Feeds

JavaScript in web browsers is new security weak spot

Ajax fingered as main culprit

SANS - Survey on application security programs

The growing use of JavaScript in web browsers is the new security weak spot, says Brian Chess, chief scientist and founder of US security software specialist Fortify Software.

Specifically, the use of Ajax techniques to build Web 2.0 applications makes enterprise applications more vulnerable.

"It is really hard to see the difference between what Ajax is supposed to do and what is an attack from hijacking JavaScript," Chess says. "Potentially it provides a bridge between external internet applications and internal intranet applications behind the firewall."

This week, Fortify announced the latest version of its Secure Coding Rulepacks aimed specifically at the JavaScript hijacking Chess refers to. Fortify's recent research into source code vulnerabilities highlights what Chess sees as the next major wave of hacking activity.

"We think the problem is being seriously underestimated because of the surge in Web 2.0 applications. People don't want to talk about it in case it spoils the party - in fact, some have criticised us and said we are ruining Ajax by highlighting its vulnerabilities. But there are some potentially dangerous scenarios that could spin off JavaScript hacks."

Fortify specialises in source code analysis tools which can help spot potential security problems. The latest release of its Secure Code Rulepacks incorporates technology it acquired from its recent takeover of Secure Software. The technology analyses JavaScript code frameworks searching for potential security loopholes.

Chess says the original plan for the release was to merge Secure Software's technology with Fortify's - but the dangers of JavaScript hijacking prompted a re-think. "The bulk of the work on this release was to port across the Secure Software technology. But the JavaScript hi-jacking problem came up a couple of months ago and we decided it could not wait." ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.