Popular website security solution not safe enough: Study

Computer scientists have found that the most common used Domain Name System (DNS) redirection strategy -- the success of which depends on shielding the website's original IP address -- is not secure as it can easily be bypassed.

Websites and online services increasingly have to deal with acts of cybercrimes.

"Website owners can protect themselves against cyberattacks by installing dedicated hardware," said Thomas Vissers from the University of Leuven.

"Yet, this is typically too expensive and too complex for most of them. That's why website owners often rely on the services offered by cloud-based security providers," he added.

One strategy these providers commonly use to protect websites includes diverting incoming web traffic via their own infrastructure which is sufficiently robust to detect and absorb cyberattacks.

"However, the success of this strategy heavily depends on how well the website's original IP address can be shielded. If that IP address can be retrieved, protection mechanisms can easily be bypassed," Vissers said.

According to the researchers, this is the Achilles heel of cloud-based security.

Nearly 18,000 websites, protected by five different providers, were subjected to the team's DNS redirection vulnerability tests.

The researchers built a tool called CLOUDPIERCER, which automatically tries to retrieve websites' original IP address based on eight different methods, including the use of unprotected subdomains.

The results were pretty confronting. In more than 70 percent of the cases, CLOUDPIERCER was able to effectively retrieve the website's original IP address, thereby, providing the exact information that is needed to launch a successful cyberattack.

The findings were presented at the 22nd ACM Conference on Computer and Communications Security (CCS) held in Denver, Colorado, recently.

"With CLOUDPIERCER, people can test their own website against the eight methods that we have used in our research. CLOUDPIERCER scans the website, and indicates to which IP detection method it is most vulnerable," Vissers noted.

The tool has been made available for free.