One of the newest web technologies has a sneaky power: it can access pages from your browser without you knowing about it.
What if a computer geek could write a program that could make friends for him? That's what 19-year-old "Samy" did in October on the social networking site MySpace. Samy, who started programming at 12, was trying Ajax, the latest star of the Web 2.0 technologies. It stands for Asynchronous Javascript and XML, and in effect lets your browser talk to websites without you knowing about it. (There's a primer at
http://tinyurl. com/7xzse.) Web users generally experience it as a smooth interaction that doesn't have to load a new page - like dragging a mouse around the Google Maps interface. Used on sites such as Odeo and Gmail, it allows them to be as interactive as desktop programmes. But Samy found a sneakier power in Ajax. MySpace, the seventh most popular English-language website according to Alexa Internet, allows people to set up pages as part of a "profile" and find others through their profiles; they can add those people as "friends".
"The idea was simple. I wanted anyone who viewed my profile to automatically add me as a friend," says Samy. "When I realised I could do this via Ajax, I figured I could replicate my Ajax code into any profile my code was modifying." After some tweaking to circumvent MySpace's systems from preventing Javascript code running, Samy created Ajax code on his MySpace site that ran automatically when anyone looked at his profile. Because Ajax can interact with pages users never see, his code pressed all the relevant buttons to add Samy to the victim's friends, and added the words "but most of all, samy is my hero" to their page. Finally, the code pasted itself into the victim's profile, so that any MySpace user viewing the victim's page would have their page infected. MySpace users were unaware that their computers were doing anything unusual. Forced to shut down The code - strictly speaking, a cross-site scripting worm - spread exponentially. Within 24 hours Samy had a million emails from MySpace users "wanting" to be his friend and to whom he was their "hero". MySpace was forced to shut down and make changes to stop Samy's code spreading. "The potential, or threat, with Ajax malware is that server communication is now hidden from the user," says Jesse James Garrett, who coined the term Ajax. "As a result the application can do things on your behalf without your knowledge." On a web page, Ajax can do as much as Javascript - though that's limited locally (it can't delete files apart from cookies on your computer). Garrett now consults for Adaptive Path, which has helped companies create their web experiences. He often explains the popularity of Ajax as a way of making sites feel faster and more feature-rich, and allowing more of the computational work of web application to happen on the user's computer. However, if a site isn't secure, it means your browser can step through complex actions, with you none the wiser. Billy Hoffman, a security researcher for SPI Dynamics in Atlanta, Georgia, had been pondering the risks of Ajax. He outlined his worst-case scenario at the American security conference Black Hat Federal in January. He called it the "1929 Virus", named for the stock market crash that preceded the Great Depression. Hoffman envisioned such a "cross-site script" making its way into a forum post, user profile or web-based stock ticker. Imagine someone who trades stocks online via a browser - as many Americans do - being hit by the virus. The Ajax code could step through the complex forms required to transfer money between accounts and make trades. It could selectively buy or sell stocks, without the knowledge of the account owner. "The exploited users might get their money back but external investors would be making decisions based on a market that was influenced in part by a virus." Garrett says the early myth about Ajax - that it would be too complex for the average developer - has been dispelled, but sees its popularity with developers as a blessing and a curse.An explosion of tools for creating Ajax has led to developers needing to know even less about the technology they are implementing. The tools also lower the bar for malicious Ajax, prompting experts to implore developers to consider the security of web applications carefully. Garrett sees the MySpace Worm as a proof of concept, and even Samy agrees. No general solution He sees the buzz in the business community as part of the problem. "Over-enthusiastic executives will demand that business logic move into the browser without thinking about the consequences." Hoffman points out there's no way to create a general solution, even for websites that don't use Ajax technology. "A web server cannot tell the difference between requests made by a user with a browser and requests made by Ajax." Despite its promise, Web 2.0 is likely to have its share of security bumps. But while many have learned not to open email attachments, user education may not be of much use in Web 2.0 because there's no way of knowing the malicious code has been loaded - unless you turn off Javascript in your browser. Then none of the Ajax-dependent sites such as Google Maps will work.
The Guardian
