Risk
11/24/2010
11:48 AM
Connect Directly
RSS
E-Mail
50%
50%

Consumers Ignore Safe Online Shopping Guidance

Webroot survey finds that 52% of people don't check for an HTTPS connection before making purchases and 23% feel safe when using free, public wireless connections for e-commerce.

How Firesheep Can Hijack Web Sessions
(click image for larger view)
Slideshow: How Firesheep Can Hijack Web Sessions

Know how to shop safe this holiday season. That's the warning from a new study of online shopping habits, which found that 52% of people don't check for an HTTPS connection before making e-commerce purchases, and 50% don't look for the browser padlock icon which indicates that data is being exchanged in encrypted format with websites.

Those findings come from a new survey of more than 2,600 people in Australia, the United Kingdom, and the United States, conducted by ResearchNow for security firm Webroot.

"Through our survey, we learned that one in seven respondents has already become a victim of credit, debit, or PayPal account fraud this year," said Jeff Horne, threat research director at Webroot, in a statement. "In addition, 57% received phishing emails from bogus sources claiming to be a legitimate company -- something we see rise around Black Friday and Cyber Monday," aka the Monday after Thanksgiving.

The Webroot survey study also found regular use of free Wi-Fi for e-commerce purposes. For example, 23% of respondents said they feel safe when using a public wireless connection, and 18% of respondents said they'd likely shop for gifts when logged into free, public Wi-Fi hotspots.

Yet, attackers can sniff sensitive data sent via Wi-Fi hotspots, since many websites -- as well as hotspots -- don't use SSL to fully encrypt all sessions. The risk was highlighted earlier this month by the release of Firesheep, a Firefox extension which automatically sniffs communications between people using the same hotspot and such websites as Amazon.com, unless defensive measures are taken.

On the upside, however, the study found that 52% of consumers only buy from websites which offer some type of trust certification, issued by such outfits as the Better Business Bureau (BBB) and VeriSign. Furthermore, 72% of people use complex passwords that mix letters, numbers, and symbols, and 62% don't save passwords in their browser. But only 37% of people use unique passwords for each password-protected website at which they shop.

When shopping, Webroot recommends never conducting a financial transaction on a website unless it displays "HTTPS" in the address bar. In addition, it said that "on sites where the retailer uses extended SSL validation, look for the address bar to turn green on secured pages."

While researchers have shown that SSL can be bypassed by a determined attacker using a man-in-the-middle attack, and that padlock icons can be faked, security experts say they're still a better-than-nothing indicator of a secure browsing session.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6335
Published: 2014-08-26
The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and ...

CVE-2014-0480
Published: 2014-08-26
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL ...

CVE-2014-0481
Published: 2014-08-26
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a d...

CVE-2014-0482
Published: 2014-08-26
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors relate...

CVE-2014-0483
Published: 2014-08-26
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.