HP Security Products Blog
From applications to infrastructure, enterprises and governments alike face a constant barrage of digital attacks designed to steal data, cripple networks, damage brands, and perform a host of other malicious intents. HP Enterprise Security Products offers products and services that help organizations meet the security demands of a rapidly changing and more dangerous world. HP ESP enables businesses and institutions to take a proactive approach to security that integrates information correlation, deep application analysis and network-level defense mechanisms—unifying the components of a complete security program and reducing risk across your enterprise. In this blog, we will announce the latest offerings from HP ESP, discuss current trends in vulnerability research and technology, reveal new HP ESP security initiatives and promote our upcoming appearances and speaking engagements.

Ajax Security Acceptance

Its time again for AjaxWorld, the largest Ajax conference in the US. Bryan and I are thrilled. AjaxWorld offered us back-to-back sessions so we can do a 90+ minute workshop on how to break into Ajax applications. We will not only hit the major themes like increased attack surface, code transparency, etc, but are also demonstrating some more advanced features such as control flow manipulation, reversing client logic, exploiting Offline Ajax applications, and Mashup/Aggregate hacking. All of which we are covered in our upcoming book, Ajax Security.

Sharp eyed readers will note that 90+ minute is a ridiculous amount of time. This is on par with how much time the keynote speakers and presentations are given. Normal speaking slots are only 40 or 45 minutes! AjaxWorld did this because, well, they love SPI. We have spoken at the every AjaxWorld held so far. We give solid presentations that developers can understand and they personally invite us back every time.

Which leads me to my point.

I think people are starting to get the message about Ajax Security. Lets use AjaxWorld as a barameter of Ajax Security acceptance. When we spoke at the first AjaxWorld, SPI's was the only presentation talking to developers about Ajax Security. That was 1 talk about security out of around 100 presentations. And it was packed. At the 2nd AjaxWorld, SPI talked about Ajax security, and was joined by another presentation on security given by Dan Cornwell of Sprajax fame. Sure there were a few other presentations that had the word "secure" or "security" in the title but these were mainly product pitches and none offered product agnostic security advice to developers about the risks they face. Thats 2 presentations out of 100+ talking about security.

Now we get to AjaxWorld West 2007 and there are 5 presentations about security and all of them look great. Brian Chess from Fortify, Joe Stagner from Microsoft, Byran and I from SPI/HP, Danny Allen from Watchfire/IBM, and Pothiraj Selvaraj from CGE. I am absolutely floored by the turn out. And its not just more security speakers at Ajax conferences. There are other indications that people are accepting Ajax Security. We are seeing a number of books on Ajax Security come out. Ajax frameworks are starting to implement security features natively. In some cases framework developers are reaching out directly to the web security companies that seem to get it. For example SPI has been to Redmond multiple times this year working with the ASP.NET and Atlas teams. We see security vendors and consultants who were in denial about Ajax have toned down the rhetoric. Now vendors from the scanner and source code analysis spaces are joining SPI on stage this year at AjaxWorld. We've gone from a 20 something with long hair talking about Ajax security to CTOs and CEOs, and VPs spreading the message. And that is extremely satisfying.

I suppose if anything, AjaxWorld 2007 is a nice breath of fresh air. A cause SPI has been championing for nearly 2 years now is becoming more mainstream and finding acceptance in the Security and Development communities. I welcome my friendly competitors to the party, even if they were a little late and got lost along the way. :-) Because at the end of the day, more smart people working on tough problems helps everyone.

And thats the kind of thing that makes me want to go to work everyday.

Speaking at Shmoo

I’m really excited to be speaking at Shmoocon again and especially excited about my presentation this Saturday at 1pm. Javascript Malware for a Gray Goo Tomorrow focuses on the increased scope of damage caused by Cross-Site Scripting (XSS) vulnerabilities in the last year. The Web 2.0 revolution has been built on the back of standards compliant browsers and enhancements to the JavaScript language. This homogenous platform, coupled with JavaScript’s new features has enabled attackers to perform advanced attacks using XSS that were thought to be impossible even 2 years ago. Self-propagating XSS+Ajax worms, advanced keystroke and mouse loggers, port scanning, fingerprinting, and assaulting intranet applications, as well as stealing search engine queries or browser histories are now all components in an attackers toolbox.

The first part of my presentation will provide an overview of all these new advanced threats. Specifically, how this attacks work and how they can be prevented. In the second half I’ll discuss how JavaScript is capable of crawling and auditing 3rd party websites just like a traditional web scanner. As a proof of concept, I created Jikto, a web scanner written in JavaScript. Although I will not be releasing the source code of Jikto, I will be giving a full live demo and provide a detailed discussion about its methodology and architecture. The purpose of this public discussion and demonstration is to raise awareness of the danger of a XSS vulnerability and educate web developers and administrators on how to create websites securely. The biggest tragedy of all would be if a developer decides to put off fixing a XSS vulnerability because they weren’t aware of all the damage that could be done.

I really believe people are going to see some cool tricks, learn more about how attackers are using the often misunderstood JavaScript to perform sophisticated attacks, and leave with the knowledge to design, code and deploy secure websites. Hope to see you all there!
Showing results for 
Search instead for 
Do you mean 
About the Author(s)
HP Blog

HP Software Solutions Blog


Follow Us
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation.