Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/26/2014
12:00 PM
Chris Weltzien
Chris Weltzien
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

Top 5 Reasons Your Small Business Website is Under Attack

There is no such thing as "too small to hack." If a business has a website, hackers can exploit it.

I was recently looking for a place to board our cat this summer, and one business had on its home page, underneath the name of the company, the words “Viagra discounts” in small but legible type. Assuming the company isn’t branching out from felines to pharmaceuticals, why would this appear on its website? The answer, of course, is that the company didn’t put it there, and was probably unaware of it altogether.

When small business owners think about website security at all, their attitude is usually something along the lines of, “Why would anyone attack us? We’re not a bank and we don’t store credit card data.” Once the company sets up its website, it “sets it and forgets it.” It may check its search ranking once in a while to be sure it hasn’t been blacklisted by Google, but that’s as far as it is likely to go. However, hackers are attacking small business websites with increasing frequency and sophistication: In the cyber-attack ecosystem small business websites are both an attack platform and an attack target.

Unfortunately, the current upward trend of small businesses managing their own websites will only amplify this problem. The National Small Business Association 2013 Technology Survey found that nearly two-thirds of small businesses maintain their own websites, up 15% from the 2010 report. Meanwhile the report indicates that 64% of companies consider the time required to simply maintain the site “a major challenge.”

If you work in, or provide security services to, a small business, below are five points that you need to understand in order to effectively defend your website from attack.

5. New vulnerabilities threaten your business every day: Small business owners need to understand that vulnerability discovery and disclosure is dynamic. Just because a website hasn’t been updated lately doesn’t mean that new vulnerabilities aren’t a threat. In fact vulnerabilities in existing code are more likely to appear on websites that haven’t been updated. According to anonymized aggregated customer data we analyzed at 6Scan, for companies using Web content management systems this issue is even more critical. At any given time between 70% and 80% of WordPress users are running an outdated version which can contain critical, and well documented, vulnerabilities.

4. Your site is under attack 24/7: Many small business owners check their traffic figures daily, pleased to see any increase. They might not be so happy to learn, as we did from our analysis, that, on average, 7% of the traffic to their site is actively attacking it, attempting to detect and exploit vulnerabilities. A site that gets 100 unique visitors per day (placing it approximately at Alexa’s 100,000th most trafficked site) is a target of two breach attempts every hour of every day -- almost 20,000 attacks per year. With these numbers it’s not a matter of if a vulnerability will be exploited but when.

3. Hackers are more efficient than ever: Cisco’s 2014 Annual Security Report referred to hacking legitimate websites as a “high-efficiency infection strategy.” Once a site is compromised, it turns into an attack platform, giving hackers the freedom to choose what devices to attack, what viruses to distribute, even what date and time to launch the attacks for maximum effect.

Back in my days at Zone Labs (one of the early desktop firewall vendors) malware email attachments were all the rage. Now bad guys don’t need to go through all the effort to push malicious attacks with a single payload -- they just hack legitimate websites and the victims to come to them. If they want to beta test a new iOS exploit, they can run that for a few days. If they want to build a botnet with proven malicious code, they just pop that up. The victims will just keep showing up, not knowing the site has been compromised. This ruthless strategy puts the “viral” back in viral marketing.

2. Your site -- no matter how small -- is valuable to hackers: There is no such thing as “too small to hack.” If a business has a website, hackers can exploit it. Stealing personally identifiable information from users and visitors is one way they derive value. But even without credit card data, user/password credentials can be valuable when used as part of a bigger scam.

Hackers also breach legitimate websites to post phishing pages -- this is essential to get around anti-spam software that will flag a link to a blacklisted IP. According to the Websense 2014 Threat Report, 85% of all malicious Web links are hosted on hacked legitimate sites. A third way attackers can use a hacked site is to host malicious content used in phishing scams.

1. Your reputation gets hacked as well: Being blacklisted by Google damages a small business’s brand, but it pales in comparison to being used as a platform to attack its business partners -- and this is not a spy-movie, spear-phishing scenario. Last year the networks of Facebook, Twitter, Microsoft, and Apple were compromised in “watering hole” attacks. In these attacks, cyber criminals hacked into small business Web sites that are known to be frequented by employees of the targeted companies. These specific attacks focused on small mobile application developers, but the model works for any industry.

The days of small businesses putting up a few web pages and relying on “security through obscurity” to protect them are gone forever. Hackers have great incentive to unleash sophisticated -- and often highly automated -- attacks on even the smallest sites. Small business stakeholders must begin to regard website security as a necessary part of operating in an online world, or their customers and partners will pay the price.

