The security risk in Web 2.0 | CNET News.com (1)

来源:百度文库 编辑:神马文学网 时间:2024/03/29 20:01:44
The security risk in Web 2.0
Security has become a no-brainer for desktop software, but the same doesn‘t hold true for the booming world of Web applications.
ByJoris Evers
Staff Writer, CNET News.com
Published: July 28, 2006, 4:00 AM PDT
TalkBackE-mailPrintdel.icio.usDigg this
Web 2.0 is causing a splash as it stretches the boundaries of what Web sites can do. But in the rush to add features, security has become an afterthought, experts say.
The buzz around the new technology echoesthe ‘90s Internet boom--complete with pricey conferences, plenty of start-ups, and innovative companies like MySpace.com and Writely being snapped up for big bucks. And the sense of deja vu goes even further for some experts. Just as in theearly days of desktop software, they say, the development momentum is all about features--and protections are being neglected.
High Impact
What‘s new:
Security has been overlooked in the rush to adopt Web 2.0 features on sites, some experts say.
Bottom line:
While surfers can find some PC protection in security software, the burden is on developers to make sure they don‘t leave any loopholes for attackers.
More stories on this topic
"We‘re continuing to make the same mistakes by putting security last," said Billy Hoffman, lead engineer at Web security specialist SPI Dynamics. "People are buying into this hype and throwing together ideas for Web applications, but they are not thinking about security, and they are not realizing how badly they are exposing their users."
Yamanner, Samy and Spaceflash are among the higher-profile attacks that have surfaced online. The Yamanner worm targeted Yahoo Mail, harvesting e-mail addresses and forwarding itself to all contacts in a user‘s Yahoo address book. TheSamy andSpaceflash worms both spread on MySpace, changing profiles on thehugely popular social-networking Web site.
Web 2.0 lacks a precise definition; it‘s used mainly as a catch-all term to cover Web sites that are more than just plain, static pages. Web 2.0 sites are more interactive, allowing people to tag photos posted online, for example. Unlike their predecessors, they deliver an experience moreakin to using a desktop application.
One of the key enablers of the flashier Web sites is aprogramming technique known as AJAX, which stands for "Asynchronous JavaScript and XML."Google Maps, launched last year, was one of the first Web applications toshowcase the benefits of AJAX development techniques to a broad audience, when it let people use a mouse to move a map image around the screen.
But AJAX doesn‘t just help make Web pages and sites more interactive. It could also provide ways for hackers to hit a Web server and to exploit sites in attacks on visitors, experts said.
"Think of it like a house," said Hoffman, who will give a presentation on AJAX security at next week‘sBlack Hat security event in Las Vegas. "A traditional Web site is like a house with no windows and just a front door. An AJAX Web site is like a house with a ton of windows and a sliding door. You can put the biggest locks on your front and back doors, but I can still get in through a window."
A Web site based on the new programming techniques has a greater "attack surface" because it has many more interactions with the browser and may run JavaScript on the client PC, he noted. JavaScript is a scripting programming language popular on Web sites. In contrast, old-fashioned Web sites typically accept information through forms.
Cross-site scripting
AJAX also increases the possibility of so-calledcross-site scripting flaws, which occur when the site developer doesn‘t properly code pages, experts said. An attacker canexploit this type of vulnerability to hijack user accounts, launch information-stealing phishing scams or even download malicious code onto users‘ computers, experts have said. Big-name Web companies such as Microsoft, eBay, Yahoo and Google have all experiencedcross-site scripting flaws on their Web sites.
"I think it would be naïve for anyone to say that there are no security problems."--Ryan Asleson, co-author, "Foundations of Ajax"
But cross-site scripting issues are only one risk. Other potential problems in AJAX code include race conditions, code correctness issues, object model violations, insecure randomness and poor error handling, said Brian Chess, chief scientist atFortify Software, a maker ofsource-code analysis tools.
Such errors could expose people‘s data, let one user control another user‘s session, allow malicious code to run, or enable other attacks, Fortify said. The company‘s researchers found examples of all of these errors in sample AJAX code in a December analysis of "Foundations of Ajax," a how-to-book aimed at software developers.
"Since the code samples (in the book) are likely to be regarded as a best-practices guide, many software developers worldwide will learn insecure coding habits," Chess said.
Ryan Asleson, one of the authors of "Foundations of Ajax," said he had not heard of the alleged flaws in the sample code. However, he said, if those problems do exist, it is possible, because the code was kept as simple for a large audience. "We never intended the code that‘s in there to actually be production-ready code," he noted.
CONTINUED:New development, old mistakes...
Page 1| 2