E-commerce in the Middle East – On the Up and Up!

E-commerce is on a massive upward trajectory in the Middle East and North Africa (MENA) region. According to a recent report issued by Visa[1], nowhere else in the world is growing as fast: MENA experienced a 45% increase in 2012, compared to the previous year, with transactions soaring from $10 to $15 billion.[2] The fastest growing markets

For retailers who have tended to ignore or avoid this market, in favour of others that have seemed both more stable and lucrative, those figures are bound to make them think again. This is fertile territory and many of their rivals are now clearly reaping the rewards to be had there. So expect to see competition hotting up!

What are people buying online right now and how can the MENA region overcome some fundamental factors to drive growth even higher? The popular and growing areas for e-commerce right now are banking, paying bills and booking travel. Purchasing items and/or services is still not as developed as in the major European markets, and clearly this offers vast promise for those who can exploit its vast potential in the MENA region[3].

That said, and despite its impressive performance of late, the MENA region is still not actually expanding at nearly the same rate as the rest of the globe when it comes to e-commerce.  Why is this? In part it’s down to lack of confidence and trust online; according to a recent survey by Onecard, 56 per cent of respondents based in the Middle East said they were concerned about credit card fraud and the region faces the same barriers seen elsewhere around the world, where lack of trust and payment security are regularly highlighted as key concerns for people when choosing to shop online. Additionally a report from Deloitte highlights[4] that it is there are three other factors that are holding growth back:

First, there are the logistical issues around physical addresses (they are not well defined enough) and also the postal system itself, whose infrastructure is poor.

Secondly, there is an absence of the relevant e-laws necessary to provide proper levels of protection for consumers and vendors.

And, finally, it can be expensive for small businesses to set up payment gateways, thus deterring them from entering the market – a factor that is reflected in the widespread popularity of cash on delivery (COD) payments across the region. Strikingly, while there are an estimated 90 million internet users in the Middle East, a mere 15% of Middle East companies have an online presence.[5] Moreover, some 70-80% of online purchases are COD, with just 30% paid for online – and that despite almost 50% of consumers owning credit cards.

At the same time, it should be said that such flexibility of payment types has certainly made e-commerce more accessible, and more attractive, to users; and no doubt has contributed substantially to the surge in sales that has taken place recently. Whilst ‘cash on delivery’ is a good solution to consumers’ lack of trust in online transactions, it can hinder the growth of e-commerce in the region due to difficulty in coordinating home delivery services and ultimately it’s much less cost effective than taking payments online. As mentioned above, ecommerce comes branded with what is a typical online question for end users and retailers alike: ‘Are you safe?’ Because, unless they truly believe that they can operate securely online – and that transactions can be undertaken and completed in a tightly protected environment – the massive potential that MENA offers will simply not be realised.

These issues are of course being addressed and in anticipation of this it’s worth considering that in order to Be successful online, and to capture more consumer mindshare and business, sites need to be:

  • Accessible (particularly for mobile) – consider responsive design to meet the needs of your visitors
  • Easy to use – e.g. clear navigation and extensive search
  • Trustworthy – demonstrate that your site can be trusted with credit card details using clear security indicators such as SSL, and through the use of online trust marks such as the Norton Secured Seal
  • Fully localised into your target markets language.

All well and good… in theory. The reality is that, while it’s relatively simple to set up an e-commerce site, there is still widespread ignorance of the potential hazards that exist when sending data via unsecured connections. In fact, many customers still do not even know that SSL certificates exist to protect them online.

Clearly, sites in the Middle East region that really want to be successful should be using SSL and trust marks to demonstrate that they are professional, dependable and safe to do business with. Indeed in my opinion SSL certificates should be mandatory for any ecommerce site or for anyone else that asks customers to submit any kind of personal information. Using SSL is also the clever option for companies that don’t ask for personal information from visitors – something that can act as a barrier on line. Companies such as Google use SSL to pass along certain information about what searchers are looking for – and are requiring this higher level of security to perform that service. This trend seems likely to continue, making SSL certificates vital to virtually any website – but especially those with e-commerce in mind.

