Risk
11/24/2010
11:48 AM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Consumers Ignore Safe Online Shopping Guidance

Webroot survey finds that 52% of people don't check for an HTTPS connection before making purchases and 23% feel safe when using free, public wireless connections for e-commerce.

How Firesheep Can Hijack Web Sessions
(click image for larger view)
Slideshow: How Firesheep Can Hijack Web Sessions

Know how to shop safe this holiday season. That's the warning from a new study of online shopping habits, which found that 52% of people don't check for an HTTPS connection before making e-commerce purchases, and 50% don't look for the browser padlock icon which indicates that data is being exchanged in encrypted format with websites.

Those findings come from a new survey of more than 2,600 people in Australia, the United Kingdom, and the United States, conducted by ResearchNow for security firm Webroot.

"Through our survey, we learned that one in seven respondents has already become a victim of credit, debit, or PayPal account fraud this year," said Jeff Horne, threat research director at Webroot, in a statement. "In addition, 57% received phishing emails from bogus sources claiming to be a legitimate company -- something we see rise around Black Friday and Cyber Monday," aka the Monday after Thanksgiving.

The Webroot survey study also found regular use of free Wi-Fi for e-commerce purposes. For example, 23% of respondents said they feel safe when using a public wireless connection, and 18% of respondents said they'd likely shop for gifts when logged into free, public Wi-Fi hotspots.

Yet, attackers can sniff sensitive data sent via Wi-Fi hotspots, since many websites -- as well as hotspots -- don't use SSL to fully encrypt all sessions. The risk was highlighted earlier this month by the release of Firesheep, a Firefox extension which automatically sniffs communications between people using the same hotspot and such websites as Amazon.com, unless defensive measures are taken.

On the upside, however, the study found that 52% of consumers only buy from websites which offer some type of trust certification, issued by such outfits as the Better Business Bureau (BBB) and VeriSign. Furthermore, 72% of people use complex passwords that mix letters, numbers, and symbols, and 62% don't save passwords in their browser. But only 37% of people use unique passwords for each password-protected website at which they shop.

When shopping, Webroot recommends never conducting a financial transaction on a website unless it displays "HTTPS" in the address bar. In addition, it said that "on sites where the retailer uses extended SSL validation, look for the address bar to turn green on secured pages."

While researchers have shown that SSL can be bypassed by a determined attacker using a man-in-the-middle attack, and that padlock icons can be faked, security experts say they're still a better-than-nothing indicator of a secure browsing session.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web