November 19, 2007 (IDG News Service) — If Samy Kamkar plays his cards right, he may be allowed to visit Myspace again in just a few months. For the time being, however, he’s not even allowed to touch a computer, following a January 2007 guilty plea for creating what many consider to be the first Web 2.0 worm: the Samy worm.

Samy’s worm wasn’t malicious, but it did force News Corp.’s MySpace social-networking site to shut down in late 2005 after forcing more than 1 million users to declare Samy a “hero” on their profile pages.

Last week, Samy, who is now 21, made his first public appearance since his conviction, attending the OWASP App Sec 2007 conference, host by eBay in San Jose, California. He was treated like a celebrity at the show, but there were some complications. Under the terms of his plea agreement, he can only use computers for work, so he was forced to show slides that he’d dictated to a friend on a computer that was operated by a conference staffer.

Kamkar: When I wrote the worm, it initially wasn’t a worm. Initially I was just trying to spruce up my MySpace profile. I also wanted to show off to a couple of friends, so I thought ‘wouldn’t it be cool if I did this? [..] As a programmer, it wasn’t too much to learn how to use AJAX, which really helped make the worm work and proliferate really quickly. It only took a few days to write the thing from start to finish and it was only in the last day that I thought that this could be a worm.

(days? *cough*)

While Web 2.0 applications might be all the rage for developers and increasingly important in the enterprise, security experts warn they represent a serious threat — a fact that won’t change until businesses start demanding greater protections.

That was the theme at the New New Internet conference here yesterday, where a panel of security experts told audience members that Web 2.0 application developers lack tools to secure their applications, creating a problem unlikely to be fixed without greater prompting by IT management.

“Beat up on your vendors and your own developers,” said Steve Orrin, director of security solutions for Intel Corp. “Look for and ask for security features in your applications. Until you start asking, they aren’t going to see it as a requirement.”

Much of the issue stems from the fact that underlying technologies being used in new Web applications and Web services were never properly secured to begin with, panelists said.

“We’ve already moved on and started to look at Web 2.0 technology, when Web 1.0 wasn’t secure yet,” Orrin said.

“By networking with code-writing peers and hearing lectures by security experts”, he said, “hackers can gather the truth: information necessary to build safer systems and to push for better security.”

“Cross-Site Scripting is much more powerful when used in a Web 2.0 environment”

“What we’re seeing is advanced uses of the same sorts of attacks that were used before.” Cross-site scripting, for example, is “much more powerful” when used in a Web 2.0 environment, he suggested. “As powerful a tool as Web 2.0 technology is for developers and users, it’s even more so for attackers.”

That’s especially true of things like phishing attacks, Orrin said.

“It’s become a lot easier to trick users with Web 2.0 — the automation is to the point where the user doesn’t even have to be involved for the attack to occur.”

Hart Rossman, chief security technologist at research and engineering giant Science Applications International Corporation (SAIC), agreed. He pointed to the difficulties that security professionals face in checking some Web 2.0 applications for vulnerabilities. “AJAX is the weapon of choice for sex appeal, but current vulnerability assessment tools have trouble traversing AJAX sites, and it’s harder to find the vulnerabilities,” Rossman said. “You can’t recreate sessions as easily, so if something happens, it’s very difficult to create the forensics to analyze it.”

“AJAX is the weapon of choice for sex appeal.”

Rossman added that the rise of the use of widgets and other outside components on sites raises the specter of people using “Web 2.0 on top of Web 2.0″ to mount large cross-network attacks.

Experts such as Rossman are currently focusing their efforts on determining a suitably-scary-sounding name for these new and unprotected (and potentially devestating to your E-business) Web 2.0 on top of Web 2.0 attack worms.

“People tend not to trust the mash-up developer.. they trust the API provider. There’s very little thought given to the mash-up, or the mash-up on top of the mash-up.”

News Link : http://www.internetnews.com/dev-news/article.php/3708876

We are proud to announce the grand-opening of XSS Worm : Cross Site Scripting Attacks ™ - http://www.XSSworm.com - Cross Site Scripting Attacks : the new site for discussion of XSS (also known as CSS (not to be confused with Cascading Style Sheets (also sometimes referred to as CSS)) vulnerabilities) security issues in web-enabled networks and dynamic Internet applications.

XSS - a word commonly used by modern security experts to categorize a wide range of emerging web-enabled security threats. This unpronounceable word was once said to derive from the common term “Cross Site Scripting” (the leading X in this instance perhaps alluding to the Cross of the popular novel.) Yes friends our Web sites are being more complicated from day to day; and the web sites which has been produced by html is decreasing on the net. The popular ones are php;asp;jsp and other technologies and with this increasing the attacks are being more dangerous.

It’s very common and unfortunately still an issue we have to deal with in many web-aware applications. Internally the XSS WORM Team has been working on several XSS Security projects to help mitigate and fix these security issues, as well as to detect them in the code sources that are available online so that they can be fixed a worm is developed.

Go straight to the XSS Security discussion forum!

According to a new study, up to over 90% of all (100%) web sites may be vulnerable to some form of security attack.

Prominent Jeremiah Grossman of WhiteHat Security (whitehat.com) — the Web applications security founded by vulnerability scanning whiz Jeremiah Grossman — concludes that as many as 90 percent of all the sites that it has tested in the last year remain open to some form of hijack or infection.

The leading problem remains many sites’ vulnerability to cross-site scripting (XSS) hacks, through which attackers place malicious code on legitimate sites to trick end users into handing over their personal information or passwords.

As many as 75 percent of the pages scanned by WhiteHat had some form of XSS-exploitable flaw, according to the paper. But it’s not only XSS Worms that application developers have to be conerned about - according to Whitehat, Cross Request Forgery attacks are emerging as the “new .. [xss] ” and hackers are scrambling to update their virus engines.

“The best way to think about Response Splitting is that it’s executed similarly to Cross-Site Scripting (XSS) … but more powerful.“
Jeremiah Grossman

As in the rest of the online world, however, WhiteHat contends that XSS threats top the list of vulnerability classes by vertical, followed closely by Information Leakage.

“These statistics continue to reveal recurring and emerging issues that are affecting Web sites across industries,” said Grossman, who wears the title of CTO at WhiteHat. “As increasing amounts of sensitive data are stored online, WhiteHat remains vigilant about alerting companies to common attack methods and emphasizing the importance of Web site vulnerability management as part of their overall security posture.”

The original security article source can be located at http://weblog.infoworld.com/zeroday/archives/2007/10/study_90_percen.html or at http://google.com.

This is our introduction for the newest premium security information service XSSworm.com : cross-site scripting attacks - we will be posting news and updates on these topics and we welcome all of your comments on the topics of Web 2.0 Security, Cross-Site Scripting, XSS Worms, XSRF Worms, Digg and Social Networking worms, Youtube worms, Facebook worms, Web 2.0 Security and XML and so much more!

Looking for XSS Vulnerabilities and Exploits?

WHITEHATS — Please pay our XSS page a visit and leave your comments! - only the most relevant XSS security news and tools and comments only - no spam please your blackhat SEO tricks is not welcome here.

Regards, The XSS Worm . Com Team.

XSS WORM : Cross Site Scripting Attacks : http://www.xssworm.com - cross-site-scripting-security@xssworm.com - AIM: cross site XSS - (c) 2007,2008