One question when considering which security vendor can add the most value to your existing or newly established site is “how can I can demonstrate my trustworthiness to potential customers?” According to a survey carried out this year by the independent web research organisation Baymard Institute in conjunction with Google, the Norton Secured Seal is by far the most trusted, with 35.6% of the votes – nearly 13% ahead of its nearest rival. It was shown to be the seal that gave customers the strongest sense of trust when purchasing online, making it the de facto choice[6].

Such reassurance will play a major role, as the internet spreads it reach and e-commerce gathers ever greater momentum throughout MENA capturing and keeping customers is where success lies.

 

Back to School: Do You Know ‘Who’ Is In Your Child’s Backpack?

It’s that time of year again. You head out to the store to buy a truckload of number two pencils and color-coded binders along with a flood of other dazed parents who can’t believe school is back in session. So you pretty much know what is in your child’s backpack but do you know who Read more…

AVAST detects and blocks 100% of Zeus Trojans in Banking Security Test

avast! Internet Security detects and blocks 100% of the world’s most malicious Zeus Trojan strains. The Zeus Trojan is the most prevalent type of financial malware. Zeus infects a user’s computer and lies in wait until the user logs on to a banking website. Once that occurs, it attempts to steal the user’s bank account […]

BYOD: Balancing Convenience and Security

      No Comments on BYOD: Balancing Convenience and Security

It lies next to you as you sleep, comes with you to work, rides home with you in your car and even travels with you on vacation. Your smartphone goes with you everywhere. Although convenient, the unprecedented connectivity we are experiencing culturally with mobile devices can create an equally daunting issue when it comes to Read more…

Targeted Attacks Delivering Fruit

      No Comments on Targeted Attacks Delivering Fruit

Contributor: Lionel Payet
Political news has always been one of the top topics used in targeted attacks. Last week we came across unique malicious emails targeting high-profile companies in Europe and Asia (in sectors such as finance, mining, telecom, …

Cover Yourself: Google Leaves Your Passwords Exposed

We would like to assume that passwords saved in our web browser are stored in a secured virtual lock box, helping us to surf the web with increased speed and easily log into our favorite sites without sacrificing safety. Unfortunately, this might not be the case on Google Chrome, as it was recently brought to Read more…

What is a Zero-Day Threat?

      No Comments on What is a Zero-Day Threat?

The term “zero-day threat” may sound like the title of a hit film, but it’s definitely not that kind of thriller. A zero-day threat or attack is an unknown vulnerability in your computer or mobile device’s software or hardware. The term is derived from the age of the exploit, which takes place before or on Read more…

Android Cryptographic Issue May Affect Hundreds of Thousands of Apps

There’s been a lot of confusion over the last few days, since bitcoin.org announced that an Android component responsible for generating secure random numbers contained a critical weakness that rendered many Android bitcoin wallets vulnerable.
Th…

Microsoft Patch Tuesday – August 2013

      No Comments on Microsoft Patch Tuesday – August 2013

Hello, welcome to this month’s blog on the Microsoft patch release. This month the vendor is releasing eight bulletins covering a total of 23 vulnerabilities. 14 of this month’s issues are rated ’Critical’.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft’s summary of the July releases can be found here:
http://technet.microsoft.com/en-us/security/bulletin/ms13-Aug

The following is a breakdown of the issues being addressed this month:

  1. MS13-066 Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (2873872)

    AD FS Information Disclosure Vulnerability (CVE-2013-3185) MS Rating: Important

    An information disclosure vulnerability exists in Active Directory Federation Services (AD FS) that could allow the unintentional disclosure of account information.

  2. MS13-062 Vulnerability in Remote Procedure Call Could Allow Elevation of Privilege (2849470)

    Remote Procedure Call Vulnerability (CVE-2013-3175) MS Rating: Important

    An elevation of privilege vulnerability exists in the way that Windows handles asynchronous RPC requests. An attacker who successfully exploited this vulnerability could execute arbitrary code and take complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

  3. MS13-064 Vulnerability in Windows NAT Driver Could Allow Denial of Service (2849568)

    Windows NAT Denial of Service Vulnerability (CVE-2013-3182) MS Rating: Important

    A denial of service vulnerability exists in the Windows NAT Driver that could cause the target system to stop responding until restarted.

