Blog | G5 Cyber Security

Is HTTPS Safe? Malicious Websites & SSL

G5 Cyber Security

TL;DR

HTTPS (the padlock in your browser) means your connection to a website is encrypted, protecting your data in transit. It doesn’t guarantee the site itself is safe or trustworthy. Malicious websites can still use HTTPS.

Why HTTPS Doesn’t Mean ‘Safe’

HTTPS only encrypts communication between your computer and the website server. It does not verify who owns the website, whether it contains viruses, or if it will steal your information. Think of it like a secure tunnel – it protects what’s inside the tunnel, but doesn’t check where the tunnel leads.

How Malicious Sites Use HTTPS

  1. Phishing: Attackers create fake websites that look identical to legitimate ones (e.g., your bank). They get an SSL certificate for these sites so they appear secure, tricking you into entering your username and password.
  2. Malware Distribution: A compromised website with HTTPS can still serve malware. The encryption protects the download process but doesn’t prevent the file from being harmful.
  3. Data Theft: Even with HTTPS, a malicious site can collect your personal information (e.g., credit card details) and use it for fraudulent purposes. The data is encrypted while sent, but decrypted on their server.

How to Check if a Site is Safe – Beyond the Padlock

  1. Check the SSL Certificate: Click the padlock icon in your browser’s address bar and examine the certificate details.
    • Issued To: Verify that the certificate is issued to the correct domain name.
    • Validity Period: Ensure the certificate hasn’t expired.
    • Issuer: A reputable Certificate Authority (CA) like Let’s Encrypt, DigiCert, or Sectigo is a good sign.
  2. Look for Trust Seals/Badges: Websites may display trust seals from security companies (e.g., Norton Secured, McAfee Secure). However, these can be faked – click the seal to verify it on the company’s website.
  3. Use Website Reputation Tools: Several online tools check a website’s reputation and safety.
  4. Be Wary of Suspicious URLs: Pay attention to the domain name. Look for typos, extra characters, or unusual extensions (e.g., .xyz instead of .com).
  5. Check Website Content: Be cautious if a website asks for excessive personal information or has poor grammar and spelling.

Technical Checks (For Advanced Users)

  1. DNS Lookup: Use the nslookup command to verify the domain’s DNS records. 
    nslookup example.com

    Check if the IP address matches the expected server for that website.

  2. WHOIS Lookup: Find out who owns the domain using a WHOIS lookup tool (e.g., DomainTools). Look for inconsistencies or hidden registration information.
  3. SSL Labs SSL Server Test: Use this tool (SSL Labs) to analyze the website’s SSL configuration and identify potential vulnerabilities.

Staying Safe Online

Exit mobile version