Hey, You Have a Problem: On the Feasibility of Large-Scale Web Vulnerability
summary
Study scans the Alexa top million and finds 44,000 vulnerable domains (WordPress and site-specific DOM XSS), splits them into five groups, and sends targeted emails, WHOIS contacts, hosting abuse reports and aggregated lists to CERTs/providers. Only 2,064 (5.8%) reports received and viewing a report yields about 40% fix-after-read, but overall 74.5% remain exploitable after a month. WHOIS works best for WordPress, trusted third parties for client-side XSS, and reminders increase clicks but not enough fixes.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:27Motivation and Research Questions
- 1:32Types of Vulnerabilities
- 2:57Communication Channels
- 4:37Notification Procedure
- 6:20Web Interface
- 7:34Measurements
- 9:27Fixed Sites over Time
- 12:16Reachability of Direct Channels
- 15:48Time to Fix after Report View
- 18:18Need for Reminders and Time to Fix
- 19:36Sender Reputation
- 21:25User Distrust
- 24:50Conclusion
related talks
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015
50mWorrisome Web Vulnerability Trends in the Race to Innovation
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
36mHow the WordPress Ecosystem Handles Security and What You Can Learn from It
30mThe Myth of the Meteoric Rise in Vulnerabilities
52mDemystifying Front-End Security
58mNothing to Risk but Risk Itself: Expanding Vulnerability Risk with Internet-Scale Data
40mClient-Side Protection Against DOM-Base...