Risk

11/24/2010
11:48 AM
50%
50%

Consumers Ignore Safe Online Shopping Guidance

Webroot survey finds that 52% of people don't check for an HTTPS connection before making purchases and 23% feel safe when using free, public wireless connections for e-commerce.

How Firesheep Can Hijack Web Sessions
(click image for larger view)
Slideshow: How Firesheep Can Hijack Web Sessions

Know how to shop safe this holiday season. That's the warning from a new study of online shopping habits, which found that 52% of people don't check for an HTTPS connection before making e-commerce purchases, and 50% don't look for the browser padlock icon which indicates that data is being exchanged in encrypted format with websites.

Those findings come from a new survey of more than 2,600 people in Australia, the United Kingdom, and the United States, conducted by ResearchNow for security firm Webroot.

"Through our survey, we learned that one in seven respondents has already become a victim of credit, debit, or PayPal account fraud this year," said Jeff Horne, threat research director at Webroot, in a statement. "In addition, 57% received phishing emails from bogus sources claiming to be a legitimate company -- something we see rise around Black Friday and Cyber Monday," aka the Monday after Thanksgiving.

The Webroot survey study also found regular use of free Wi-Fi for e-commerce purposes. For example, 23% of respondents said they feel safe when using a public wireless connection, and 18% of respondents said they'd likely shop for gifts when logged into free, public Wi-Fi hotspots.

Yet, attackers can sniff sensitive data sent via Wi-Fi hotspots, since many websites -- as well as hotspots -- don't use SSL to fully encrypt all sessions. The risk was highlighted earlier this month by the release of Firesheep, a Firefox extension which automatically sniffs communications between people using the same hotspot and such websites as Amazon.com, unless defensive measures are taken.

On the upside, however, the study found that 52% of consumers only buy from websites which offer some type of trust certification, issued by such outfits as the Better Business Bureau (BBB) and VeriSign. Furthermore, 72% of people use complex passwords that mix letters, numbers, and symbols, and 62% don't save passwords in their browser. But only 37% of people use unique passwords for each password-protected website at which they shop.

When shopping, Webroot recommends never conducting a financial transaction on a website unless it displays "HTTPS" in the address bar. In addition, it said that "on sites where the retailer uses extended SSL validation, look for the address bar to turn green on secured pages."

While researchers have shown that SSL can be bypassed by a determined attacker using a man-in-the-middle attack, and that padlock icons can be faked, security experts say they're still a better-than-nothing indicator of a secure browsing session.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
To Be Ready for the Security Future, Pay Attention to the Security Past
Liz Maida, Co-founder, CEO & CTO, Uplevel Security,  9/18/2017
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Jan, check this out! I found an unhackable PC.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.