Very cool mashups are often written using Ajax. In many cases, a mashup will invoke a callback function that is meant to be defined by other apps in the mashup. This is a security disaster and once again shows there is a fundamental tradeoff between cool new Web functionality and security. As the Fortify team says in its paper, "An application can be mashup-friendly or it can be secure, but it cannot be both."
The Real Security Problem With Ajax
Most people who build software think of their creation as a number of components (let's call these "boxes") that communicate through APIs in various ways (we'll call the communications lines "arrows"). In a traditional boxes-and-arrows software design, architects concern themselves with things like which box does what, which data flow where, and how the right kind of computations are performed in the right order. Most architects ponder a god's eye view of the system that treats the boxes as essentially equal parts of the system.
The problem with the Web 2.0 world is that many of the boxes run on untrustworthy machines. In fact, in the worst cases, these boxes run on intentionally malicious machines owned by an attacker. Attackers can then leverage the old chestnut "make the client invisible" attack pattern to break system security.
Put in more traditional security terms, part of the computation in a Web 2.0 design happens on the "untrusted" side of a critical trust boundary. If developers forget to account for the trust boundary in their design, they end up exposing critical data, essential computations, or other valuable information assets to attackers.
Ajax makes this kind of mistake easier than ever by treating a complete software system as a set of basically equivalent boxes and arrows with little focus on trust boundaries. Plus, trust boundaries expand when sensitive data and credentials are shoved around between the client and the server.
This kind of trust boundary problem is one that security engineers have wrestled with for years when dealing with distributed systems. In our new book, Exploiting Online Games, to be released in July, Greg Hoglund and I describe myriad security problems suffered by MMORPGs such as World of Warcraft and Second Life. A majority of these exploitable, monetizable problems involve mixed-up thinking about trust boundaries, which parts of a security-critical computation can be performed where, and what kinds of assumptions game developers make. I believe that the kinds of security problems suffered by massively distributed online games are a harbinger of the kinds of security problems we'll see in Web 2.0 software.
Until system designers gain a better understanding of trust boundaries and learn to avoid sending critical parts of their system directly to attackers, we'll end up with poor distributed system security. Be forewarned.