On CBS.com: Play Survivor Video Trivia Now
BNET Business Network:
BNET
TechRepublic
ZDNet

Talkback

Add your opinion
advertisement

From our video sponsors

advertisement
Click Here
AJAX & security

AJAX is a new Web technology being used in sites like Google Maps and MySpace. Like every new technology, it has security risks. Brian Chess of Fortify Software urges developers to be mindful of these threats.

Hi, my name's Brian Chess. I'm Chief Scientist of Fortify Software, and today we're going to talk about AJAX and Security. AJAX stands for Asynchronous JavaScript And XML. It's a cool new web technology that people are using to build much, much more rich user interfaces on the web. Google Maps is a great example of AJAX at work.

So today we're going to talk about the security implications of using AJAX in your applications. So in order to tell the story, we've got to go back in time to 1988. We're going to talk about the very first worm that ever hit the internet. It was called the Morris Worm. Now in 1988, of course, programs on the internet were almost all written in the C programming language. And a big problem when you're writing in C is buffer overflows. So a program named Send Mail had a buffer overflow in it, and that buffer overflow took advantage of a function named Get S, which stands for Get String. So when you call Get S, a bad guy can actually end up injecting code into your program. And as security folks like to say, as soon as a bad guy can run their code on your computer, it really isn't your computer anymore.

So now we're going to move forward to 2005, when the internet met the MySpace worm. Now the problem with MySpace wasn't related to C because MySpace isn't written in C. The problem with MySpace was related to JavaScript. And in JavaScript you can't have a buffer overflow but you can have a problem known as cross-site scripting, sometimes abbreviated XSS. Now the issue here is that when you've got a cross-site scripting problem, an attacker can, again, inject code that will then get executed in the browser.

Does it sound familiar yet? It's actually exactly the same thing that happens when you run into a buffer overflow in a C program. So from 1988 to 2005, what have we learned? Well, we still have problems with worms. We don't have problems as much anymore with C programs, but we have problems with JavaScript now. We don't have problems with buffer overflow, we've got problems with cross-site scripting. So what the lesson programmers need to keep in mind is when they're doing cool and exciting new stuff like AJAX, it really doesn't matter whether they're programming in C or that they're programming in a language like JavaScript. You've got to keep security in mind.