Web 2.0 applications raise security issues

Just how safe are Web 2.0-style apps?

As new Web applications such as wikis, blogs and podcasts that foster increased collaboration and communication proliferate, they are bringing new security challenges corporate network managers have to contend with.

According to Robert Hansen, president of California-based security consultancy SecTheory, the use of programming languages such as Java and Ajax, as well as the JSON data interchange format, in Web 2.0-style apps has created another door from which nefarious elements can enter a company's back end and do irreparable damage.

Traditional Web pages return with the results the person is looking for, Hansen says.

"It is a very binary, back-and-forth connection, and it's also very easy for programmers to understand how to protect that . . . All they do is filter the output to make sure the results don't contain malicious content," he says.

The problem with Ajax and JSON, he goes on, is that one request has actually become two: one to a page that has some JavaScript on it, which in turn makes a request to a JavaScript function or XML component that returns data back to the original page.

"So there are actually two places where you have to think about your security instead of one," Hansen says. "The JavaScript is making the calls on [the visitor's] behalf. You have to know that your surface area has increased."

The breaches most often associated with these types of attacks, Hansen says, are credential thefts, such as account settings for a G-Mail account.

However, he adds, there is far worse that can be done.

"If you go to my Web page and you pull down my JavaScript, and I'm a bad guy, I can force your browser to connect anywhere I want it to, which includes other machines inside your [corporation's] firewall."

The hacker could then force a user's browser to connect to internal services and try to exploit them. "This is a new class of attack and these are just for starters," Hansen says.

He adds that while he does not have evidence of such an attack taking place, Internet users should not deny its presence.

"It's incredibly difficult to detect, so it's hard to tell if it is or isn't happening."

He points to a piece of JavaScript circulating on the Internet called jikto, which can play a role in carrying out this style of attack.

"I have talked to a couple of black hat search engine optimization guys -- and these are not nice guys, by the way -- who have decided that that is an 'interesting technology' for them."

Using JavaScript to get into previously well-guarded areas of the network can play havoc with some companies' customer-facing Web sites that utilize it extensively, Hansen adds. Banks are a prime example.

"They actually use it to try to protect you, but as a result you're ending up having JavaScript turned on all the time.

Most people don't even know to turn it off to begin with, and even if you do, you would still be required to turn it on all the time, just to use the basic functionality of the Internet."

One firm that has had to put up some fairly stringent security parameters around its Web 2.0 efforts is InnoCentive, an online entity that brings together medical organizations and researchers seeking healthcare breakthroughs with other medical professionals and teams that can potentially offer solutions.

The process involves "seeker" organizations posting challenges to potential "solvers" on the InnoCentive site. If a solver's idea is chosen by a seeker, a cash amount is awarded.

These prizes range anywhere from US$10,000 to $1 million, but are typically in the $30,000 to $40,000 range, says Tom Venable, executive vice-president of marketing and sales for Eli Lilly and Co. spinoff.

The focus of the firm's security setup is designed not so much to prevent outside hacks but to preserve the confidentiality of the participants' sensitive corporate and research data, Venable says.

"We have to create these challenges to give the solver enough information to solve the problem and yet mask the seeker company and what the problem is going to be used for, because we don't want to expose any product development strategies to the marketplace," he says.

"Security is very tight."

The next step in InnoCentive's online community push is to create more open-ended conversation capabilities.

It seems the system's users have already got the jump on the company's network planners, however, proving that Web 2.0 functionality can spring up these days with little prodding.

"There are informal networks being set up on Yahoo and such (locations) where solvers may collaborate," Venable says.

"That sort of informal worknet, as we call it, is going on outside our system, but we will be adding that type of functionality into our system in 2008."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Greg Enright

Network World Canada
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?