Advanced Ajax Security

Slide 1:Ad v a n c e d A ja x S e c u r it y Billy Hoffman (billy.hoffman@hp.com) Manager, HP Security Labs © 2007 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice

Slide 2:Who am I? • Manager HP Security Labs • In security space for 6 years • CS Degree from Georgia Tech • Areas of focus − Crawling and sampling − JavaScript static analysis − XSS • Frequent presenter at hacker/security conferences 2

Slide 3:Presentation Overview • Manipulating Client-side logic • Defeating logic protection techniques • Function Hijacking • JSON Hijacking • Hacking Google Gears 3 March 31, 2008

Slide 4:“Boring” Ajax Security • Increased attack surface • Direct API access • Easier to reverse engineer • Amplifying web attacks • Offline attacks • “Surely no on