IT Jobs
Malware adapts to Web 2.0
Survival of the sneakiest.
By Robert McMillan, IDG News Service
Published: 02:47 GMT, 15 November 07
Hackers will use Web 2.0 technologies to make their attacks sneakier and more effective, according to a security researcher.
Google Mashups, RSS feeds and search can all be misused to distribute malware, attack people and communicate with botnets, said Petko Petkov, speaking at the Open Web Application Security Project (OWASP) US 2007 conference, held on eBay's campus.
Hacker toolkits like MPack have made it easier for the bad guys to deploy malicious code, but some of these emerging technologies promise to take hacking to a whole new level, he said.
"Now people can use and abuse Web 2.0 technologies to construct something much larger," he said. "When you look at it from a hacker perspective, you'll see there are a whole lot of opportunities."
Petkov said it took just one day to build a web-based attack infrastructure using Google Mashup Editor, Google's invite-only web application development service. And even if Google decided to shut down this type of attack system, its open and distributed design makes it very easy to set up a new account and launch an identical network.
"What is cool and what is the problem is if somebody closes the application down, these attackers can bring back the application to a live version in five seconds," he said.
This kind of Web 2.0 malware is in its infancy, but it's starting to be used, said Wayne Huang, CEO of web security firm Armorize. Huang said he has seen attackers use Google Alerts to scan the web for sites running software with known vulnerabilities, and he said that criminals are also starting to use RSS-to-email conversion services to control their botnets.
Until recently botnets would be controlled via IRC (Internet Relay Chat) channels, but now distributed RSS-based command-and-control networks are coming into favour, Huang said. This makes it much harder for law enforcement to take down the controller computers.
Attackers could also encode the date and domain name of the computer looking for instructions on random web pages that would also contain attack instructions for the botnet. These instructions could then be dug up by the botnet using Google search.
Researchers like Petkov and Huang believe that criminals are only beginning to experiment with Web 2.0 hacking techniques like these, but that if they do catch on, it could become a nightmare for the Web 2.0 world.
"Nobody realises the potential for abuse," Huang said. "When it happens, I think it's going to be on a very massive scale and very hard to stop."
"I think [these attacks] are brand new right now, but with time they're going to get more relevant," Petkov said. "Right now we're still in the playground with this."
Add your commentComments