Ajax Security Risks
Billy Hoffman of SPI Dynamics is speaking out about the risks of JavaScript and Ajax and was quoted in a recent InfoWorld article. One of the most telling quotes about the state of Web application security from Hoffman is:
"In the last two years, we've seen JavaScript go from stealing cookies to doing key-logging, screen-scraping and all sorts of phishing attacks," Hoffman said. "JavaScript used to be something that was more annoying than anything, but now it's being used in port scanning, to create self-propagating malware and to steal browser histories."
We've known JavaScript is vulnerable to attacks for a long time but new development techniques, like Ajax, and the development tools that support these techniques, are increasing the potential for introducing these vulnerabilities to your sites.
Hoffman goes on to say:
The only way to improve the situation is for site operators to undertake more comprehensive efforts to rid their pages of the problems, said Hoffman, and for them to slow down adoption of newer languages, such as AJAX, which appear to outstrip many Web developers' security skills.
For more on Ajax security, see Ajax Security Basics.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
