Feature

Exploiting Web 2.0: The Barbarians Inside the Firewall

Web 2.0 makes businesses vulnerable to a new class of security threats—attackers using Web browsers and Web traffic to sneak undetected past legacy firewalls, intrusion prevention systems and URL filters.

Leave a comment

By Doug Camplejohn, CEO, Mi5 Networks

September 21, 2007 — CIO — Although Web 2.0 has enriched the Internet with some great new capabilities, it has also brought some very unpleasant ones, namely a whole class of new security threats that can silently install when a user visits a compromised website. Web 2.0 gives the bad guys more "surface area" to exploit—more bandwidth, more communication channels (for example, IM, P2P), and more client-side executable options. To make matters worse, many users appear to have thrown caution to the wind when it comes to downloading untrusted content. Employees who would never download an e-mail attachment from someone they didn't know will now add a widget to their MySpace page or play a potentially harmful YouTube clip without knowing where it came from.

It is also becoming more and more difficult to distinguish malicious from nonmalicious sites. Google recently published a paper from researching sites it crawls (see "The Ghost in the Browser"), and found that one in 10 websites contains a malicious payload. Most users would be hard-pressed to distinguish the malicious 10 percent from a random set of search results. Once inside the firewall, these covert applications can steal confidential data, infect other machines and launch spam or malicious attacks.

The "New New" Threat: Botnets
The most sophisticated of these new threats are botnets. These collections of software robots known as "bots" run on compromised computers called "zombies" that can be controlled by "bot herders" through a communications infrastructure named "command and control" or "C&C" for short. The value of a botnet is directly proportional to the number of machines it controls, the value of those machines (for example, .com versus .org, if data theft is the goal) and the aggregate bandwidth the botnet can command for distributed denial-of-service (DDoS) attacks.

Once a bot hijacks a PC, it starts scanning the network for other vulnerable hosts to compromise. The bot will then report back to C&C with information on how many systems are under its control. Finally, C&C will send instructions and payloads for the botnet to execute, which could include sending spam, click fraud, collecting confidential data or launching a DDoS attack.

In the early days, botnets were typically controlled by a single C&C, so chopping off its "head" would render the botnet useless. Not anymore. These days, most botnets contain multiple C&Cs, hiding on many servers, with control being turned over to a new server every few minutes. They use a tiered infrastructure, much like a military command structure, so taking out a lower-level C&C won't affect the rest of the botnet. In the spirit of organized crime, botnet owners are now collaborating, sharing pools of bots and C&C servers to increase fault tolerance, and they're making more money in the process. Finally, bots are broadening their reach beyond their initial target base of desktop PCs and are now infecting servers, including e-mail and UNIX servers.