Web 2.0, DNS flaws revealed at Black Hat

The size and scope of security problems are growing to be so large that security experts are having more difficulty than ever protecting end users from emerging threats. That was evident in the Black Hat Briefings security conference that opened Wednesday.

Case in point: IOActive researcher Dan Kaminsky detailed for the first time the specific nature of the DNS flaw reported recently and its overarching scope, providing example after example of how various Internet technologies that rely on the accuracy of the DNS information they received could be compromised. Kaminsky warned the audience that the DNS vulnerability could let entire countries and entire top-level domains be hijacked.

While Kaminsky’s revelations made headlines, the pervasive undercurrent at Black Hat was on the dangers of Web 2.0 technology. Not only is there “just more crap out there,” said conference organizer Jeff Moss, but “the interconnectedness of Web 2.0 applications stresses things that might not have been big problems in isolation, but have become huge problems when [they’re] all tied together.”

For example, in his talk about Google Gadgets, Tom Stracener of security vendor Cenzic demonstrated Web-based applets, including port scanners and other malicious tools that could be used to attack users and steal data, and described a vulnerability in Google Gadgets that could lead to what Stracener calls “GMalware,” or malicious software written in the Gmodules format employed by Google Gadgets.

A whole raft of Web 2.0 risks comes from the poor protection of documents, Web site browsing history, RSS feed subscriptions, e-mail, personal information such as passwords, and traces of online activity — all of which are typically stored locally on the PC, says Jeremiah Grossman of White Hat Security. That information is increasingly moved into the ether, into applications where Grossman said he’s “not seeing features on the road map that are needed to secure these apps.” Thus, all of that data could become compromised.

“We’re moving towards Web-based software, software that runs in the browser, and that’s a really insecure device,” said Grossman. What Web application providers want to do “can’t be done securely in the browser right now.” Web 2.0 applications are “the new place for malware,” he said, “and as it gets larger the problems are only going to get worse.”