Vulnerabilities / Threats
8/26/2014
12:00 PM
Chris Weltzien
Chris Weltzien
Commentary
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Top 5 Reasons Your Small Business Website is Under Attack

There is no such thing as "too small to hack." If a business has a website, hackers can exploit it.

I was recently looking for a place to board our cat this summer, and one business had on its home page, underneath the name of the company, the words “Viagra discounts” in small but legible type. Assuming the company isn’t branching out from felines to pharmaceuticals, why would this appear on its website? The answer, of course, is that the company didn’t put it there, and was probably unaware of it altogether.

When small business owners think about website security at all, their attitude is usually something along the lines of, “Why would anyone attack us? We’re not a bank and we don’t store credit card data.” Once the company sets up its website, it “sets it and forgets it.” It may check its search ranking once in a while to be sure it hasn’t been blacklisted by Google, but that’s as far as it is likely to go. However, hackers are attacking small business websites with increasing frequency and sophistication: In the cyber-attack ecosystem small business websites are both an attack platform and an attack target.

Unfortunately, the current upward trend of small businesses managing their own websites will only amplify this problem. The National Small Business Association 2013 Technology Survey found that nearly two-thirds of small businesses maintain their own websites, up 15% from the 2010 report. Meanwhile the report indicates that 64% of companies consider the time required to simply maintain the site “a major challenge.”

If you work in, or provide security services to, a small business, below are five points that you need to understand in order to effectively defend your website from attack.

5. New vulnerabilities threaten your business every day: Small business owners need to understand that vulnerability discovery and disclosure is dynamic. Just because a website hasn’t been updated lately doesn’t mean that new vulnerabilities aren’t a threat. In fact vulnerabilities in existing code are more likely to appear on websites that haven’t been updated. According to anonymized aggregated customer data we analyzed at 6Scan, for companies using Web content management systems this issue is even more critical. At any given time between 70% and 80% of WordPress users are running an outdated version which can contain critical, and well documented, vulnerabilities.

4. Your site is under attack 24/7: Many small business owners check their traffic figures daily, pleased to see any increase. They might not be so happy to learn, as we did from our analysis, that, on average, 7% of the traffic to their site is actively attacking it, attempting to detect and exploit vulnerabilities. A site that gets 100 unique visitors per day (placing it approximately at Alexa’s 100,000th most trafficked site) is a target of two breach attempts every hour of every day -- almost 20,000 attacks per year. With these numbers it’s not a matter of if a vulnerability will be exploited but when.

3. Hackers are more efficient than ever: Cisco’s 2014 Annual Security Report referred to hacking legitimate websites as a “high-efficiency infection strategy.” Once a site is compromised, it turns into an attack platform, giving hackers the freedom to choose what devices to attack, what viruses to distribute, even what date and time to launch the attacks for maximum effect.

Back in my days at Zone Labs (one of the early desktop firewall vendors) malware email attachments were all the rage. Now bad guys don’t need to go through all the effort to push malicious attacks with a single payload -- they just hack legitimate websites and the victims to come to them. If they want to beta test a new iOS exploit, they can run that for a few days. If they want to build a botnet with proven malicious code, they just pop that up. The victims will just keep showing up, not knowing the site has been compromised. This ruthless strategy puts the “viral” back in viral marketing.

2. Your site -- no matter how small -- is valuable to hackers: There is no such thing as “too small to hack.” If a business has a website, hackers can exploit it. Stealing personally identifiable information from users and visitors is one way they derive value. But even without credit card data, user/password credentials can be valuable when used as part of a bigger scam.

Hackers also breach legitimate websites to post phishing pages -- this is essential to get around anti-spam software that will flag a link to a blacklisted IP. According to the Websense 2014 Threat Report, 85% of all malicious Web links are hosted on hacked legitimate sites. A third way attackers can use a hacked site is to host malicious content used in phishing scams.

1. Your reputation gets hacked as well: Being blacklisted by Google damages a small business’s brand, but it pales in comparison to being used as a platform to attack its business partners -- and this is not a spy-movie, spear-phishing scenario. Last year the networks of Facebook, Twitter, Microsoft, and Apple were compromised in “watering hole” attacks. In these attacks, cyber criminals hacked into small business Web sites that are known to be frequented by employees of the targeted companies. These specific attacks focused on small mobile application developers, but the model works for any industry.

The days of small businesses putting up a few web pages and relying on “security through obscurity” to protect them are gone forever. Hackers have great incentive to unleash sophisticated -- and often highly automated -- attacks on even the smallest sites. Small business stakeholders must begin to regard website security as a necessary part of operating in an online world, or their customers and partners will pay the price.

