many ‘typosquatters’ formed in trusted categories such as financial services.

Typosquatting is the method of setting up fake domains that look similar to a company’s actual website, for example yaoo.com appears to look like yahoo.com.

“To prepare this report, we tracked the web activity of our users over a 30-day period. During that time, we saw traffic to 78 malicious sites that had been misspelled to deceive people trying to visit Alexa’s top 1,000 domains,” the report says.

It also says that business and economy sites received more than their fair share of risky activity last year. They hosted more phishing sites than any other category and experienced the most security incidents in the last 12 months. 12,307 business and economy sites had been used as attack vectors or malware delivery systems.

Menlo Security also analysed the script origin servers for both primary and background sites, and correlate known CVE vulnerabilities. The company found that more than 32,649 sites use Microsoft IIS 7.5, which was released in 2009.

Those results suggest that organisations are using aging software technologies to run their websites – technologies that may have been compromised multiple times since they were released.

“Many sites use software that is no longer fully supported. Microsoft’s Internet Information Services (IIS) 5 was released in 2000, and reached mainstream support end” in 2005, the report indicates.

Menlo Security says organisations must have a ‘healthy distrust' for the web.

“Website owners need to make sure their servers run the latest software updates, and should investigate technologies such as Content-Security-Policy (CSP), which can reduce introduction of malicious code via background sites.”

Can you spot the phish? Google's quiz puts you to the test
The quiz may not be as clear-cut as you think - but that's exactly why you should do it.
London coworking space teams with Global Cyber Alliance
A London-based coworking space is about to become a major cybersecurity innovation hub and a primary UK landing pad for security challenge winners.
Comms providers hit by most DDoS attacks in Q3 2018
New data indicates attackers preyed on the large attack surface of ASN-level communications service providers with a ‘bit-and-piece’ approach.
Check Point launches hyperscale network security solution
With Check Point Maestro, organisations can scale up their existing Check Point security gateways on demand.
Should AI technology determine the necessity for cyber attack responses?
Fujitsu has developed an AI that supposedly automatically determines whether action needs to be taken in response to a cyber attack.
Trend Micro’s telecom security solution certified as VMware-ready
Certification by VMware allows communications service providers who prefer or have already adopted VMware vCloud NFV to add network security services from Trend Micro.
Frost & Sullivan honours Honeywell's IIoT value creation
Frost & Sullivan has awarded Honeywell with the 2018 Global Customer Value Leadership Award for its work protecting industrial internet of things (IIoT) customers.
Top cybersecurity threats of 2019 – Carbon Black
Carbon Black chief cybersecurity officer Tom Kellermann combines his thoughts with those of Carbon Black's threat analysts and security strategists.