The top 10 reasons Web sites get hacked

Discussion in 'DSL & Info Tech News' started by dyoddyowel, Oct 12, 2007.

  1. dyoddyowel

    dyoddyowel Member

    The top 10 reasons Web sites get hacked
    Web developers ignore security flaws at customers' peril

    Web security is at the top of customers’ minds after many well-publicized personal data breaches, but the people who actually build Web applications aren’t paying much attention to security, experts say.

    “They’re totally ignoring it,” says IT consultant Joel Snyder. “When you go to your Web site design team, what you’re looking for is people who are creative and able to build these interesting Web sites… That’s No. 1, and No. 9 on the list would be that it’s a secure Web site.”

    The biggest problem is designers aren’t building walls within Web applications to partition and validate data moving between parts of the system, he says.

    Security is usually something that’s considered after a site is built rather than before it is designed, agrees Khalid Kark, senior analyst at Forrester.

    “I’d say the majority of Web sites are hackable,” Kark says. “The crux of the problem is security isn’t thought of at the time of creating the application.”

    That’s a big problem, and it’s one the nonprofit Open Web Application Security Project (OWASP) is trying to solve. An OWASP report called “The Ten Most Critical Web Application Security Vulnerabilities” was issued this year to raise awareness about the biggest security challenges facing Web developers.

    The first version of the list was released in 2004, but OWASP Chairman Jeff Williams says Web security has barely improved. New technologies such as AJAX and Rich Internet Applications that make Web sites look better also create more attack surfaces, he says. Convincing businesses their Web sites are insecure is no easy task, though.

    “It’s frustrating to me, because these flaws are so easy to find and so easy to exploit,” says Williams, who is also CEO and co-founder of Aspect Security. “It’s like missing a wall on a house.”

    Web vulnerabilities
    Experts say most Web applications can be hacked. Here are the top ten vulnerabilities that could put your Web site at risk.

    1. Cross site scripting
    2. Injection flaws
    3. Malicious file execution
    4. Insecure direct object reference
    5. Cross site request forgery
    6. Information leakage and improper error handling
    7. Broken authentication and session management
    8. Insecure cryptographic storage
    9. Insecure communications
    10. Failure to restrict URL access

    SOURCE: OWASP (the Open Web Application Security Project)

    Here is a summary of OWASP’s top 10 Web vulnerabilities, including a description of each problem, real-world examples and how to fix the flaws.

    1. Cross site scripting (XSS)

    The problem: The “most prevalent and pernicious” Web application security vulnerability, XSS flaws happen when an application sends user data to a Web browser without first validating or encoding the content. This lets hackers execute malicious scripts in a browser, letting them hijack user sessions, deface Web sites, insert hostile content and conduct phishing and malware attacks.

    Attacks are usually executed with JavaScript, letting hackers manipulate any aspect of a page. In a worst-case scenario, a hacker could steal information and impersonate a user on a bank’s Web site, according to Snyder.

    Real-world example: PayPal was targeted last year when attackers redirected PayPal visitors to a page warning users their accounts had been compromised. Victims were redirected to a phishing site and prompted to enter PayPal login information, Social Security numbers and credit card details. PayPal said it closed the vulnerability in June 2006.

    How to protect users: Use a whitelist to validate all incoming data, which rejects any data that’s not specified on the whitelist as being good. This approach is the opposite of blacklisting, which rejects only inputs known to be bad. Additionally, use appropriate encoding of all output data. “Validation allows the detection of attacks, and encoding prevents any successful script injection from running in the browser,” OWASP says.

    Continue to source...

    By Jon Brodkin, Network World, 10/04/07 ... ities.html
  2. Guest

    Guest Guest

    may bago AJAX
  3. Unwired

    Unwired Member

    What do you mean? :?: :idea:
    As a newbie web designer and coder/scripter, this is my priority, kasi ang hirap pag na hack. Ang mga webmaster my responsibility rin sa mga records ng members.

    SQL injection and cross scripting are the most common. Yung site ko meron na isang attack record. according to "whois" it came from Trend Micro... :shock: ...

    The most famous web security application for nuke is NukeSentinel™ by Raven, this is one of the reason why I choose Nuke over other CMS.
    Kindly check my link sig..

    most vulnerable dito ang php apps..

    Good read!!!:)
  4. Guest

    Guest Guest

    one of the few methods in attacking , Asynchronous JavaScript and XML its like XSS...
  5. klyster

    klyster Member

    Sa amin 2nd priority namin ang security eh, pero di namin pinapabayaan yun. We always encrypt our scripts and disable some functions such as right click, medyo classic nga lang yung system namin hehehe, we use java scripting for it eh. Kayo guys ano gamit nyo???

Share This Page