ImmuniWeb

Security Advisories

The ImmuniWeb Security Research Team (formerly known as High-Tech Bridge) has released over 500 security advisories[2] affecting various software, with issues identified in products from many well-known vendors, such as Sony,[3] McAfee[4] Novell,[5] in addition to many web vulnerabilities affecting popular open source and commercial web applications, such as osCommerce,[6] Zen Cart,[7] Microsoft SharePoint, SugarCRM and others.

The Security Research Lab was registered as CVE and CWE compatible by MITRE.[8] It is one of only 24 organizations, globally, and the first in Switzerland, that has been able to achieve CWE certification.

The company is listed among 81 organizations, as of August 2013, that include CVE identifiers in their security advisories.[9]

Free Online Services and Related Research

ImmuniWeb launched an SSL/TLS configuration testing tool in October 2015.[10] The tool can validate email, web or any other TLS or SSL server configuration against NIST guidelines and checks PCI DSS compliance, it was cited in articles covering the TalkTalk data breach.[11][12]

Security and Privacy Research

The discovery of vulnerabilities in Yahoo! sites by the company was widely reported,[13][14] leading to the t-shirt gate affair and changes in Yahoo's bug bounty program. The firm identified and reported four XSS vulnerabilities on Yahoo! domains, for which the company was awarded two gift vouchers to the value of $25.[15][16][17][18] The sparse reward offered to security researchers for identifying vulnerabilities on Yahoo! was criticized, sparking what came to be called t-shirt-gate,[19] a campaign against Yahoo! sending out T-shirts as thanks for discovering vulnerabilities. The company's discovery of these vulnerabilities and the subsequent criticism of Yahoo!'s reward program led to Yahoo! rolling out a new vulnerability reporting policy which offers between $150 and $15,000 for reported issues, based on pre-established criteria.[14][20]

In December 2013, the firm's research[21] on privacy in popular social networks and email services was cited[22][23] in a class action lawsuit for allegedly violating its members' privacy by scanning private messages sent on the social network.

In October 2014, the company discovered a Remote Code Execution vulnerability in PHP.[24] In December 2014, they identified the RansomWeb attack,[25] a development of Ransomware attacks, where hackers have started taking over web servers, encrypting the data on them and demanding payment to unlock the files.

In April 2014, the discovery[26] of sophisticated Drive-by download attacks, revealed how drive-by download attacks are used to target specific website visitors after their authentication on a compromised web resource.

In December 2015, the company tested the most popular free email service providers, for SSL/TLS email encryption.[27] Hushmail, previously considered as one of the most secure email providers, received a failing "F" grade. Just after, the company updated its SSL configuration and received a score of "B+".[28]