Web 2.0 vulnerabilties to watch for

New Web applications bring a number of new security challenges

New Web applications such as wikis, blogs and podcasts that foster increased collaboration and communication have enjoyed a great proliferation in recent months. They have brought with them, however, a number of new security challenges with which corporate network managers now have to contend.

According to Robert Hansen, president of California-based security consultancy SecTheory, the use of programming languages such as Java and Ajax, as well as the JSON data interchange format, in Web 2.0-style apps has created another door from which nefarious elements can enter a company's back end and do irreparable damage.

With traditional Web pages, visitors load it up and that one page would return with the results the person is looking for, Hansen says.

"It is a very binary, back-and-forth connection, and it's also very easy for programmers to understand how to protect that....All they do is filter the output to make sure the results don't contain malicious content."

The problem with Ajax and JSON, he says, is that one request has actually become two: one to a page that has some JavaScript on it, which in turn makes a request to a JavaScript function or XML component which returns data back to that original page.

"So there are actually two places where you have to think about your security instead of one," Hansen says. "The JavaScript is making the calls on [the visitor's] behalf. You have to know that your surface area has increased."

The breaches most often associated with these types of attacks, Hansen says, are credential thefts, such as account settings for a G-Mail account. However, he adds, there is far worse that can be done.

"If you go to my Web page and you pull down my JavaScript, and I'm a bad guy, I can force your browser to connect anywhere I want it to, which includes other machines inside your [corporation's] firewall."

The hacker could then force a user's browser to connect to internal services and try to exploit them. "This is a new class of attack and these are just for starters," Hansen says.

He adds that while he does not have evidence of such an attack taking place, Internet users should not deny its presence. "It's incredibly difficult to detect, so it's hard to tell if it is or isn't happening."

He points to a piece of JavaScript circulating on the Internet called jikto, which can play a role in carrying out this style of attack.

"I have talked to a couple of black hat search engine optimization guys -- and these are not nice guys, by the way -- who have decided that that is an 'interesting technology' for them."

Using JavaScript to get into previously well-guarded areas of the network can play havoc with some companies' customer-facing Web sites that utilize it extensively, Hansen adds. Banks are a prime example.

"They actually use it to try to protect you, but as a result you're ending up having JavaScript turned on all the time. Most people don't even know to turn it off to begin with, and even if you do, you would still be required to turn it on all the time, just to use the basic functionality of the Internet."

One firm that has had to put up some fairly stringent security parameters around its Web 2.0 efforts is InnoCentive, an online entity that brings together medical organizations and researchers seeking health-care breakthroughs with other medical professionals and teams that can potentially offer solutions.

The process involves "seeker" organizations posting challenges to potential "solvers" on the InnoCentive site. If a solver's idea is chosen by a seeker, a cash amount is awarded. These prizes range anywhere from US$10,000 to US$1 million, but are typically in the US$30,000 to US$40,000 range, says Tom Venable, executive vice-president, marketing and sales for the Andover, Massachusetts-based Eli Lilly and Co. spinoff. The focus of the firm's security setup is designed not so much to prevent outside hacks but to preserve the confidentiality of the participants' sensitive corporate and research data, Venable says.

"We have to create these challenges to give the solver enough information to solve the problem and yet mask the seeker company and what the problem is going to be used for, because we don't want to expose any product development strategies to the marketplace. Security is very tight."

The next step in InnoCentive's online community push is to create more open-ended conversation capabilities. It seems the system's users have already got the jump on the company's network planners, however, proving that Web 2.0 functionality can spring up these days with little prodding.

"There are informal networks being set up on Yahoo and such (locations) where solvers may collaborate," Venable says. "That sort of informal worknet, as we call it, is going on outside our system, but we will be adding that type of functionality into our system in 2008."

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Greg Enright

Network World Canada
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?