Hackers welcome Web 2.0

 

Gallery

Posted on 22 Mar 2007 at 15:52

According to security experts, companies embracing web 2.0 technologies could open themselves up to new forms of attack by hackers.

The fact that these technologies introduce both JavaScript and XML onto the desktop to mediate between the browser and the web server makes things more problematic, said Pete Simpson, ThreatLab manager at content security company Clearswift, speaking at a round table event.

It makes the work of the developer more difficult to design and test the security of these new applications, he said. And, in turn, this allows hackers to combine techniques to infiltrate and subvert systems.

'It combines both the weaknesses of the web page attack and the back-end application attack, both are compounded on the desktop level,' said Simpson. 'It gives the attacker a lot more ways and opportunities to get at the back-end.'

He said a hacker could probe weaknesses at the back-end more successfully and allow them to inject code into web pages. 'It is bringing two modes of attack to a single location,' he said.

Analysts said that in order to protect an organisation from such attacks, a change of mindset is needed to overcome the problem of hackers using multiple attack vectors to access systems. Clive Longbottom, service director at analyst firm Quocirca, said that with Web 2.0, it is the content that needs to be focused on for protection rather than the underlying infrastructure.

'If content is sent to a supplier, what is it within that content that they have to be able to see, what can they change, what actions can they take upon it?' asked Longbottom.

'It becomes far easier to say the technology is far less important, it is the content. You need to be able to tag it and secure it. Not many companies are near to that.'

Author: Rene Millman