Web 2.0 vulnerabilties to watch for

New Web applications bring a number of new security challenges

New Web applications such as wikis, blogs and podcasts that foster increased collaboration and communication have enjoyed a great proliferation in recent months. They have brought with them, however, a number of new security challenges with which corporate network managers now have to contend.

According to Robert Hansen, president of California-based security consultancy SecTheory, the use of programming languages such as Java and Ajax, as well as the JSON data interchange format, in Web 2.0-style apps has created another door from which nefarious elements can enter a company's back end and do irreparable damage.

With traditional Web pages, visitors load it up and that one page would return with the results the person is looking for, Hansen says.

"It is a very binary, back-and-forth connection, and it's also very easy for programmers to understand how to protect that....All they do is filter the output to make sure the results don't contain malicious content."

The problem with Ajax and JSON, he says, is that one request has actually become two: one to a page that has some JavaScript on it, which in turn makes a request to a JavaScript function or XML component which returns data back to that original page.

"So there are actually two places where you have to think about your security instead of one," Hansen says. "The JavaScript is making the calls on [the visitor's] behalf. You have to know that your surface area has increased."

The breaches most often associated with these types of attacks, Hansen says, are credential thefts, such as account settings for a G-Mail account. However, he adds, there is far worse that can be done.

"If you go to my Web page and you pull down my JavaScript, and I'm a bad guy, I can force your browser to connect anywhere I want it to, which includes other machines inside your [corporation's] firewall."

The hacker could then force a user's browser to connect to internal services and try to exploit them. "This is a new class of attack and these are just for starters," Hansen says.

He adds that while he does not have evidence of such an attack taking place, Internet users should not deny its presence. "It's incredibly difficult to detect, so it's hard to tell if it is or isn't happening."

He points to a piece of JavaScript circulating on the Internet called jikto, which can play a role in carrying out this style of attack.

"I have talked to a couple of black hat search engine optimization guys -- and these are not nice guys, by the way -- who have decided that that is an 'interesting technology' for them."

Using JavaScript to get into previously well-guarded areas of the network can play havoc with some companies' customer-facing Web sites that utilize it extensively, Hansen adds. Banks are a prime example.

"They actually use it to try to protect you, but as a result you're ending up having JavaScript turned on all the time. Most people don't even know to turn it off to begin with, and even if you do, you would still be required to turn it on all the time, just to use the basic functionality of the Internet."

One firm that has had to put up some fairly stringent security parameters around its Web 2.0 efforts is InnoCentive, an online entity that brings together medical organizations and researchers seeking health-care breakthroughs with other medical professionals and teams that can potentially offer solutions.

The process involves "seeker" organizations posting challenges to potential "solvers" on the InnoCentive site. If a solver's idea is chosen by a seeker, a cash amount is awarded. These prizes range anywhere from US$10,000 to US$1 million, but are typically in the US$30,000 to US$40,000 range, says Tom Venable, executive vice-president, marketing and sales for the Andover, Massachusetts-based Eli Lilly and Co. spinoff. The focus of the firm's security setup is designed not so much to prevent outside hacks but to preserve the confidentiality of the participants' sensitive corporate and research data, Venable says.

"We have to create these challenges to give the solver enough information to solve the problem and yet mask the seeker company and what the problem is going to be used for, because we don't want to expose any product development strategies to the marketplace. Security is very tight."

The next step in InnoCentive's online community push is to create more open-ended conversation capabilities. It seems the system's users have already got the jump on the company's network planners, however, proving that Web 2.0 functionality can spring up these days with little prodding.

"There are informal networks being set up on Yahoo and such (locations) where solvers may collaborate," Venable says. "That sort of informal worknet, as we call it, is going on outside our system, but we will be adding that type of functionality into our system in 2008."

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Greg Enright

Network World Canada
Show Comments

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers


This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang


It really doesn’t get more “gaming laptop” than this.

Jack Jeffries


As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr


The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?