Click here to receive your FREE subscription to Campus Technology
News
GWT: Advanced AJAX Security
1/3/2008
Billy Hoffman gave a talk on advanced AJAX security at the recent Google Web Toolkit (GWT) conference in San Francisco. Hoffman manages HP Security Labs, which was SPIDynamics until HP acquired it this year, along with Hoffman. He focuses on automated discovery of Web application vulnerabilities and Web crawling technologies.
His research includes areas such as sampling, JavaScript static analysis (automatic analysis of source code), and cross-site scripting (XSS) -- code injection by malicious Web users into Web pages viewed by other users. However, he did note that XSS isn't required for AJAX hacking; there's much lower-hanging fruit.
In this talk, Hoffman demonstrated advanced attacks against AJAX applications, including manipulating client-side logic, defeating logic protection techniques, function hijacking (client-side code being changed), JavaScript Object Notation (JSON) hijacking and denial of service attacks. He discussed the susceptibility of GWT applications to these kinds of attacks and compared GWT security features to other AJAX frameworks, such as Prototype and Dojo. He ended by talking about hacking Google Gears, an open source browser extension that lets developers create Web applications that can run offline.
Hackers Love AJAX
According to Hoffman, AJAX is a hacker's dream come true. It offers an increased "attack surface," direct Application Programming Interface (API) access, vulnerability to reverse engineering, susceptibility to amplifying Web attacks and vulnerability to offline attacks. He said Microsoft is the worst at opening the door to hackers because nearly everything with Structured Query Language (SQL) statements is SQL-injectible, allowing direct access to the database server. Plus, he said, "much expert advice is blatantly wrong."
Recommended Reading
- College of Southern Nevada Implementing Angel To Run Online Courses
The College of Southern Nevada (CSN), a community college in Las Vegas with 41,000 students, has adopted the Angel Learning Management Suite (LMS) to support its online course offerings. In Spring 2008 CSN began evaluating alternatives to WebCT, which it currently runs, and made the decision to adopt Angel in the fall. In January 2009, CSN's 865 sections of online enrollment will be delivered using the Angel LMS.
- Toshiba Brings DisplayLink to Docking Station
Toshiba has introduced a new USB docking station that incorporates DisplayLink--a technology that allows computers to connect to projectors and other types of displays through USB 2.0.
- Mitsubishi Ships SXGA+ Projector with DICOM Simulation
Mitsubishi has begun shipping a new LCD-based SXGA+ projector aimed at higher education, specifically medical schools. The new MH2850U, according to Mitsubishi, is "specially engineered for projecting DICOM simulation images for use in medical education and training."
- First Look: Komodo IDE 5.0
Last month, ActiveState released Komodo IDE 5.0, the company's latest integrated development environment (IDE). Komodo supports multiple programming and markup languages, including HTML, JavaScript, PHP, Perl, Java, Python, C++ and more. It does not support some .NET languages at present, such as ASP/ASP.NET, C# and VB.NET.
- IBM Offers Cloud Computing Help
IBM last week announced consulting services specifically designed to help organizations assess their options in using cloud computing technology. "Cloud computing" is a much argued term, but it typically refers to solutions delivered over the Internet, rather than via customer premises-installed software.
- Hollins U Chooses Omnilert for Emergency Notification Ahead of VA Deadline
Hollins University, among other higher ed institutions in Virginia, has implemented Omnilert's e2Campus emergency notification system (ENS) just ahead of a state-mandated deadline requiring them at every public institution of higher education by Jan. 1. Hollins itself isn't a public campus, but wished to implement an ENS before the end of the year, the school said in a company statement.