  4. MS13-060 Vulnerability in Unicode Scripts Processor Could Allow Remote Code Execution (2850869)

    Uniscribe Font Parsing Engine Memory Corruption Vulnerability (CVE-2013-3181) MS Rating: Critical

    A remote code execution vulnerability exists in the Unicode Scripts Processor included in affected versions of Microsoft Windows. An attacker who successfully exploited this vulnerability could run arbitrary code as the current user.

  5. MS13-065 Vulnerability in ICMPv6 could allow Denial of Service (2868623)

    ICMPv6 Vulnerability (CVE-2013-3183) MS Rating: Important

    A denial of service vulnerability exists in the Windows TCP/IP stack that could cause the target system to stop responding until restarted. The vulnerability is caused when the TCP/IP stack does not properly allocate memory for incoming ICMPv6 packets.

  6. MS13-059 Cumulative Security Update for Internet Explorer (2862772)

    Internet Explorer Process Integrity Level Assignment Vulnerability (CVE-2013-3186) MS Rating: Moderate

    An elevation of privilege vulnerability exists in the way that Internet Explorer handles process integrity level assignment in specific cases. An attacker who successfully exploited this vulnerability could allow arbitrary code to execute with elevated privileges.

    EUC-JP Character Encoding Vulnerability (CVE-2013-3192) MS Rating: Moderate

    An information disclosure vulnerability exists in Internet Explorer that could allow script to perform cross-site scripting attacks. An attacker could exploit the vulnerability by inserting specially crafted strings into a website, resulting in information disclosure when a user viewed the website.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3184) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3187) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3188) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3189) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3190) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3191) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3193) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3194) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

    Internet Explorer Memory Corruption Vulnerability (CVE-2013-3199) MS Rating: Critical

    A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

  7. MS13-063 Vulnerability in Windows Kernel Could Allow Security Feature Bypass (2859537)

    ASLR Security Feature Bypass Vulnerability (CVE-2013-2556) MS Rating: Important

    A security feature vulnerability exists in Windows due to the improper implementation of the Address Space Layout Randomization (ASLR). The vulnerability could allow an attacker to bypass the ASLR security feature, most likely during, or in the course of exploiting, a remote code execution vulnerability. The attacker could then load a DLL in the process.

    Windows Kernel Memory Corruption Vulnerability(CVE-2013-3196) MS Rating: Important

    An elevation of privilege vulnerability exists in the Windows kernel due to a memory corruption condition in the NT Virtual DOS Machine (NTVDM). An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

    Windows Kernel Memory Corruption Vulnerability(CVE-2013-3197) MS Rating: Important

    An elevation of privilege vulnerability exists in the Windows kernel due to a memory corruption condition in the NT Virtual DOS Machine (NTVDM). An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

    Windows Kernel Memory Corruption Vulnerability(CVE-2013-3198) MS Rating: Important

    An elevation of privilege vulnerability exists in the Windows kernel due to a memory corruption condition in the NT Virtual DOS Machine (NTVDM). An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

  8. MS13-061 Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution (2876063)

    Oracle Outside In Contains Multiple Exploitable Vulnerabilities (CVE-2013-2393) MS Rating: Critical

    Remote Code Execution vulnerabilities exist in Exchange Server 2007 and Exchange Server 2010 through the WebReady Document Viewing feature. The vulnerabilities could allow a remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser.

    Oracle Outside In Contains Multiple Exploitable Vulnerabilities (CVE-2013-3776) MS Rating: Critical

    Remote Code Execution vulnerabilities exist in Exchange Server 2007 and Exchange Server 2010 through the WebReady Document Viewing feature. The vulnerabilities could allow a remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser.

    Oracle Outside In Contains Multiple Exploitable Vulnerabilities (CVE-2013-3781) MS Rating: Critical

    Remote Code Execution vulnerabilities exist in Exchange Server 2007 and Exchange Server 2010 through the WebReady Document Viewing feature. The vulnerabilities could allow a remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser.

More information on the vulnerabilities being addressed this month is available at Symantec’s free SecurityFocus portal and to our customers through the DeepSight Threat Management System.

avast! Free Mobile Security collects another award from AV-TEST

There are lots of Android security apps to choose from, but avast! Free Mobile Security has got the goods compared to many paid-for solutions, and it’s FREE. Independent German testing lab AV-Test evaluated 30 mobile security products for Android and awarded AVAST with its coveted certification for the product’s excellent protection against malicious apps (99.8%) […]