Web 2.0 vulnerabilties to watch for
- 19 July, 2007 14:31
New Web applications such as wikis, blogs and podcasts that foster increased collaboration and communication have enjoyed a great proliferation in recent months. They have brought with them, however, a number of new security challenges with which corporate network managers now have to contend.
According to Robert Hansen, president of California-based security consultancy SecTheory, the use of programming languages such as Java and Ajax, as well as the JSON data interchange format, in Web 2.0-style apps has created another door from which nefarious elements can enter a company's back end and do irreparable damage.
With traditional Web pages, visitors load it up and that one page would return with the results the person is looking for, Hansen says.
"It is a very binary, back-and-forth connection, and it's also very easy for programmers to understand how to protect that....All they do is filter the output to make sure the results don't contain malicious content."
The breaches most often associated with these types of attacks, Hansen says, are credential thefts, such as account settings for a G-Mail account. However, he adds, there is far worse that can be done.
The hacker could then force a user's browser to connect to internal services and try to exploit them. "This is a new class of attack and these are just for starters," Hansen says.
He adds that while he does not have evidence of such an attack taking place, Internet users should not deny its presence. "It's incredibly difficult to detect, so it's hard to tell if it is or isn't happening."
"I have talked to a couple of black hat search engine optimization guys -- and these are not nice guys, by the way -- who have decided that that is an 'interesting technology' for them."
One firm that has had to put up some fairly stringent security parameters around its Web 2.0 efforts is InnoCentive, an online entity that brings together medical organizations and researchers seeking health-care breakthroughs with other medical professionals and teams that can potentially offer solutions.
The process involves "seeker" organizations posting challenges to potential "solvers" on the InnoCentive site. If a solver's idea is chosen by a seeker, a cash amount is awarded. These prizes range anywhere from US$10,000 to US$1 million, but are typically in the US$30,000 to US$40,000 range, says Tom Venable, executive vice-president, marketing and sales for the Andover, Massachusetts-based Eli Lilly and Co. spinoff. The focus of the firm's security setup is designed not so much to prevent outside hacks but to preserve the confidentiality of the participants' sensitive corporate and research data, Venable says.
"We have to create these challenges to give the solver enough information to solve the problem and yet mask the seeker company and what the problem is going to be used for, because we don't want to expose any product development strategies to the marketplace. Security is very tight."
The next step in InnoCentive's online community push is to create more open-ended conversation capabilities. It seems the system's users have already got the jump on the company's network planners, however, proving that Web 2.0 functionality can spring up these days with little prodding.
"There are informal networks being set up on Yahoo and such (locations) where solvers may collaborate," Venable says. "That sort of informal worknet, as we call it, is going on outside our system, but we will be adding that type of functionality into our system in 2008."