Chris is CEO of 6Scan, a pioneer in automated website security, and he has been building successful security businesses for the past decade. Prior to 6Scan he was President and Chief Operating Officer of website security firm Exploit Prevention Labs, which was acquired by AVG ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 3   >   >>
cherr552
50%
50%
cherr552,
User Rank: Apprentice
8/27/2014 | 8:02:34 PM
How do non-techie small businesses get security advice?
Many small businesses have a web presence, but no tech expertise--their web sites are developed by designers or consultants, who rarely return to maintain what they've built. 



In the setup-and-forget model, the site builders make recommendations about the hosting provider, and they should be able to recommend a security provider as well.  After all, their reputation depends on building sites that perform well (for their customers--the small businesses).
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:48:54 PM
Re: What about solutions? >Early Trends in Hosting
Exactly. The incremental premium for a hosting service that takes security seriously is negligible compared to the lost revenue/reputation if your company's website gets placed on the Google blacklist/blocklist.
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:45:37 PM
Re: Don't bother without security
Unfortunately security is often the last thing to be addressed in a website launch plan (if it's addressed at all) and the more dynamic a site is, the greater the attack surface is likely to be. We're hoping to raise the awareness that big names make the big news (Target, etc) but the majority iof attacks target smaller businesses. The cost is also coming down so it should be attainable for almost all start-ups.
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:38:08 PM
Re: Automation
I like the analogy. I may borrow that one. Thanks!
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:37:11 PM
Re: What about solutions?
WAFs are a valuable layer in website security. Companies that don't have dedicated IT resources may want a "security suite" approach that includes vulnerability and malware scanning and remediation as well. On the DDoS side its not a particular concern for smaller businesses, the bigger threat for them is being hacked and co-opted into a botnet that will participate in the actual DDoS attack.
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
8/27/2014 | 12:17:52 PM
Don't bother without security
This is why I feel like I'm stomping on people's ideas everytime a friend tells me they've come up with a clever business idea that involves a website. If they don't know how to handle security themselves and can't afford to hire someone to do it for them, it seems doomed to fail. 

When your reputationo can be ruined so easly, it's going to become much harder to startup internet based businesses, without some serious capital funding to help shore up defenses, preemptively and after the fact. 
Biffster
50%
50%
Biffster,
User Rank: Apprentice
8/27/2014 | 9:48:17 AM
Automation
Nice article.  What I like about the author's company 6Scan, is their emphasis on automation to improve website safety and security.  It is a complicated world out there.  Thanks for making it a little simpler.  Imagine how effective the air bags in your car would be if you had to operate them manually.  Automation is the key, especially for small business sites.
Stratustician
50%
50%
Stratustician,
User Rank: Moderator
8/27/2014 | 9:38:51 AM
Re: What about solutions?
I'm surprised we don't see more small business solutions around Web Application Firewalls (WAF) or DDoS.  These are great ways to limit the risk of malicious traffic and can be offered as hosted solutions.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/27/2014 | 7:05:13 AM
Re: What about solutions? >Early Trends in Hosting
I find it really interesting that web hosting companies are looking to offer 3rd party website security services tailored for the small biz market because of the increasing cost for them to repair hacked sites....  That's something to consider when choosing a web hosting vendor. 
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
8/27/2014 | 12:52:35 AM
Re: What about solutions?
Paul you point out a common misconception. Most hosting companies provide security only for the web server itself, not the websites that reside on the server. Often small business owners don't have the time or resources to drill down on this critical delineation. Fortunately, there is an early trend in the hosting space to offer 3rd party website security services tailored for this market (the cost for hosting companies to keep repairing hacked sites is becoming a significant burden). At 6Scan our automated service is an advanced low-touch solution designed for small businesses and there are a few other options including SiteLock and Sucuri.
<<   <   Page 2 / 3   >   >>
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16395
PUBLISHED: 2019-09-17
GnuCOBOL 2.2 has a stack-based buffer overflow in the cb_name() function in cobc/tree.c via crafted COBOL source code.
CVE-2019-16396
PUBLISHED: 2019-09-17
GnuCOBOL 2.2 has a use-after-free in the end_scope_of_program_name() function in cobc/parser.y via crafted COBOL source code.
CVE-2019-16199
PUBLISHED: 2019-09-17
eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to certain URLs related to the ReGa core process.
CVE-2019-16391
PUBLISHED: 2019-09-17
SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiser_action.php.
CVE-2019-16392
PUBLISHED: 2019-09-17
SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.