Web 2.0 opens companies up to hackers

Companies looking to embrace web 2.0 technologies could open themselves up to new forms of attack by hackers, according to security experts.

Speaking at a round table event, ThreatLab manager at content security company Clearswift Pete Simpson said that the fact that these technologies introduce both JavaScript and XML onto the desktop to mediate between the browser and the web server, it makes the work of the developer more difficult to design and test the security of these new applications. In turn this allows hackers to combine techniques to infiltrate and subvert systems.

"It combines both the weaknesses of the web page attack and the back-end application attack, both are compounded on the desktop level," said Simpson. "It gives the attacker a lot more ways and opportunities to get at the back-end."

He said a hacker could probe weaknesses at the back-end more successfully and allow them to inject code into web pages. "It is bringing two modes of attack to a single location," he said.

Analysts said that in order to protect an organisation from attacks through web 2.0 applications, a change of mindset is needed to overcome the problem of hackers using multiple attack vectors to access systems. Clive Longbottom, service director at analyst firm Quocirca, said that with web 2.0, it is the content that needs to be focused on for protection rather than the underlying infrastructure.

"If content is sent to a supplier, what is it within that content that they have to be able to see, what can they change, what actions can they take upon it," said Longbottom.

"It becomes far easier to say the technology is far less important, it is the content. You need to be able to tag it and secure it. Not many companies are near to that."

Does web 2.0 lead to hack 2.0? Discuss this now on our forums.

Email to a friend

Print this page