Do website design platforms pose too big a security risk?

Risky business?

Questions were raised about the security vulnerabilities of cloud-based website design platforms in 2016, when a DOM-based cross-site scripting (XSS) vulnerability discovered on Wix was said to have put 87 million websites and their users at risk. 

The XSS bug allowed attackers to create worms capable of taking over administrator accounts. This, in turn, gave them full control over websites. More worrying still, exploiting this vulnerability was almost as simple as designing the website itself, by adding a simple parameter to any site created on Wix.com.

Unlike traditional cross-site scripting exploits, where a payload is dropped onto a page in response to an http(s) request, DOM-based XSS attacks modify the Document Object Model environment in the browser used by client-side script, and malicious code affects the execution of client-side code, according to the Open Web Application Security Project (Owasp).

“Vulnerabilities exist across the board, but maybe the issue with platforms such as Wix and Shopify is that the people using them don’t check these things, and aren’t investing in detection software”

Matt Austin, director of security research at Contrast Security, who found the exploit, said: “Administrator control of a Wix.com site could be used to widely distribute malware, create a dynamic, distributed, browser-based botnet, mine cryptocurrency, and otherwise generally control the content of the site as well as the users who use it.”

Wix swiftly fixed the vulnerability, at the time, and told ZDNet, on 3 November 2016: “We take the security of our customers very seriously. After thorough examination, we can state that the issue has been addressed. We do operate a formal bug bounty programme and are taking steps to widen the community.”

Although experts haven’t discovered a similar vulnerability since, many, such as computer security expert Graham Cluley, admit that their experience with such platforms is limited, meaning it is difficult for them to comment on whether or not the issue still exists and the scale of what happened.

“I’m afraid I don’t have any experience with Wix or Squarespace, or know what mitigation steps they might have taken to avoid other attacks, so I can’t shed any light on this area,” he says.

Could this mean it is possible that some smaller security vulnerabilities lie undetected and are being exploited continuously?

Are security vulnerability scanners the solution?

Similarly to website design, many IT and information security professionals have grown accustomed to the ease of being able to click a button and automate all of their web security testing, by using vulnerability scanners.

One such platform is Netsparker, a vulnerability detection system used by Microsoft, Cisco and Intel, to name but a few. Suphi Özgür Cankurt, regional sales manager at the company, believes website design platforms have some additional vulnerabilities, but this is because small business owners using them don’t regularly run security checks.

“Website design platforms let you do so much now. It means there are more avenues for hackers to exploit and it is important to identify vulnerabilities early,” says Cankurt.

“It is important to note that these vulnerabilities exist across the board, but maybe the issue with platforms such as Wix and Shopify is that the people using them don’t check these things, and aren’t investing in detection software, such as ours.”

However, Kevin Beaver, an IT security consultant at Principle Logic, believes that because there are so many nuances to running web vulnerability scans, only an experienced professional is going to know how to properly run them to yield the best results. So the solution isn’t necessarily investing in vulnerability scanning software, but in the platforms’ hiring of experts capable of assessing and interpreting the issues that could exist.

“You have to know your scanners and what to expect or you won’t get the desired results,” says Beaver. “Granted, many scanner vendors have done an excellent job fine-tuning the interfaces of their tools, but there’s so much more to it.

“When using these scanners, many will just look for high-risk vulnerabilities, then you’re probably overlooking a ton of potential opportunities to uncover additional security flaws,” says Beaver, writing on Computer Weekly's sister site SearchSecurity.com.

All business is risky business

More importantly, it is not just website design platforms that are susceptible to attacks. Guy Podjarny, security researcher at open source security company Snyk, said, in a blog in June 2017, that 50% of all website vulnerabilities reported since 2012 were XSS. And security researchers at Netsparker have already identified DOM-based XSS issues in high-profile internet companies such as Google, Yahoo and Alexa.

Similarly, Denis Sinegubko, founder of Unmask Parasites and a senior malware researcher at Sucuri, believes hackers are more likely to attack larger companies, seeking higher rewards, and also that websites hosted on platforms make vulnerabilities easier to fix.

“Generally, if a platform allows you to insert HTML of third-party scripts and iframes, it can be abused to serve a malicious code. However, we didn’t see serious massive attacks on those sites recently, but we have seen attacks on multinationals and their systems,” says Sinegubko.

“In our experience, the main areas of abuse for small to medium-sized businesses are spam via custom templates and using ad-backed widgets. Otherwise, the hacks are not massive. However, if hackers find a vulnerability in the platform itself, that will allow them to modify any sites hosted there, we’ll definitely see massive attacks," he says.

“On the other hand, such attacks can be quickly mitigated, as most likely they won’t require action from thousands of individual webmasters, but rather just a coordinated effort from the platform staff.”

Ultimately, the consensus seems to be that security should take priority over customisability, and more should be done to educate SME owners of the exploits hackers can take advantage of.

Switching to a cloud-based website design platform doesn’t necessarily mean your business is more prone to security exploits, but if users, platform owners, vulnerability assessment specialists and experts ignore the risks that exist in a cyber warfare-infested world, the consequences could be catastrophic.