November 2016 Summaries

Implementing HTTPS is a fundamental step towards enhancing website security, although many websites, such as over 900 Swedish online stores analyzed, often overlook it. HTTPS can be enforced through several methods, such as using an external provider like Cloudflare, which is cost-effective but may not encrypt traffic completely, or through traditional methods requiring the purchase of certificates, which are more compatible with older systems. Let’s Encrypt offers a free, automated certificate solution similar to traditional methods but might not support older infrastructures fully. For optimal security, it is crucial to enforce HTTPS by redirecting HTTP requests to HTTPS using 301 redirects and to implement HTTP Strict Transport Security (HSTS) to prevent attackers from exploiting the initial unencrypted connection. Mixed content issues may arise during the transition to HTTPS, and addressing them is necessary to avoid negative impacts on SEO and accessibility. Additionally, regular certificate renewals and careful configuration, including reviewing the robots.txt file, are essential to maintain secure and functional HTTPS implementation.

Detectify's Security Advisor Frans Rosén discussed online shopping security tips on TV4’s Nyhetsmorgon, highlighting the lack of awareness among consumers about the potential security risks they face, especially with Black Friday approaching. Research conducted by Detectify's security researcher Linus Särud revealed that over 60% of 915 Swedish online stores do not have HTTPS enabled by default, indicating a significant security concern. Throughout November, Detectify has been emphasizing e-commerce security by compiling various guides, research findings, and best practices, encouraging consumers to educate themselves on these issues through their blog series in anticipation of Black Friday shopping.

Online retail has seen significant growth since the inception of the internet, with giants like Amazon and eBay launching in 1995 and making online shopping routine. In Sweden, 85% of the population shopped online last year, but a study of 915 Swedish e-commerce sites revealed only 37% enforce HTTPS by default, indicating a lag in adopting security best practices. Despite e-commerce's reliance on external pages for handling sensitive data, many retailers overlook the necessity of secure configurations, risking consumer trust and business reputation. The ease of intercepting unencrypted data, coupled with the rise of sophisticated attacks like JavaScript-based credit card thefts, highlights the pressing need for improved security measures. While consumers have become more security-conscious, many businesses have yet to prioritize security as a critical aspect of their operations. Adopting robust security not only enhances consumer trust but can also serve as a competitive advantage in an industry where brand reputation is increasingly vital.

Running an online store requires careful attention to security vulnerabilities that can compromise both the business and its customers. Common security issues include price manipulation through intercepted requests, exploiting race conditions in gift card fund transfers, and simple yet effective attacks such as guessing sequentially generated gift card IDs or coupon codes. These vulnerabilities can lead to significant financial losses and operational disruptions. Additionally, attackers may attempt to deduce stock levels to counter competitive strategies, or launch DDoS attacks to incapacitate competitors' sites, diverting customers to their own stores. Stolen credit cards pose another risk, as chargebacks from fraudulent transactions can incur high fees and logistical challenges in retrieving shipped goods. The delicate balance between robust security measures and maintaining a user-friendly experience is crucial for online retailers. To address these concerns, continuous security monitoring services like Detectify offer solutions to identify and mitigate over 700 potential vulnerabilities, helping store owners safeguard their e-commerce platforms effectively.

Detectify has launched a beta phase of its crowdsourced bug bounty program, Detectify Crowdsource, which integrates global independent security researchers to enhance its web application security service. This initiative combines automation with crowdsourcing, allowing researchers to submit security vulnerabilities that are evaluated by Detectify's team before being added to the service, with compensation based on the severity and uniqueness of the findings. The program is facilitated by Bugcrowd, a prominent marketplace for bug bounties, and aims to leverage the expertise of top ethical hackers without requiring them to commit to full-time positions. The approach is designed to keep Detectify's services current and responsive to the fast-evolving cyber threat landscape, as emphasized by Detectify's CEO Rickard Carlsson and Bugcrowd's CEO Casey Ellis. Detectify, founded by leading white hat hackers in 2013, intends to expand its network of researchers gradually to maintain the high quality of its security measures.