AJAX: Savior or Security Scourge?
"Computers have enabled people to make more mistakes faster than almost
any invention in history, with the possible exception of tequila and hand
guns." --Mitch Ratcliffe
After a recent announcement by threat identification and remediation tools
vendor Fortify Software, maybe we should add AJAX to that list. The company
says a security vulnerability could make AJAX-based applications susceptible
to "JavaScipt hijacking," which lets unauthorized parties read private
opened the floodgates to phishers -- all they needed to do was get someone to
click on a valid PDF file link.
But Brian Chess, co-founder and chief scientist at Fortify, says this is not
your father's browser-based security problem. "It's not a new name for
in AJAX-style applications," Chess said.
At issue are the AJAX frameworks and client-side libraries used for AJAX development,
The Microsoft ASP.NET AJAX tool (code-named Atlas), Google Web Toolkit and libraries
such as Prototype, DoJo and Yahoo! UI are all affected, says Fortify.
The good news? Patching the hole should be quick work for tool providers, and
developers can certainly prevent private information from being transmitted
without authentication. Of course, all this argues back to the biggest issue
applications, you cannot afford to write crappy code.
What do you think? If we set down the hand guns and tequila bottles and focus
on writing good code, can we ever hope to avoid calamitous mistakes? How is
your company making sure its AJAX code isn't vulnerable? E-mail me at firstname.lastname@example.org.
Posted by Michael Desmond on 04/04/2007 at 1:15 PM