DNS Holes, Web 2.0 Flaws Draw Interest at Black Hat

The size and scope of security problems is growing to be so large that security experts are having more difficulty than ever protecting end users from emerging threats. That was evident in the Black Hat Briefings security conference that opened Wednesday.

Case in point: IOActive researcher Dan Kaminsky's detailed for the first time the specific nature of the  DNS flaw reported recently and its overarching scope, providing example after example of how various Internet technologies that rely on the accuracy of the DNS information they received  could be compromised. He warned the audience that the DNS vulnerability could let entire countries, entire top-level domains be hijacked.

While the Kaminsky revelations made the headlines, the pervasive undercurrent at Black Hat was on the dangers of Web 2.0 technology. Not only is "there just more crap out there," says conference organizer Jeff Moss, but "the interconnectedness of Web 2.0 applications stresses things that might not have been big problems in isolation, but have become huge problems when [they're] all tied together."

For example, in his talk about Google Gadgets, Tom Stracener of security vendor Cenzic demonstrated Web-based applets, including port scanners and other malicious tools that could be used to attackusers and steal data, and described a vulnerability in Google Gadgets, which could lead to what Stracener calls "GMalware," or malicious software written in the Gmodules format employed by Google Gadgets.

A whole raft of Web 2.0 risks come from the poor protection of documents, Web site browsing history, RSS feed subscriptions, e-mail, personal information such as passwords, and traces of online activity -- all of which are typically stored locally on the PC, says Jeremiah Grossman of White Hat Security. That information is increasingly moved into the ether, into applications where Grossman says he's "not seeing features on the roadmap that are needed to secure these apps." Thus, all of that data could become compromised.

"We're moving towards Web-based software, software that runs in the browser, and that's a really insecure device," says Grossman. What Web application providers want to do "can't be done securely in the browser right now." Web 2.0 applications are "the new place for malware," he says, "and as it gets larger the problems are only going to get worse."