Nearly half of the world’s top one million websites are vulnerable to malware, turning browsing into a security minefield for users, according to new research from Menlo Security.
The vendor’s newly released State of the Web 2016 report claimed that 46% of the top Alexa ranked sites around the globe are open to exploitation by cybercriminals.
So-called ‘background sites’ were highlighted in the report as a potential weakness. These sites typically feed active content to the browser for content delivery, trackers, beacons and ad-delivery.
Background requests sending content to web browsers outnumbered user requests at a ratio of 25:1, according to the report.
Menlo Security classified sites as risky if the homepage or background site was: running software with known bugs; categorized as a “known bad” site; or had experienced a security incident in the past 12 months. It claimed vulnerable software was the main reason for rating a site as risky.
Of the one million sites appraised, 355,804 ran vulnerable software or accessed background domains running vulnerable software; 166,853 were rated as “known bad” sites; and 31,938 had experienced a recent security incident.
The vendor claimed the high percentage of risky sites is especially concerning given that traditional security products are doing a poor job at protecting users – because they rate sites either “good” or “bad,” which can result in damaging false positives and negatives.
Another knock-on effect of poor web security is that phishing attackers are increasingly able to use compromised legitimate sites in a bid to thwart URL filters.
Frost & Sullivan VP of research, Michael Suby claimed the report proved web use by firms and consumers was “essential but risky.”
“Furthermore, malware creators have historically demonstrated that they can evade detection techniques,” he added.
“While detection is important in reducing exposure, there is no guarantee of 100% detection. We believe that isolation, engaging the internet at arm’s length, is an up-and-coming approach to reducing the malware risk inherent in web browsing and click-able links in email.”