Half of popular websites vulnerable: study