Researchers: Users allowed to access infected sites found through search engines

Users are largely allowed to access infected websites found through search engines, according to new research published Tuesday.

Security firm SiteLock scanned more than 6 million of their clients’ sites during the second quarter of 2018.

The firm found only 17 percent of infected sites are blacklisted by search engines like Google, meaning visitors to those sites could be unwittingly exposing themselves to malware.

That statistic generally held from SiteLock’s findings in the first quarter of 2018, pointing to a lack of action on blacklisting the sites.

{mosads}Jessica Ortega, a web security research analyst for SiteLock, said search engines are often hesitant to blacklist sites unless they are entirely certain that it is a security risk, because flagging a site can cause substantial damage to the site or their reputation.

She said that the responsibility to secure sites instead falls on the website owners.

“If websites’ owners are not taking the security of their websites seriously, it really can harm their visitors and the average search engine users,” Ortega said.

SiteLock researchers also found websites are attacked 58 times a day on average, with bots carrying out the majority of attacks. The firm found malicious bots made up 87 of the traffic filtered by its web application firewalls.

And 9 percent of the sites reviewed by the firm were also found to have at least one cyber vulnerability, with more than 170 million sites around the world estimated to have a vulnerability.

Ortega said that bots are often created to scan for newly announced vulnerabilities on sites and take advantage of those opportunities when they’re identified.

The report also highlighted the potential targeting of open-source content management systems like WordPress and Drupal.

While similar services only provide updates once or twice a quarter, Drupal uncovered a major security risk in a previous version of the software, prompting it to push multiple updates in a few months.

The SiteLock report found that 77 percent of Drupal sites were still running a previous core version of the software, opening up the sites to possible malware attacks.

Ortega said that site owners who don’t utilize automatic updates may not have realized the importance of updating the software.

She said that with so many updates in a short period of time, it “can be very difficult to keep up with.”