A bunch of hub-ub has been created over a presentation at the CCC conference called Subverting Ajax.
The FUD has been interesting to watch. Early in the article they discuss how JavaScript is a prototype-based system which is a 'flaw' as people can do things like:
-
-
XMLHttpRequest.prototype.send = function (pay) {
-
// Hijacked .send
-
sniff("Hijacked: "+" "+pay);
-
pay=HijackRequest(pay);
-
return this.xml.send(pay);
-
}
-
The article does do a good job in explaining some of the dangers, but doesn't mean that all Ajax is bad. Much as SQL injections are bad, but if you do a few smart things you will make sure that there is no surface for them.
Alex Russell of Dojo has a great response over on his blog:
What really makes me sad though is that the work of folks like H.D. Moore, Thor Larhom, and Jeremiah Grossman gets lost in the noise when chaff like this is published. By not providing an honest evaluation of the real-world potential of a threat vector, the authors of a paper like this create a sort of seismograph that can’t tell magnitudes, only number of things shaking. Without magnitude information, an instant market is created for people to stand on the tops of roofs and yell down how bad it is (or in this case, how bad it could have been had they not been valiantly standing there).
Threat information is only valuable as when there is enough data about it to manage and mitigate risk. Yes, security problems are real, and web app security problems aren’t going away any time soon, but without level-headed analysis of the threat vectors, the real-world risk profiles, and the root-of-trust that is being attacked there is very little reason for clients to view the security community as anything but a freakish collection of opportunists, wolves, and disillusioned techno-utopianists. Accurate data builds trust, and trust builds a relationships that allows you to effectively mitigate risk. It’s high time that the security industry developed a code of ethics that prevents FUD-slinging. OWASP could even lead the way although I suspect there’s not a chance in hell of it happening.
What are your thoughts?