Chris is CEO of 6Scan, a pioneer in automated website security, and he has been building successful security businesses for the past decade. Prior to 6Scan he was President and Chief Operating Officer of website security firm Exploit Prevention Labs, which was acquired by AVG ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 3   >   >>
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
9/2/2014 | 6:37:08 PM
RE: Solutions
Hi Joseph -- at 6Scan we provide a free scanning service availble at www.6scan.com/signup. We will identify vulnerabilities and existing website infections and we provide paid remediation services to fix any problems. We try and keep the process as smooth and affordable as possible. Solutions are also available from SiteLock and Sucuri.
JosephL208
100%
0%
JosephL208,
User Rank: Apprentice
9/1/2014 | 9:28:53 AM
RE: Solutions
So, what are the solution? The real soutions? As a small business owner, I don't really have the time to dedicate to protecting my systems especailly given how fast the hacking evolves. Yet, I also can't afford to have my reputation and data compermised. So, what are the solutions?


Capital LookUp - www.capitallookup.com/
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/31/2014 | 8:37:37 AM
Re: a good read - important for small business owners
Is the reason for why they are typically less vigilant with their bank accounts due to lack of resources? I feel their should be a finance analyst that would track changes to the account on a daily basis.

Also, how come the same fraud measures aren't taken for SMB's?
DarkReadingTim
50%
50%
DarkReadingTim,
User Rank: Strategist
8/29/2014 | 9:25:41 AM
Re: a good read - important for small business owners
A key reason for continued attacks on SMBs is their bank accounts. An SMB can get a significantly larger line of credit than an individual, yet most SMBs don't track their "identities" as closely as individuals do. And oh, by the way, banks don't simply reimburse SMBs for fraudulent charges as they do for individuals.
Biffster
50%
50%
Biffster,
User Rank: Apprentice
8/28/2014 | 3:24:10 PM
Re: How do non-techie small businesses get security advice?
Agreed! Or perhaps Web Hosters should be more proactive in enforcing safe secure website behavior, sorta like the "click it or ticket" campaign for seat belt enforcement. Unsecured sites are the online equivalent of an attractive nuisance that can harm many others.
Whoopty
50%
50%
Whoopty,
User Rank: Moderator
8/28/2014 | 3:15:27 PM
Re: Don't bother without security
A lot of the problems I've found when working with smaller businesses, is there's often a lack of understand not only of security itself, but who to hire to help with it. There are pleenty of freelancers I've worked with who claim to be well versed in Wordpress (or similar CMS) security, only to have them charge for hours of work with little results, or for them to clear out the affected files but not fix the loophole.

Very frustrating for everyone involved. I'd love to see some sort of accreditation that could be earned perhaps that was well known enough that even those unfamiliar with web security at an even basic level could understand and hire the right people. 
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/28/2014 | 3:12:31 PM
Re: Don't bother without security
Great point. With proactive security the cost/benefit analysis focuses on value of the assett being secured. Two examples we see are small companies that service larger customers and small businesses that run transactional models. 

If you serve larger clients (who interact with your site) the cost of being a watering hole -- hacked and infected as a means to attack your larger customers -- can be measured as percentage of the value of your current clients. Also, if the attack became public, competitors would use it to take new business. To stay competitive would then require  marketing to off set the damage. 

On the transactional side the calculation would include lost revenue if your site is blacklisted by browsers or toolbars (Chrome, Firefox, AVG, etc) and the near destruction of all SEO/SEM efforts. Years of optimization can be undone with a single malware detection and it can take months to get it back. 
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
8/28/2014 | 2:49:48 PM
Re: Don't bother without security
Unfortunate indeed! Delivery of secure technology, and not just delivery of technology itself, should be a top priority for a business that includes an internet presence as part of their operational and strategic goals. However, without proper communication of the importance of security, organization heads will not place that kind of priority on security. It is therefore imperative that security professionals learn the art of effective business communication if they are to push the security agenda forward. FUD (fear, uncertainty, doubt) based messages have gone the way of the boy who cried wolf. Tough sell though, for a small business that has limited resources to begin with.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/28/2014 | 8:00:11 AM
Re: How do non-techie small businesses get security advice?
Or the web hoster should be more proactive about raising the awareness of the small business about potential website security issues that could cause serious damage.
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 9:57:16 PM
Re: How do non-techie small businesses get security advice?
This rather common -- a small company has a problem with their site but the developer did it as a one-off project and is no longer actively engaged. You make a great point, when hiring a developer companies should ask for an ongoing plan to maintain the security of the site.
Page 1 / 3   >   >>
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5314
Published: 2014-11-23
Buffer overflow in Cybozu Office 9 and 10 before 10.1.0, Mailwise 4 and 5 before 5.1.4, and Dezie 8 before 8.1.1 allows remote authenticated users to execute arbitrary code via e-mail messages.

CVE-2014-5325
Published: 2014-11-23
The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity refe...

CVE-2014-5326
Published: 2014-11-23
Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2014-6477
Published: 2014-11-23
Unspecified vulnerability in the JPublisher component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4290, CVE-2014-4291, CVE-2014-4292, CVE-2014-4...

CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?