WhiteHat: 90 percent of websites vulnerable to attack

Share this article:
Nine out of 10 websites have vulnerabilities open to attack, according to a new report by WhiteHat Security.

Cross-site scripting (XSS) is the No. 1 class of vulnerability, impacting three-quarters of websites, according to the company's third WhiteHat Website Security Statistics Report.

New techniques such as XSS-phishing, intranet hacking and web worms may force enterprises to re-evaluate the viability of XSS on a case-by-case basis, the company said.

The report also features a comparison of vulnerabilities across vertical markets, including the retail, health care, financial services, IT and insurance industries. While web security remains generally weak, the retail sector has performed better than other markets, according to WhiteHat.

Since the company's April report, it has seen a "noticeable increase" in XSS, information leaks, SQL injections and HTTP response splitting. The company attributes the increase to the discovery of new attack techniques and improvements in vulnerability-identification technology.

HTTP response splitting has been “a misunderstood and underestimated issue, evading most scanning technology since its discovery several years ago,” WhiteHat said in a statement. This form of web application vulnerability, caused by the failure of the application or its environment to properly sanitize input values, can be used to perform XSS attacks, cross-user defacement, web cache poisoning and other attacks.

WhiteHat called the results "startling both in the prevalence and potential consequences of HTTP response splitting exploits."

“Statistics continue to reveal recurring and emerging issues that are affecting websites across industries," said Jeremiah Grossman, WhiteHat founder and chief technology officer.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

CryptoWall surpasses CryptoLocker in infection rates

CryptoWall surpasses CryptoLocker in infection rates

A threat analysis from Dell SecureWorks CTU says that CryptoWall has picked up where its famous sibling left off.

Professor says Google search, not hacking, yielded medical info

Professor says Google search, not hacking, yielded medical ...

A professor of ethical hacking at City College San Francisco came forward to clarify that he did not demonstrate hacking a medical center's server in a class.

Syrian Malware Team makes use of enhanced BlackWorm RAT

Syrian Malware Team makes use of enhanced BlackWorm ...

FireEye analyzed the hacking group's use of the malware, dubbed the "Dark Edition" of BlackWorm.