Issues And Limitations Of Third Party Security Seals
summary
Scanning of the seal ecosystem finds more than 8,000 sites using third‑party security seals, often e‑commerce, with prices from $84 to over $2,000 a year. Empirical tests show weak results: a controlled vulnerable prestashop with 12 injected vulnerabilities fools many scanners, two providers find none, and manual tests expose 7 of 9 cooperating sealed sites as vulnerable. Attacks include visibility polling as an oracle, proxyed scans that reveal exact flaws, and referer/meta tricks that resurrect badges for phishing.
AI-written summary · about
chapters (6)
- 0:00Start
- 6:17Security Seal Providers
- 9:29Security Seal Customers
- 11:28Security Evaluation
- 15:14Manual Penetration Test
- 33:37Conclusion
related talks
44mA Matter Of Trust: When Security Is Not Enough
40mWebsite security 101
23mAdventures in Vendor Security and Continuous Review
44mApplication Security: Everything we know is wrong
26mBuilding and Verifying Security Trust in Today’s Complex Tech Stacks ...
33mSecurity on a Shoestring: A Low-Budget Security Revival Tour (Jared Casner)
01h 00mSecurity Theatre
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!