Software // Information Management
10:58 PM
Connect Directly
Repost This

Ajax's Success Could Weaken Web 2.0

Despite the several ways to break down a Web site built using Ajax, all is not lost, according to SPI Dynamics.

Bandwagoning is inevitable whenever a new technology or technique demonstrates success, and Ajax, or Asynchronous JavaScript and XML, has definitely been successful in the Web 2.0 world. Maybe too successful, from a security standpoint.

To prove this theory, SPI Dynamics Wednesday at the Black Hat USA 2007 conference in Las Vegas demonstrated several ways to break down a Web site they built using Ajax. The company dubbed the rush to erect Ajax-based Web sites "Premature Ajax-ulation," and proceeded to describe how it can be diagnosed, treated, and even avoided.

To demonstrate the lack of attention paid to securing Ajax, all of the techniques and approaches SPI researchers used to construct their fictitious site, called, came from books and other readily available resources about Ajax. The result was a site where flight pricing, seat selection, and other features were easily manipulated.

"Developers write these applications the way they're supposed to be used," Bryan Sullivan, SPI's development manager, told InformationWeek. "That's great, except that you've only ever tried to exercise the application the way it's intended to be used." Those attacking the application have no such inhibitions.

"Bryan and I were shocked at the bad advice published in Ajax security books," Billy Hoffman, lead security researcher for SPI, which is set to be bought by HP, told InformationWeek.

Ajax is seductive because it lets developers build applications that are as responsive as a desktop app but available over the Web. Ajax has risen to prominence on the back of applications such as Google Maps, which breaks up complex functions so that the users get more immediate gratification from their requests for information.

"With traditional Web applications, you broke in by feeding malicious code into the server to help make the server fail," Hoffman said. JavaScript, however, makes greater use of the client, thus giving anyone attacking an Ajax-based application access to a greater amount of the application's code.

The news wasn't all bad, however. It is possible to write secure Ajax applications if programmers carefully define and validate the data parameters their applications accept as well as the output the applications deliver. Barring that, abstinence, or at least using Ajax sparingly, may be the best solution.

Comment  | 
Print  | 
More Insights
The Agile Archive
The Agile Archive
When it comes to managing data, donít look at backup and archiving systems as burdens and cost centers. A well-designed archive can enhance data protection and restores, ease search and e-discovery efforts, and save money by intelligently moving data from expensive primary storage systems.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Elite 100 - 2014
Our InformationWeek Elite 100 issue -- our 26th ranking of technology innovators -- shines a spotlight on businesses that are succeeding because of their digital strategies. We take a close at look at the top five companies in this year's ranking and the eight winners of our Business Innovation awards, and offer 20 great ideas that you can use in your company. We also provide a ranked list of our Elite 100 innovators.
Twitter Feed
Audio Interviews
Archived Audio Interviews
GE is a leader in combining connected devices and advanced analytics in pursuit of practical goals like less downtime, lower operating costs, and higher throughput. At GIO Power & Water, CIO Jim Fowler is part of the team exploring how to apply these techniques to some of the world's essential infrastructure, from power plants to water treatment systems. Join us, and bring your questions, as we talk about what's ahead.