
The New Year has been a busy one for me, thanks to several new customers asking me to provide custom OpenLaszlo-powered Flash widget development. It has been exciting working with other new ventures in their early stages. I find it noteworthy that all my new customers are utilizing widgets for e-commerce purposes. E-commerce 2.0 via widgets seems to be gaining momentum!
I’ve been meaning to write this post since December about flaws in MyBlogLog’s widget…I suppose it is good that I didn’t, because I may have upset their recent $10MM acquisition by Yahoo!
Just about any web application developed in HTML/AJAX is inherently insecure. HTML has been bastardized since the dot-com boom to be an application development technology, which it never was intended to be. HTML is fine for presenting and navigating static text, as originally designed. But when you ask a standards-based thin-client technology to perform the task of running as an application technology, you are asking for trouble with regards to performance and security. This makes AJAX, riding on the back of HTML, an insecure foundation upon which to try to build Rich Internet Applications (RIA’s).
The crux of the problem comes down to scripting. Any browser-based web application can be fooled by scripting. Scripting allows hackers (or as I call myself when doing this, an experimenter) to create automated programs that perform the actions that a human performs within a browser, like editing text and clicking buttons.
eBay is always a favorite target for scripted bots. Every automated eBay snipe program is a scripted bot, b/c eBay has granted only one company that I know about (Unwired Buyer) access to their bidding API. eBay has taken immense efforts at surely a great expense to try to defeat scripted bots (notice how eBay’s URLs are now randomly generated when doing searches…but then please be sure to use Cooqy for all your eBay shopping!).
Fundamentally, eBay and other companies running HTML web applications and HTML widgets like MyBlogLog will never succeed in preventing scripted bot attacks. The standards-based browser and availability of browser source code like the Gecko engine give hackers (or experimenters) the power to emulate humans very effectively. Steps are continually being taken to defeat scripted bots (like those annoyingly hard-to-read letter and number images you are forced to re-enter to login to many websites)…but the problem will never entirely go away…that is the bane of trying to build a skyscraper on top of a fundamentally weak foundation originally intended to support a house.
MyBlogLog’s implementation is particularly amateurish with regards to security and the ability to spoof the reader roll widget. This TechCrunch article doesn’t begin to scratch the surface of the vulnerability. The article talks about the ease of spamming a single reader roll widget…but it is just as easy to spam all reader rolls on every blog containing the widget! That makes the MyBlogLog reader roll a fantastic advertising vehicle to drive traffic! Here’s how easy it is for hackers (or experimenters) to advertise on everybody’s MyBlogLog reader roll widget:
The first step is to create a MyBlogLog account and upload an avatar with the image to appear on every MyBlogLog widget. On the account’s home page, view the page source. MyBlogLog creates a “SID” (a unique identifier) for every user. The SID can be quickly spotted by looking at the avatar’s filename (hosted on Amazon’s S3 service). It will look like “2006113016423040″. It is simply a date and time that the MyBlogLog account was created.
The way the widget works, is that when a user signs into MyBlogLog, the SID is stored in a browser cookie. The widget simply reads the cookie and displays the avatar. This is done via a simple PHP REST-style transaction the widget performs when it loads (mybloglog.com/tr/urltrk.php). The PHP transaction parameters identifies the widget’s owner (another SID) and the viewer’s SID. So simply invoking a PHP REST transaction with the SID and the target widget’s SID is all that is needed to make an image appear at the top of the widget.
MyBlogLog makes it incredibly easy to mine everyone’s SID…all someone has to do is scrape the HTML contents of their member directory and parse out everyone’s SID. I can’t emphasize how stupid it is for MyBlogLog to have an entire directory of members and communities in a static HTML structure…this is inviting all types of attacks. Actually, I’ll go so far to say it is F@#king Stupid. I can’t believe Yahoo! coughed up $10MM for amateurs with only 35,000 member accounts, but oh well. Buyer beware.
Creating the scripted bot is trivially easy (well, for a programmer at least)…just write a program to iterate through the online member directory, read each member’s HTML page to extract the SID, then invoke the PHP REST transaction with your account’s SID…presto, you have a very effective marketing tool to get noticed on several thousand blogs. It won’t be long until teenagers have fun placing porno pics on everyone’s blogs. This works very well on blogs with slow traffic, where the image is likely to stay at the top of the widget for weeks on end. The majority of blogs don’t have much traffic, after all.
Unfortunately, MyBlogLog is not an isolated example. Web 2.0 companies rushing to build widgets and web applications with HTML and AJAX technology without considering security are all ripe for attacks. Even when security is taken into consideration, there is always the possibility of scripted bot attacks.
This is one reason why Cooqy’s widgets and RIA search engine are built with Flash as the runtime engine. As far as I know, there is no effective scripting mechanism that can be used to create script bots for Flash widgets and web applications. The recent announcement of Adobe to open-source portions of the Flash player may unfortunately open up the door to this in the future, however. But for now at least, Flash provides a fundamentally more secure and hack-proof (or experimentation-proof) foundation for building widgets and web apps.
OpenLaszlo-powered Flash applications are, I believe, the fastest and safest way to bring new widgets and web applications to market.