Security Experts Warn of Web 2.0 Woes

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

RESTON, Va. — While Web 2.0 applications might be all the rage for developers and increasingly important in the enterprise, security experts warn they represent a serious threat — a fact that won’t change until businesses start demanding greater protections.

That was the theme at the New New Internet conference here yesterday, where a panel of security experts told audience members that Web 2.0 application developers lack tools to secure their applications, creating a problem unlikely to be fixed without greater prompting by IT management.

“Beat up on your vendors and your own developers,” said Steve Orrin, director of security solutions for Intel Corp. “Look for and ask for security features in your applications. Until you start asking, they aren’t going to see it as a requirement.”

Much of the issue stems from the fact that underlying technologies being used in new Web applications and Web services were never properly secured to begin with, panelists said.

“We’ve already moved on and started to look at Web 2.0 technology, when Web 1.0 wasn’t secure yet,” Orrin said. “What we’re seeing is advanced uses of the same sorts of attacks that were used before.” Cross-site scripting, for example, is “much more powerful” when used in a Web 2.0 environment, he suggested. “As powerful a tool as Web 2.0 technology is for developers and users, it’s even more so for attackers.”

That’s especially true of things like phishing attacks, Orrin said. “It’s become a lot easier to trick users with Web 2.0 — the automation is to the point where the user doesn’t even have to be involved for the attack to occur.”

Hart Rossman, chief security technologist at research and engineering giant Science Applications International Corporation (SAIC), agreed. He pointed to the difficulties that security professionals face in checking some Web 2.0 applications for vulnerabilities.

“AJAX is the weapon of choice for sex appeal, but current vulnerability assessment tools have trouble traversing AJAX sites, and it’s harder to find the vulnerabilities,” Rossman said. “You can’t recreate sessions as easily, so if something happens, it’s very difficult to create the forensics to analyze it.”

Ironically, the current closed nature of many social networks’ application programming interfaces has prevented some attacks mounted over them from crossing over to other platforms, “despite the fact that people rail against the walled garden,” Rossman said. “For the most part, [the social networking sites] are walled gardens — but they’re happy to let you develop applications in them and stay there.”

That fact has prevented some attacks from becoming more widespread, he said, but added that the rise of the use of widgets and other outside components on sites like MySpace raises the specter of people using “Web 2.0 on top of Web 2.0” to mount larger cross-network attacks.

“Social networks become a breeding ground for Flash worms,” said Orrin. He pointed to the MySpace QuickTime worm attack from last December that attacked users’ profiles, rewriting them with links to phishing sites. “By loading the video, a million people viewed the video and were attacked by the virus in a single evening.”

Perhaps more ironic, Google and a number of social networking sites just a day earlier announced their partnership to develop common APIs across their sites.

If Rossman’s “walled garden” theory is correct, the newly partnered social networking sites — which includes MySpace, the industry’s largest player — could mean the end of the isolationist protections currently enjoyed by those sites, and an increased likelihood for problems faced by one site to migrate to others.

The panel yesterday also discussed hazards inherent in the very thing that social networks are built on — the building of trust in strangers.

Jeffery Grass, CEO of BuySAFE, a third-party merchant assurance company, said that in a survey of eBay buyers from merchants who had 90-percent positive ratings, almost half of users felt like they had still been victims of fraud in some way, “that they were overcharged for shipping, that the description wasn’t accurate, et cetera.”

“Web 2.0 creates a lot of connectedness,” Grass said. “It helps create a more trusted interaction with the other party. But it also creates risk — how do you know the other party is someone you can trust?”

Orrin and Rossman extended the trust issue to the realm of mash-ups and add-on components. “People tend not to trust the mash-up developer,” Rossman said. “They [put their trust in ] the API provider. There’s very little thought given to the mash-up itself.”

This article was first published on InternetNews.com.