Click here to receive your FREE subscription to Campus Technology
News
GWT: Advanced AJAX Security
1/3/2008
Billy Hoffman gave a talk on advanced AJAX security at the recent Google Web Toolkit (GWT) conference in San Francisco. Hoffman manages HP Security Labs, which was SPIDynamics until HP acquired it this year, along with Hoffman. He focuses on automated discovery of Web application vulnerabilities and Web crawling technologies.
His research includes areas such as sampling, JavaScript static analysis (automatic analysis of source code), and cross-site scripting (XSS) -- code injection by malicious Web users into Web pages viewed by other users. However, he did note that XSS isn't required for AJAX hacking; there's much lower-hanging fruit.
In this talk, Hoffman demonstrated advanced attacks against AJAX applications, including manipulating client-side logic, defeating logic protection techniques, function hijacking (client-side code being changed), JavaScript Object Notation (JSON) hijacking and denial of service attacks. He discussed the susceptibility of GWT applications to these kinds of attacks and compared GWT security features to other AJAX frameworks, such as Prototype and Dojo. He ended by talking about hacking Google Gears, an open source browser extension that lets developers create Web applications that can run offline.
Hackers Love AJAX
According to Hoffman, AJAX is a hacker's dream come true. It offers an increased "attack surface," direct Application Programming Interface (API) access, vulnerability to reverse engineering, susceptibility to amplifying Web attacks and vulnerability to offline attacks. He said Microsoft is the worst at opening the door to hackers because nearly everything with Structured Query Language (SQL) statements is SQL-injectible, allowing direct access to the database server. Plus, he said, "much expert advice is blatantly wrong."
Recommended Reading
- IE Is Least-Patched Browser, Report Says
According to a report released last Tuesday, more than 40 percent of Internet surfers don't use browsers with up-to-date security patches--and Internet Explorer users are the biggest culprits.
- Ballmer Wants Board Change at Yahoo
Microsoft's executives have been talking with investor and corporate raider Carl Icahn about renewed plans for Microsoft to acquire part or all of Yahoo, provided that Yahoo's board is replaced. The details were described in an open letter issued Monday by Icahn, which is addressed to Yahoo's shareholders.
- July 2008 Crossword
Click above to see the solution for the July 2008 Campus Technology crossword puzzle.
- Stanford, IFL Introducing $50 Handheld to Mexico Students
Stanford University School of Education and Innovations for Learning, a Chicago-based nonprofit, have entered into a social entrepreneurship collaboration to bring the $50 Teachermate Handheld Computer to extremely underserved children in Latin America.
- 'Important' Fixes To Come in Microsoft's July Patch Cycle
IT pros will come back from the holiday weekend to face a possible four patches in Microsoft's July patch rollout, according an advance announcement issued by the company. The patches, arriving Tuesday, won't contain "critical" or "moderate" items, but all four will be deemed "important."
- Joliet JC Adopts MIR3 Emergency Notification Platform
Joliet Junior College will be deploying the MIR3 inCampusAlert emergency notification service for its main campus in Joliet, IL and its extended campuses and extension centers. inCampusAlert allows for dissemination of information to and from cell phones, e-mail, pagers, land lines, and SMS.
