New Web applications such as wikis, blogs and podcasts that foster increased collaboration and communication have enjoyed a great proliferation in recent months. They have brought with them, however, a number of new security challenges with which corporate network managers now have to contend.
According to Robert Hansen, president of California-based security consultancy SecTheory, the use of programming languages such as Java and Ajax, as well as the JSON data interchange format, in Web 2.0-style apps has created another door from which nefarious elements can enter a company’s back end and do irreparable damage.
With traditional Web pages, visitors load it up and that one page would return with the results the person is looking for, Hansen says.
“It is a very binary, back-and-forth connection, and it’s also very easy for programmers to understand how to protect that.…All they do is filter the output to make sure the results don’t contain malicious content.”
The problem with Ajax and JSON, he says, is that one request has actually become two: one to a page that has some JavaScript on it, which in turn makes a request to a JavaScript function or XML component which returns data back to that original page.
“So there are actually two places where you have to think about your security instead of one,” Hansen says. “The JavaScript is making the calls on [the visitor’s] behalf. You have to know that your surface area has increased.”
The breaches most often associated with these types of attacks, Hansen says, are credential thefts, such as account settings for a G-Mail account. However, he adds, there is far worse that can be done.
“If you go to my Web page and you pull down my JavaScript, and I’m a bad guy, I can force your browser to connect anywhere I want it to, which includes other machines inside your (corporation’s) firewall.”
The hacker could then force a user’s browser to connect to internal services and try to exploit them. “This is a new class of attack and these are just for starters,” Hansen says.
He adds that while he does not have evidence of such an attack taking place, Internet users should not deny its presence. “It’s incredibly difficult to detect, so it’s hard to tell if it is or isn’t happening.”
He points to a piece of JavaScript circulating on the Internet called jikto, which can play a role in carrying out this style of attack.
“I have talked to a couple of black hat search engine optimization guys — and these are not nice guys, by the way — who have decided that that is an ‘interesting technology’ for them.”
Using JavaScript to get into previously well-guarded areas of the network can play havoc with some companies’ customer-facing Web sites that utilize it extensively, Hansen adds. Banks are a prime example.
“They actually use it to try to protect you, but as a result you’re ending up having JavaScript turned on all the time. Most people don’t even know to turn it off to begin with, and even if you do, you would still be required to turn it on all the time, just to use the basic functionality of the Internet.”
One firm that has had to put up some fairly stringent security parameters around its Web 2.0 efforts is InnoCentive, an online entity that brings together medical organizations and researchers seeking healthcare breakthroughs with other medical professionals and teams that can potentially offer solutions.
The process involves “seeker” organizations posting challenges to potential “solvers” on the InnoCentive site. If a solver’s idea is chosen by a seeker, a cash amount is awarded. These prizes range anywhere from US$10,000 to $1 million, but are typically in the $30,000 to $40,000 range, says Tom Venable, executive vice-president, marketing and sales for the Andover, Mass.-based Eli Lilly and Co. spinoff. The focus of the firm’s security setup is designed not so much to prevent outside hacks but to preserve the confidentiality of the participants’ sensitive corporate and research data, Venable says.
“We have to create these challenges to give the solver enough information to solve the problem and yet mask the seeker company and what the problem is going to be used for, because we don’t want to expose any product development strategies to the marketplace. Security is very tight.”
The next step in InnoCentive’s online community push is to create more open-ended conversation capabilities. It seems the system’s users have already got the jump on the company’s network planners, however, proving that Web 2.0 functionality can spring up these days with little prodding.
“There are informal networks being set up on Yahoo and such (locations) where solvers may collaborate,” Venable says. “That sort of informal worknet, as we call it, is going on outside our system, but we will be adding that type of functionality into our system in 2008.”
