Eight out of ten websites contain flaws that can allow attackers to steal customer data, create phishing exploits, or craft a variety of other attacks, a security company said.
WhiteHat Security regularly scans hundreds of "very popular, very high-traffic sites" for its online business customers, said Jeremiah Grossman, the company's founder. "More than likely, you have shopped there, or bank there," he said. Thirty percent of scanned sites contain an urgent vulnerability, such as one that allows direct access to a company database with customer information, he said.
Two out of three scanned sites have one or more cross-site scripting (XSS) flaws, which take advantage of problems with sites' programming and are increasingly used in phishing attacks. A recent eBay scam used a now-fixed XSS hole on the auction site to direct anyone who clicked on a phony car auction to a phishing site.
About a third of scanned sites are at risk for some sort of information leakage, which often means the providing of programming data about the site that can facilitate an attack. And about one out of four sites allows content spoofing, another phishing risk, according to WhiteHat's vulnerability report.
A type of database vulnerability that allows SQL injection attacks - "one of the nastier issues out there" - is becoming less common, Grossman said. Fewer than one out of five sites contain this type of vulnerability, but a successful incident can give a sophisticated attacker access to everything in a company's database, he said.
WhiteHat's report echoes an increasingly common theme, says Ken Dunham, director of VeriSign's iDefense rapid response team. "Web-based attacks are some of the most prevalent attacks in the last two years," he said.
Like any type of software, as web programming grows more sophisticated and complex, allowing for desktop-like “Web 2.0” applications, it also becomes more vulnerable. With Ajax , a common Web 2.0 type of programming, "you can have CSS taking place on a more invisible layer, behind the scenes," Dunham said.
The good news is that site vulnerabilities can be fixed in one central spot, in contrast to desktop software flaws, which persist until every user of the affected software updates it with a fix. And companies are becoming more nimble at identifying and closing risks that can cost them customers, Grossman says.
WhiteHat's report, which is available for download (with site registration), is based on scans performed between 1 January 2006, and 1 March, 2007. The company scans those areas of websites reached after a customer logs in.