The Penthouse, Triq Manwel Dimech, Sliema
[email protected]
+356 7950 1630
Shop Cart Checkout

Ahrefs: Data Breach with Vulnerable Security?

Ahrefs Data Breach with Vulnerable Security
by
March 8, 2024
in Companies & People, Editor’s Choice 2
204

In a new digital environment, secure operations are in online platforms, serving not only for integrity and confidentiality of data but mainly to keep users’ trust and reliance placed on these services.

However, a fresh analysis has raised serious question marks over the security measures employed by Ahrefs , the world’s leading provider of an all-in-one #SEO toolset, saying that it exposes vulnerabilities that might lead to compromise with user data and privacy.

HTTP Strict Transport Security (HSTS) Not Enforced

Another basic overlook identified is non-enforcement of HTTP Strict Transport Security (HSTS). This is a very good security feature that would ensure that users connect to a website over HTTPS when securing the data in transit.

Without HSTS, this means that #Ahrefs users are much more exposed to man-in-the-middle attacks, in which a third party watching the exchange of information between two others gets the opportunity to intercept and possibly alter either the message or the information.

Insecure Cookie Handling

The search went further to indicate that Ahrefs did not enforce secure cookies. Secure cookies can be considered as cookies that are encrypted and thus only accessed by information contained by the said authorized personnel.

This, therefore, lays bare any information on sessions, including session tokens and personal data, which is easily intercepted by third parties when there are no secure cookies. This is an abuse, which should prompt an immediate redraft of the ‘Set-Cookie’ headers to include the ‘secure’ attribute, so that the cookies are only sent over encrypted connections.

Content Security Policy (CSP) Implemented Unsafely

Another crucial finding is the unsafe implementation of the Content Security Policy (CSP). #CSP, on the other hand, is the technology devised to control the hostile sources that target the loading of particular content, with the aim to prevent the cross-site scripting (XSS) attack.

However, the CSP configuration in Ahrefs is relaxed in such a way that it allows ‘unsafe-inline’ scripts. But there’s no way to protect inline scripts and styles with nonce or hash, hence leaving #XSS as a great risk both for the user’s data and the website.

Absence from the HSTS Preload List

Still on the vulnerabilities list, the domain from Ahrefs is not in the HSTS preload list. On the other hand, adding a domain to the list will ensure that browsers enforce connections in their default secure state to the domain, therefore effectively reducing the vulnerability to a #MITM attack.

Not including in this list would mean that a user coming for the first time to the website would not be given any security guarantees by #HSTS and, as a result, might suffer any attacks.

Support for Weak Cipher Suites

And last but not least, note that the servers support weak ciphers in TLS 1.2. A cipher suite is a combination of algorithms used to protect information passed over the internet. In such an event, the weak cipher suite, therefore, makes it vulnerable to decryption by well-resourced attackers, hence a compromise in the data in transit, resulting in loss of confidentiality and integrity.

This vulnerability, therefore, underscores that Ahrefs hardens its server configuration to allow only strong cipher suites in the provision of robust encryption.

Finally, UpGuardis a world leader in #cybersecurity risk management, and it provides a comprehensive vendor #risk report that fully elucidates the situation with the digital security posture of Ahrefs.

The UpGuard Rating for Ahrefs is based on our own and dynamically updated algorithmic consideration of multiple sources of threat intelligence data: open-source, commercial, and internally developed.

The analysis includes literally hundreds of individual checks, all grouped under five main categories of critical risk: website security, email security, and phishing & malware, brand and reputation risk, and network security.

These findings are aggregated to produce an overall security rating that reflects the cumulative risk associated with the operations of Ahrefs. This report continues to represent how the actual fact remains; there are many threats and issues that are faced within the cybersecurity domain and that they need to be handled by way of an all-encompassing approach.

In other words, said, the very detailed insights up for risk from the vendor underscore very specific areas of possibility in which Ahrefs could improve its security measures to ensure more effective risk mitigation, securing their infrastructure and, by extension, their data.

Our Final Words

The findings outlined above raise serious concerns about the security measures implemented by Ahrefs.

These are the basic fundamental user data and privacy vulnerabilities where, without any data breach, Ahrefs is responsible enough to ensure these are addressed quickly so that their users have confidence in their platform. The digital world mandates vigilance, asking for proactive steps in security to keep evolving cyber threats at bay.

Frequently Asked Questions (FAQs):

What is the significance of HTTP Strict Transport Security (HSTS) in online security?
HSTS ensures secure connections over HTTPS, protecting data in transit. Ahrefs’ non-enforcement exposes users to potential man-in-the-middle attacks.

How does insecure cookie handling impact Ahrefs users’ data and privacy?
Ahrefs’ failure to enforce secure cookies exposes session information, including tokens and personal data, making it susceptible to interception by third parties.

What is the role of Content Security Policy (CSP) in preventing cyber attacks?
A properly implemented CSP prevents cross-site scripting (XSS) attacks by controlling the loading of specific content. Ahrefs’ unsafe CSP configuration poses a risk to user data and website security.

Why is the absence of Ahrefs from the HSTS preload list a security concern?
A domain on the HSTS preload list ensures default secure connections, reducing vulnerability to man-in-the-middle attacks. Ahrefs’ exclusion may leave first-time users without security guarantees.

How does support for weak cipher suites in Ahrefs’ servers impact data integrity?
Ahrefs’ support for weak ciphers in TLS 1.2 makes data vulnerable to decryption, compromising confidentiality and integrity. Strengthening cipher suites is crucial for robust encryption.

Share

With over 20 years experience in web design, SEO and website promotion I always give you an expert advice in regard to any issues related to your Site Design, SEO, Internet Marketing, Promotion, Backlinks, Site Content. In order to help you find out what is missing or can be improved and get higher rankings in Google and more traffic.

Recommended Posts