If you use an e-commerce site in the UK, how safe are your personal details? Not as safe as you might think, according to SecureTest, a security consultancy that specialises in "ethical hacking". After testing 100 UK websites, it has accused the UK e-commerce community of fundamental flaws in the way it handles customers' details.
Ethical hacking is normally done with the target's consent: paid security experts look for holes in the system. In this case, the tests were not sanctioned, and so SecureTest was careful not to breach the Computer Misuse Act (CMA). Instead, its team signed up for customer accounts on each website, and then walked through the standard procedures all customers have access to, drawing conclusions about how those sites handled customer data.
For example, almost all sites use a customer's email address as a username, which they ask for when helping customers with a forgotten password. Of those tested, 60% responded to forgotten password requests by explicitly stating whether the email address was in the database or not.
"That's a fatal mistake," says SecureTest's managing director, Ken Munro, arguing that it lets attackers verify that a particular email address is registered on an e-commerce site. An attacker could then create lists of addresses with which to start testing targeted attacks. "If I wanted to deliver a cross-site scripting attack via email to steal their customers' account details, I now know the email addresses of their customers," he says.
Pass the password
The sites surveyed recovered user passwords in one of three ways, all via email: sending a link to a web page where users enter a new password; generating and sending a new password; or simply sending the original one.
Sending account credentials over an unprotected network is a bad idea, says Michael Owen, head of security management at security consultancy and penetration tester IRM. "I wouldn't recommend any system that mailed back passwords," he says. "You're assuming that you can trust all of the machines that it will pass through, and that the customer definitely has control of his email at the time you're sending it out."
Even sending a link to a password reset page is insecure unless the page also asks the user a secret question when they arrive there. Only 14% of sites took that approach, Munro explained.
Tom Kellermann, vice-president of security awareness at security firm Core Security Technologies, goes even further. "Passwords themselves are obsolete. It is shocking to me that the standard in e-commerce is pushing people towards stronger passwords," he says, arguing that they're notoriously difficult for consumers to manage securely. "We should be moving towards two-factor authentication".
Some banks have started to adopt this approach (which generally combines something you know, such as a pin, with something you have, such as a smart card). Few, if any, e-commerce sites do it, though: the cost of giving away hardware tokens to every user would put most of them out of business. The contention over these basic security issues raises an important question: how can e-commerce companies walk the line between usability and security?
These decisions seem to be based on a mixture of de facto approaches to the problem and gut instinct, says Owen: "At the end of the day, it boils down to the risk appetite of an organisation."
Compliance complaint
The credit card industry has imposed its own regulations on the storage of credit card details. The PCI-DSS standard governs the security with which companies store credit card information. Unlike most security regulations, it was imposed by the private sector, rather than the government.
The credit card companies which designed them have promised to fine companies that don't conform to the guidelines, but most still fall short. LogLogic, which makes software that analyses security logs, commissioned a survey last week of 65 UK firms with at least 500 employees that handled credit card transactions. Only 14% were PCI-DSS compliant.
Littlewoods, which also manages the website for Adidas, isn't yet compliant, says spokesperson Anthony Taylor. But they are "well on our way to achieving compliance within the agreed timescales".
Nor is retailer New Look, says Shaun Wills, strategy and business development director, who admits that newlook.co.uk doesn't encrypt its customers' passwords either. He's not that worried, though, because the company doesn't hold customers' credit card data. Like some other sites, it forces customers to re-enter their credit card details for each transaction - thus dodging the PCI bullet. "It's a big disadvantage," he says. "But for the time being until we're absolutely confident that we have robust systems in place; we think that's probably a better way to go."
For Donal Casey, principal consultant at systems integrator Morse, the most trustworthy websites don't take credit card information at all. "I'm more interested in sites that use things like PayPal or Google Checkout because I don't necessarily want to give my card details out," he says.
The LogLogic survey didn't say what level of certification the handful of compliant companies had attained. The PCI standard has several, based on the volume of transactions a company processes. Only tier one (the highest) is externally audited, says James Cronin, CTO of tier one-compliant e-commerce platform provider Venda. "Anyone who wants to can be level two, three or four compliant just by filling in questions on a web form. It's not really a validation," he says.
But PCI only addresses the handling of credit card data. Today's websites face other problems. For several years, one way for criminals to infect victims' computers with malicious software was by using shady websites serving porn and pirated software to covertly deliver malicious scripts. Once infected, the computers became part of a botnet, remotely controlled by online crooks. Recently, criminals have refined their tactics, hacking into legitimate websites and turning them to the dark side. A survey by security firm WebSense in January found that 51% of all sites serving up malicious scripts were legitimate sites that had been hacked. "Our figure is 83%," says Graham Cluley, senior technology consultant at anti-virus firm Sophos. Every 14 seconds, Sophos finds a site delivering malicious scripts, and eight in 10 are legitimate sites that were hacked, he says.
On Valentine's day, the company found an e-commerce site selling flowers that was unwittingly infecting customers' machines. "The florist wasn't really interested, and didn't understand what we were talking about. He was into flowers, not websites," recalls Cluley.
Some sites using databases to serve up their content have been attacked using SQL injection, in which criminals manipulate the web server's database by typing carefully crafted text into a web form or the address bar. Another attack involves stealing FTP passwords from an infected PC, says Joe Stewart, senior security researcher at managed security services firm SecureWorks. "Someone gets infected with a bot, it's stealing their other passwords, and so it steals FTP passwords as well," he warns.
Web advertisements are another attack vector, warns Stewart's colleague at SecureWorks, senior security researcher Don Jackson. E-commerce companies may have control over their own content, but if banners display advertising content from third parties, how do they know they're not serving malicious scripts?
A question of trust
Such trust relationships often extend to a third-party web host looking after a company's e-commerce site, says Kellermann. "Those who host websites, portals and e-commerce engines are not being effectively tested and forced through contracts to remediate exploitable vulnerabilities before the enemy does," he warns.
These issues are worryingly real. Last October Fasthosts, a UK web hosting company, was forced to ask all of its customers to change their FTP and email passwords (stored unencrypted) following a data breach. And many e-commerce websites hosted by third parties share servers with other companies' code, so one infected application can affect others' software.
All of this makes it difficult for e-commerce customers to know who they're trusting, let alone how secure they are. And with criminals now operating in stealth mode so that they can milk compromised computers of their data for as long as possible, how will we ever really know?
