LOGIN | REGISTER NOW | SUBSCRIBE
 
print Printable version 
Most Read Latest News Blog Resources
Does Windows cost Microsoft opportunities?
Microsoft's decision to focus .NET on Windows is stifling innovation due to the specter of...

Mono brings .NET to Android
At Microsoft MIX, Mono will unveil the ability to port .NET applications to the Android op...

OSBC focus turns to best practices for open-source adoption
Businesses are no longer asking why they should adopt, but how do they use open source leg...

Digg!  Digg
Reddit  Reddit
Slashdot  Slashdot
Share on facebook  Facebook
Share on Twitter  Twitter

The Rise of Cross-Site Scripting


By Brian Chess
November 15, 2006 — 
Word is that next year Toyota will sell more vehicles than General Motors. This really shouldn’t come as too much of a surprise; Toyota has been turning a larger profit than GM for quite a while now. Still, it will be the first time in 80 years that GM hasn’t been on top. The world is not what it once was.

It turns out that something very similar has happened with software vulnerabilities.

Since the dawn of the Internet, the buffer overflow has been king. The Morris worm (the first worm seen on the Internet) exploited a buffer overflow in sendmail as one of its methods of propagation, and buffer overflows have dominated the vulnerability landscape ever since.

Well, until 2005 anyway. Steve Christey, one of the maintainers of the CVE database (cve.mitre.org), reports that in 2005, the most-reported vulnerability was cross-site scripting. Not only that, but buffer overflow wasn’t even in second place. The lineup in 2005 looked like this:

1. Cross-Site Scripting (16.0 percent)

2. SQL Injection (12.9 percent)

3. Buffer Overflow (9.8 percent)

2006 is shaping up to be even worse for the venerable buffer overflow; it’s on track to fall out of the top three:

1. Cross-Site Scripting (21.5 percent)

2. SQL Injection (14.0 percent)

3. PHP remote includes (9.5 percent)

Why such a dramatic change in software vulnerabilities? There are four things going on.

First, Web vulnerabilities are easy to find. Firewalls and intrusion detection systems don’t usually look at Web traffic, and most Web sites are quite content to allow you to poke at them until you’ve found the vulnerability you want. Attackers use tools to automatically scan sites for vulnerabilities.

Second, Web vulnerabilities are easier to exploit. In most cases, it’s a lot easier to develop a working exploit for a Web vulnerability than it is to write some robust shell code to exploit a buffer overflow.

Third, there are valuable things on the Web. Every day there are more sites, more services, more transactions and more traffic on the Web. You could find plenty of cross-site scripting vulnerabilities in 1998 too, but there wasn’t so much to gain by exploiting them. There weren’t enough sites holding valuable data, and there weren’t enough visitors to make real money exploiting Web vulnerabilities.

Finally, it takes time and concerted effort to write Web applications that don’t contain vulnerabilities. PHP makes it easy to accidentally allow cross-site scripting, SQL injection or remote attacks. Languages such as Java and C# make buffer overflow a vanishing possibility, and they even provide all the tools you need to avoid SQL injection, but they still make cross-site scripting hard to avoid.

To make matters worse, we still haven’t made progress toward eliminating buffer overflows. Christey’s data shows that the number of buffer overflow reports is holding steady at between 250 and 450 per year. Web vulnerabilities, on the other hand, have skyrocketed beginning in 2003. (In total, there were three times as many vulnerabilities reported in 2005 as there were in 2001.)

If there’s one lesson to be taken away from this data, it’s this: You can no longer write a Web application without thinking about security. Programmers need to understand that their code isn’t complete until it’s secure.

Brian Chess is chief scientist at Fortify Software.


Share this link: http://www.sdtimes.com/link/29764
 

Add comment


Name*
Email*  
Country     


  • Comment
  • Preview
Loading



 
 
 
 
News on Monday
more>>
SharePoint Tech Report
more>>


   

 
 
Download Current Issue
ISSUE 3/15/2010 PDF

Need Back Issues?
DOWNLOAD HERE

Receive the print Edition?


 
blogs tab
Google Code turns 5
Google Code Turns 5, and adds a Paxos Algorithm to make the system more stable and reliable.
03/17/2010 11:16 AM EST

Test your Visual Studio 2010 know-how
Microsoft is offering free beta certification exams for Visual Studio 2010.
03/17/2010 11:08 AM EST

Microsoft lifts the hood on IE9
Microsoft is previewing IE9.
03/16/2010 01:10 PM EST

 

Events calendar tab
EclipseCon
3/22/2010 to 3/25/2010
Santa Clara, Calif.
The Eclipse Foundation

DevConnections
4/12/2010 to 4/14/2010
Las Vegas
Penton Media

MySQL Conf. and Expo
4/12/2010 to 4/15/2010
Santa Clara, Calif.
O'Reilly Media

High Performance Computing Linux Financial Markets
4/19/2010
New York City
Flagg Management

Informix User Conf.
4/25/2010 to 4/28/2010
Overland Park, Kans.
IIUG