Websense, a web security company, said in a recent report called the State of Internet Security, that 70 percent of the top 100 sites had been hacked to serve malware to unsuspecting users. Some of the most recent examples include the websites of Paris Hilton, Paul McCartney, Anti Virus vendors Kaspersky and F-Secure, Facebook, MSN, Twitter along with many, many others.
Even if your site isn't among the web's top 100, you still need to be very vigilant. IBM recently reported that 450,000 web sites EVERY DAY are being hit by cyber criminals attempting to hack them. How sure are you that your site is clean and not being used by criminal elements to deliver malware? In this column I will show you some basic tools and show you how to use them to perform a quick check.
The first tool that we're going to use is a great program called Sandboxie. After you install the program, go ahead and run an Internet browser inside it. After the program starts, open the program's main window. From there, choose the "View" drop down menu and then "Files and Folders." Running your web browser connected to a safe site should not give you any error messages.
Then I went looking for trouble. In fact, all I did was open my SPAM filter and start clicking links. At least one of the sites installed some very suspicious software on my computer. Be VERY suspicious of any site that downloads files to your computer without your knowledge or if the site says it needs to load a program in order for you to be able to see its content.
Our next tool was written by Microsoft and works with Internet Explorer. It's called Fiddler and can be downloaded for free. This program is a bit more technical than Sandboxie but it also provides more information. Fiddler is a program used to debug web pages by monitoring all traffic between a web page and a browser and its output is more detailed.
Every time the web sends information to a browser it is logged along with the type of communication protocol used (HTTP), exactly who was sending the information (useful to make sure that only those sites that you allow are accessing your customers), and the type of content being transferred. Fiddler is a very powerful tool and you can dive into it as far as your technical skills allow. Simply be careful when using the Auto Responder and Request Builder tools.
The last tool we will explore is an add-on to the Firefox browser. Security Compass is the software company that wrote the add-on and actually has three tools worth trying: XSS Me, Access Me and SQL Inject me. As the names imply, each add-on tests for different vulnerabilities. This set of tools, unlike the previous two, actively sends information to a website looking for vulnerabilities and should be used only against sites that you own or control. The tools produce an easy to read report which summarizes any problems that it finds (make sure to disable any other add-ons that you may have running) and even test input fields for database vulnerabilities such as SQL injection attacks.
Remember though that the tools in this article are free may not be as comprehensive or thorough as tools that cost thousands of dollars.
With these pieces of software you have a basic toolbox for testing your web pages. Check your sites often and make sure that you have a clean restore disk image just in case you should ever need it.
