LOGIN | REGISTER NOW | SUBSCRIBE
 

The Rise of Cross-Site Scripting


By Brian Chess
Email    print   
November 15, 2006 —  (Page 1 of 2)
Word is that next year Toyota will sell more vehicles than General Motors. This really shouldn’t come as too much of a surprise; Toyota has been turning a larger profit than GM for quite a while now. Still, it will be the first time in 80 years that GM hasn’t been on top. The world is not what it once was.

It turns out that something very similar has happened with software vulnerabilities.

Since the dawn of the Internet, the buffer overflow has been king. The Morris worm (the first worm seen on the Internet) exploited a buffer overflow in sendmail as one of its methods of propagation, and buffer overflows have dominated the vulnerability landscape ever since.

Well, until 2005 anyway. Steve Christey, one of the maintainers of the CVE database (cve.mitre.org), reports that in 2005, the most-reported vulnerability was cross-site scripting. Not only that, but buffer overflow wasn’t even in second place. The lineup in 2005 looked like this:

1. Cross-Site Scripting (16.0 percent)

2. SQL Injection (12.9 percent)

3. Buffer Overflow (9.8 percent)

2006 is shaping up to be even worse for the venerable buffer overflow; it’s on track to fall out of the top three:

1. Cross-Site Scripting (21.5 percent)

2. SQL Injection (14.0 percent)

3. PHP remote includes (9.5 percent)

Why such a dramatic change in software vulnerabilities? There are four things going on.

First, Web vulnerabilities are easy to find. Firewalls and intrusion detection systems don’t usually look at Web traffic, and most Web sites are quite content to allow you to poke at them until you’ve found the vulnerability you want. Attackers use tools to automatically scan sites for vulnerabilities.

Second, Web vulnerabilities are easier to exploit. In most cases, it’s a lot easier to develop a working exploit for a Web vulnerability than it is to write some robust shell code to exploit a buffer overflow.




Pages 1 2 


Share this link: http://sdt.bz/29764
 
Most Read Latest News Blog Resources
Zeichick’s Take: Radio moves from analog waveforms to digital packets
Streaming radio highlights the need for streaming applications to be designed to take up as little bandwidth as possible
Taking enterprise architecture to the business side
Startup Corso is bringing out a cloud-based planning platform that ties into business plans
Appcelerator Acquires Cocoafish to Add Instant Mobile Cloud Capabilities to its Industry Leading Titanium Platform
Appcelerator Offers Messaging, Social, Location and Storage Mobile Cloud Services to All Mobile App Publishers
ComponentOne Releases a Collection of 40+ UI Widgets Powered by HTML5 and jQuery
ComponentOne has announced the 2012 release of Wijmo: a kit of UI widgets for HTML5 and jQuery development
Digg!  Digg
Reddit  Reddit
Slashdot  Slashdot
Share on facebook  Facebook
Share on Twitter  Twitter


Add comment


Name*
Email*  
Country     


  • Comment
Loading




close
NEXT ARTICLE
Git, Hudson/Jenkins and modeling on the rise among Eclipse users
More than 700 responders point out the trends in the community, such as the dominance of Java Read More...
 
 
 
 
News on Monday
more>>
SharePoint Tech Report
more>>


   

 
 

Download Current Issue
FEBRUARY 2012 PDF ISSUE

Need Back Issues?
DOWNLOAD HERE

Want to subscribe?


 
blogs tab
Are you at risk for burnout?
Burnout is a severe problem and it can strike at any time. Here's how to tell if you are nearing the edge.
02/09/2012 02:16 PM EST

Agility, mom, and apple pie
If we're to evaluate the state-of-the-art in software development, we should start with the values espoused in the Agile Manifesto.
02/07/2012 11:57 AM EST

RIM woos developers with free tablet
How do you get more apps ported to the BlackBerry PlayBook? By giving every developer a free tablet, of course!
02/04/2012 01:57 PM EST

GitHire: Use Headhunters to Find Your Perfect Programmer
Are you a hiring manager tired of scouring the job boards? Check out this new service that will find 5 people interested in your jobs.
02/03/2012 12:17 PM EST

Facebook claims hacker cred
Facebook's SEC S-1 filing form includes a short essay on the Hacker Way by Mark Zuckerberg himself.
02/02/2012 08:26 AM EST

Ryan Dahl steps down
Ryan Dahl, creator of Node.js, steps back from his position as gatekeeper for the project.
02/01/2012 04:58 PM EST

 
Events calendar tab
Cloud Connect
2/13/2012 to 2/16/2012
Santa Clara
TechWeb

SPTechCon: The SharePoint Technology Conf.
2/26/2012 to 2/29/2012
San Francisco
BZ Media

RSA Conf.
2/27/2012 to 3/2/2012
San Francisco
RSA

IBM Pulse Conf.
3/4/2012 to 3/7/2012
Las Vegas
IBM Tivoli

Game Developer Conf.
3/5/2012 to 3/9/2012
San Francisco
TechWeb