Articles

Don't Hack the Ox!

By: Szu Chang, eSecurity Columnist/Editor, Internet Journal

03/12/2009

Over the past few years, new efforts to hack into, terrorize and commit crimes on Web applications have become a major sore point. 2009, the year of the Ox, provides both challenges and opportunities for the Web application security field.

Web Applications like Ox

The year 2009 is the Year of the Ox, according to zodiac calendar.  The ox is the second animal in the zodiac and often associated with honesty, responsibility, faithfulness and gentleness. Web based applications provide all kind of Internet services to the end users and are often associated with same traits as the mythological ox.

Web applications, just like the ox, have lots of positive traits, such as being perceived as calm, dependable, honest, caring, intelligent, industrious, modest, patient, practical, and responsible.  The Internet is now being used for more and more business mission-critical applications and has become the lifeblood of many businesses now.

On the other hand Web applications, just like the ox, also have some of negative traits, such as being petty, inflexible, possessive, dogmatic, gullible, stubborn, intolerant, and materialistic.

From attackers' point of view, Web applications have the stupidity and stubbornness of an ox, and they can be hacked easily. Therefore, web applications have been thrust into the frontline of hacker assaults.  Not only have attackers become smarter and faster, it seems attackers are now more desperate and determined.

Vulnerabilities have Gone up Exponentially

Over the past few years, the number of vulnerabilities to mission-critical applications has gone up exponentially with the rise of Web based applications. New efforts to hack, terrorize and commit crimes online has become a major pain point for all types of organizations, including government and financial.

"Year after year, we see a growing number of applications within the enterprise creating security vulnerabilities that are easily prevented through better visibility across endpoints, and a more centralized patch-management process," said Harry Sverdlove, chief technology officer, Bit9 Inc.  "2008 has been no exception. This year, along with the widely reported huge increase in malware, the number of well-known applications causing security problems for companies has also increased."

Security threats that were once confined to retail and identity industries now have grown to a national security scale. According to the " December 2008 CSIS Securing Cyberspace Report", the Departments of Defense, Homeland Security, Commerce and NASA all suffered major intrusions by unknown foreign entities.

"We've seen a few targeted threats over the past year, that mark the advent of new types of exploitation of security vulnerabilities and pose threats for the future," said Mandeep Khera, chief marketing officer of Cenzic, Inc.

"Cyber terrorism attempts of this magnitude are not as difficult as one may think," said Khera. "With the current economic climate, there will be an increase in the number of people willing to take chances on exploiting various vulnerabilities especially in Web sites, and cybercrime is attractive because it is hard to identify the perpetrators. Web application security is now more important than ever, and organizations need to take extra precautions to ensure that security processes are instilled as part of their business practice."

What are Security Vulnerabilities?

When talking on vulnerabilities of Web applications, the OWASP Top Ten has been referenced widely. The Open Web Application Security Project (OWASP) is an open source community project staffed entirely by volunteer experts from across the world. 

OWASP has a list of top ten security vulnerabilities of Web applications, which spotlights the most serious and often overlooked risks. The OWASP Top Ten provides a powerful awareness document for web application security.

The OWASP Top Ten represents a broad consensus on the most critical web application security flaws. The Top Ten also provides basic methods to protect against these vulnerabilities and has been adopted widely.

The Top Ten from OWASP 2007

Cross Site Scripting (XSS)	XSS allows attackers to execute script in the victim's browser which can hijack user sessions, deface web sites, possibly introduce worms, etc.
Injection Flaws	Injection flaws, particularly SQL injection, occur when user-supplied data is sent to an interpreter as part of a command or query. The attacker's hostile data tricks the interpreter into executing unintended commands or changing data.
Malicious File Execution	Code vulnerable to remote file inclusion allows attackers to include hostile code and data, resulting in devastating attacks, such as total server compromise.
Insecure Direct Object Reference	An internal implementation object is directly exposed its reference to as a URL or form parameter. Attackers can manipulate the reference to access other objects without authorization.
Cross Site Request Forgery (CSRF)	A CSRF attack forces a logged-on victim's browser to send a pre-authenticated request to a vulnerable web application, which then forces the victim's browser to perform a hostile action to the benefit of the attacker.
Information Leakage and Improper Error Handling	Applications can unintentionally leak information about their configuration, internal workings, or violate privacy, and attackers use this weakness to steal sensitive data, or conduct more serious attacks.
Broken Authentication and Session Management	Account credentials and session tokens are often not properly protected. Attackers compromise passwords, keys, or authentication tokens to assume other users' identities.
Insecure Cryptographic Storage	Web applications do not use cryptographic functions properly to protect data and credentials.
Insecure Communications	Applications frequently fail to encrypt network traffic when it is necessary to protect sensitive communications.
Failure to Restrict URL Access	Frequently, an application only protects sensitive functionality by preventing the display of links or URLs to unauthorized users. Attackers can use this weakness to access and perform unauthorized operations by accessing those URLs directly.