Security tips for Black Friday shoppers

More than a quarter of UK and US-based online shoppers would proceed with a bargain purchase without first checking if the website is secure, a new survey has shown.

Moreover, shoppers in the US are more likely to put themselves at risk than those in the UK, with more than a third of US-based respondents admitting that they wouldn’t check the website’s security before purchasing. This is particularly worrying given that more than half of shoppers are expecting to use their credit or debit card to purchase goods this Black Friday weekend.

These are the results of a survey conducted by Opinion Matters on behalf of WhiteHat Security. The survey also found that a third of UK and US-based shoppers are not sure, or definitely do not know how to identify if a website is secure.

The retailers have a big part to play in website security. WhiteHat Security analysed retail websites between July and September 2015 and found that they are more likely to exhibit serious vulnerabilities compared to other industries. The most commonly occurring critical vulnerability classes for the retail industry were:

• Insufficient Transport Layer Protection (with 64 percent likelihood): When applications do not take measures to authenticate, encrypt, and protect sensitive network traffic, data such as payment card details and personal information can be left exposed and attackers may intercept and view the information.
• Cross Site Scripting (with 57 percent likelihood): Attackers can use a vulnerable website as a vehicle to deliver malicious instructions to a victim’s browser. This can lead to further attacks such as keylogging, impersonating the user, phishing and identity theft.
• Information Leakage (with 54 percent likelihood): Insecure applications may reveal sensitive data that can be used by an attacker to exploit the target web application, its hosting network, or its users.
• Brute Force (with 38 percent likelihood): Most commonly targeting log-in credentials, brute force attacks can also be used to retrieve the session identifier of another user, enabling the attacker to retrieve personal information and perform actions on behalf of the user.
• Cross Site Request Forgery (with 29 percent likelihood): Using social engineering (such as sending a link via email or chat), attackers can trick users into submitting a request, such as transferring funds or changing their email address or password.

According to Jeremiah Grossman, founder at WhiteHat Security, there are a few simple tricks that can help shoppers stay safe online over the next few days:

• Look out for HTTPS when browsing: HTTP -- the letters that show up in front of the URL when browsing online -- indicates that the web page is using a non-secure way of transmitting data. Data can be intercepted and read at any point between the computer and the website. HTTPS on the other hand means that all the data being transmitted is encrypted. Look out for the HTTPS coloured in either green or red and a lock icon.
• Install a modern web browser and keep it up to date: Most people are already using one of the well-known web browsers, but it is also very important that they are kept up to date with the latest security patches.
• Be wary of public Wi-Fi: While connecting to free Wi-Fi networks seems like a good idea, it can be extremely dangerous as it has become relatively easy for attackers to set up Wi-Fi hotspots to spy on traffic going back and forth between users and websites. Never trust a WiFi network and avoid banking, purchasing or sensitive transactions while connected to public Wi-Fi.
• Go direct to the website: There will be plenty of big discount emails around over the next few days that will entice shoppers to websites for bargain purchases. Shoppers should make sure that they go direct to the site from their web browser, rather than clicking through the email.
• Make your passwords hard to guess: Most people wouldn’t have the same key for their car, home, office etc., and for the same reason, it makes sense to have hard-to-guess, unique passwords for online accounts.
• Install ad blocking extensions: Malicious software often infects computers through viewing or clicking on online advertisements, so it is not a bad idea to install an ad blocking extension that either allows users to surf the web without ads, or completely blocks the invisible trackers that ads use to build profiles of online habits.
• Stick to the apps you trust: When making purchases on a smartphone, shoppers are much better off sticking to apps from companies they know and trust, rather than relying on mobile browsers and email.

Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

Image Credit: Christos Georghiou / Shutterstock