Opinions

Web-based attacks can take many forms, with effects ranging from mild inconvenience when a Web site no longer loads properly (such as the recent redirection of Barack Obama's Web site to Hillary Clinton's) to complete compromise of the user's system.

Recent attention has been focussed on the use of SQL injection, where database commands are able to be inserted into the site, and the terrible effects that such attacks have had recently.

Cross Site Scripting (XSS), and Cross Site Request Forging (CSRF) vulnerabilities have been considered by many as more distraction than vulnerability type, a problem which hasn't been helped when there is still some confusion about how some published vulnerability examples can be classed.

Most examples of XSS or CSRF vulnerabilities have been to steal authentication details from cookies set by various sites such as eBay, banking sites and webmail providers, or to temporarily replace Web site content for users when they follow a crafted link.

The problem that these attacks can have is that many of them take place in the user's browser, and not necessarily on the site. The impermanence of any attack makes it hard to tell when there is a problem and when there is something that needs to be done by the site developers.

There are teams of researchers working towards understanding more about XSS and CSRF problems, including those who are working to demonstrate cases where permanent effects can result from following a simple hyperlink.

The team at GNUCitizen are one of the leading groups to be looking at these problems and have already demonstrated a number of examples where a combination of the above vulnerability types can lead to the compromise of a common family of routers used by home broadband users in the United Kingdom.

More recently, there has been a case published where vulnerabilities in the uTorrent BitTorrent client can be leveraged and exploited through CSRF vulnerabilities, resulting in the eventual compromise of a victim's system. Users of the uTorrent client should update to the latest version and apply care from where they obtain their .torrent files.

If a number of these vulnerabilities look simplistic, it is because often they are.

The main problem for developers is in understanding how a feature or part of a site may be unintentionally exposed for manipulation, and then using secure development practices to implement their site. It has taken many years of major vulnerabilities and problematic exploits for the concepts of secure development and secure development practices to start spreading through the desktop and network application developer community.

Increasing reports and cases of online vulnerabilities should be a sign to online developers that they are going to have to apply the same sort of principles to their own work if they want it to withstand the online environment.

These problems are going to become of greater importance in the future as more devices and technologies are created to have a web interface for management, even if the user is unaware that such an interface exists. The Open Web Application Security Project (OWASP) has one of the best sets of online resources for finding out more about web based vulnerabilities and is comprised of many of the best minds currently working in this particular field of Information Security.