December 2015 Summaries

In 2015, a vulnerability scanner identified over 2 million vulnerabilities across more than 20,000 websites worldwide, revealing that the number and severity of vulnerabilities often correlate with the website's size and various factors. Vulnerabilities are categorized by severity using the Common Vulnerability Scoring System (CVSS), with red indicating critical issues (CVSS score ≥ 6), yellow for medium severity (CVSS score between 3 and 6), and blue for low severity (CVSS score between 0 and 3). Initial scans typically reveal a prevalence of medium and low-severity vulnerabilities, such as Missing DNSSEC and SSL BEAST, while more severe vulnerabilities like Login Cross Site Request Forgery (CSRF/XSRF) appear less frequently but remain critical. Over time, the composition of vulnerabilities changes, yet certain critical vulnerabilities, including Email Spoofing, Web Server Vulnerabilities, and Cross Site Scripting, persist as significant threats. The analysis aims to provide insights into common website vulnerabilities to aid in addressing potential security weaknesses effectively.

Cross-site scripting (XSS) is a prevalent security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users, compromising user data such as cookies, session IDs, and private messages. This vulnerability ranks high on the OWASP Top 10 and is frequently reported on the Detectify Crowdsource platform. A notable example of an XSS attack was the Tweetdeck XSS worm in 2014, which spread through Twitter, compromising numerous accounts. XSS attacks often involve injecting scripts via user input fields, such as search boxes, which, if not properly validated, can lead to unauthorized data access and privilege escalation. Remediation strategies include converting user input to HTML entities, URL encoding, and using safe functions like innerText instead of innerHTML to prevent script execution. Detectify offers a web security scanner that automatically tests for XSS among over 1000 other vulnerabilities, providing a comprehensive solution for identifying and mitigating security risks on websites.

In the past year, several major security breaches have significantly impacted both individuals and organizations, highlighting vulnerabilities in data privacy and digital security practices. Notable incidents include the Ashley Madison hack, where 32 million users' data was leaked due to unethical site practices, and the unauthorized tracking by Google Chrome Extensions which led to changes in their default settings. Additionally, Let's Encrypt gained trust across major browsers, promoting HTTPS as the standard for website security. The CIA Director's personal email was compromised, exposing sensitive national security information, while the Patreon and Experian breaches revealed millions of records, with the former involving a specific vulnerability in the Werkzeug Debugger. The VTech hack exposed personal details of millions of users, including children, underscoring the risks of digital data storage. These events emphasize the ongoing need for enhanced cybersecurity measures and awareness.