DNS Holes, Web 2.0 Flaws Draw Interest at Black Hat
The size and scope of security problems is growing to be so large that security experts are having more difficulty than ever protecting end users from emerging threats. That was evident in the Black Hat Briefings security conference
Case in point: IOActive researcher Dan Kaminsky's detailed for the first time the specific nature of the
While the Kaminsky revelations made the headlines, the pervasive undercurrent at Black Hat was on the dangers of Web 2.0 technology. Not only is "there just more crap out there," says conference organizer Jeff Moss, but "the interconnectedness of Web 2.0 applications stresses things that might not have been big problems in isolation, but have become huge problems when [they're] all tied together."
For example, in his
A whole raft of Web 2.0 risks come from the poor protection of documents, Web site browsing history, RSS feed subscriptions, e-mail, personal information such as passwords, and traces of online activity -- all of which are typically stored locally on the PC, says Jeremiah Grossman of White Hat Security. That information is increasingly moved into the ether, into applications where Grossman says he's "not seeing features on the roadmap that are needed to secure these apps." Thus, all of that data could become compromised.
"We're moving towards Web-based software, software that runs in the browser, and that's a really insecure device," says Grossman. What Web application providers want to do "can't be done securely in the browser right now."