Alarming lack of cybersecurity practices on world's most popular websites
The world’s most popular websites lack basic cybersecurity hygiene, an investigation by Cybernews shows.
By Shutterstock
The world’s most popular websites lack basic cybersecurity hygiene, an investigation by Cybernews shows.
Do you happen to love exploring DIY ideas on Pinterest? Scrolling through IMDB to pick the next movie to watch? Or simply scrolling through Facebook to see what your friends and enemies have been up to?
The Cybernews research team has deep-dived into an issue that’s quite often overlooked by developers – HTTP security headers. They’ve analyzed the top 100 most visited websites, including those mentioned above and other popular sites like PayPal, Wikipedia, and AliExpress, among others.
The conclusion? Many developers of the most popular websites could up their security game. Not to give threat actors any ideas – we’re not going to point fingers at which website lacks what – we’ve notified the companies mentioned in the article about our findings.
HTTP security headers explained
HTTP security headers are instructions on how the browser should interact with the webpage. This helps to protect sites from a variety of attacks like clickjacking, and ensure secure connections.
“Often ignored by developers, HTTP security headers are good firewalls that can prevent a lot of common vulnerabilities from being exploited. As your site might be subject to vulnerabilities you don’t know about, it’s always important to have additional safety measures, especially when it comes to the end user,” Cybernews researchers explained.
HTTP security headers are mostly useful for client-side attacks, aiming to exploit security flaws running on the user’s device to gain unauthorized access, steal information, and perform other malicious activities.
As per our researchers, the most common attacks include:
- Man-in-the-middle (MITM) attacks that usually occur on free public wifi or other open networks
“Security headers are important security layers. Lacking good security could lead to danger not only for web application owners, but also for the users visiting the website,” Cybernews researchers noted after having checked the top 100 most visited websites.
X-Frame-Options
34% of tested websites lack the so-called X-Frame-Options security header. This is used to protect against clickjacking.
Clickjacking refers to a technique where a user is deceived into clicking on a seemingly harmless element on a web page, which actually triggers an action or interaction that the user did not intend.
Content-Security-Policy (CSP)
50% of tested websites lack Content-Security-Policy (CSP), a security header used to mitigate attacks like XSS and data injection. This header allows web developers to define a set of policies that control the resources (e.g., scripts, stylesheets, images) that a browser should load and execute on a web page.
The Referrer-Policy
76% of tested websites lack the Referrer-Policy security header, which essentially controls how much information about the originating URL (referrer) is shared with a linked resource, enhancing privacy and reducing potential information leakage.
The Permissions-Policy
88% of tested websites lack the Permissions-Policy header security header. This allows web developers to control and manage the browser's permissions for various features and APIs.
“With the Permissions-Policy header, web developers can define the permissions for specific browser features and APIs, such as geolocation, camera, microphone, fullscreen, payment, etc. This header helps enforce security and privacy measures by allowing websites to request specific permissions from the browser before accessing certain features or APIs,” researchers explained.
The X-Content-Type-Options
33% of tested websites lack the X-Content-Type-Options security header, which prevents the browser from MIME-sniffing (content inspection) attacks. In this attack, an attacker may try to trick the browser into interpreting content as a different type than intended.
Strict-Transport-Security (HSTS)
18% of tested websites lack the Strict-Transport-Security (HSTS) header, which
instructs the browser to only connect to a website using HTTPS and to automatically convert any HTTP requests to HTTPS, preventing users from accessing the website over insecure connections.
“By implementing the Strict-Transport-Security header, website administrators can effectively protect users from certain types of attacks, such as SSL-stripping attacks, where an attacker attempts to downgrade the connection from HTTPS to HTTP,” Cybernews researchers explained.
Why does any of this matter
Security headers like those mentioned above play a crucial role in mitigating common vulnerabilities. Without them, websites become more susceptible to XSS, clickjacking, and content injection, among other attacks.
Many security headers are considered to be best security practices, helping to ensure confidentiality, integrity, and availability of user data. Their absence could potentially lead to regulatory issues and loss of consumer trust.
“In today’s digital landscape, users expect a certain level of security and privacy when interacting with websites and applications. Missing security headers can create a perception of poor security practices and erode user trust. Users may hesitate to share sensitive information or engage with websites that lack basic security measures, potentially impacting brand reputation and user engagement,” researchers noted.