Study: 86% of Websites Have At Least One Security Vulnerability

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More .

A new study published by WhiteHat Security finds that nearly all websites—86% of the thousands examined—have at least one serious security vulnerability. However, the good news is that the total number of security bugs declined. Somewhat surprisingly, SQL injection is no longer one of the top ten most common vulnerabilities; content spoofing is now the most common type of problem.

CRN’s Robert Westervelt reported, “Website vulnerabilities are on the decline at businesses that are proactively hunting down coding errors, but new data released Thursday found that flaws persist, opening up holes that are consistently being targeted by attackers. The report issued by Santa Clara, Calif.-based WhiteHat Security analyzed data from websites at more than 650 organizations that are monitored by the firm’s Sentinel application security platform. The company said the average number of serious vulnerabilities detected by its scanning tool declined from 79 flaws in 2011 to 56 flaws in 2012.”

NetworkWorld’s Ellen Messmer added, “A close look at vulnerabilities in about 15,000 websites found 86 percent had at least one serious hole that hackers could exploit, and ‘content spoofing’ was the most prevalent vulnerability, identified in over half of the sites, according to WhiteHat Security’s annual study published today. ‘Content spoofing is a way to get a website to display content from the attacker,’ says Jeremiah Grossman, CTO at WhiteHat, an IT security vendor. A criminal might do this to steal sensitive customer information or simply to embarrass the owners of a website. In any event, in content spoofing the fake content is not actually on the website as it would be in a web defacement, but simply appears to be there, Grossman points out.”

Sean Michael Kerner with eSecurity Planet noted, “While Grossman expected some of the findings, there were a few surprises. One such surprise was the prevalence of SQL injection attacks.” He quoted Grossman, who said, “SQL injection, for all the damage that it causes, is actually not in our top 10 when it comes to strict prevalence. It’s number 14 at 7 percent of websites.”

According to Dark Reading’s Kelly Jackson Higgins, “All in all, the report demonstrates how cleaning up websites — the top attack vector these days — doesn’t happen overnight. Even organizations that are schooling their developers in security, running Web application firewalls (WAFs), and performing static code analysis are experiencing mixed results overall in their app security, the report shows — with more vulnerabilities in their websites in some cases, the report found. Those with WAFs had 11 percent more vulnerabilities, for instance, while organizations that ran static-code analysis on their websites had 15 percent more flaws.”