[ insider_reports_insider ]
Webmasters Shouldn't Be Insecure
David Utter
Staff Writer
2007-09-20
 Insider Reports RSS Feed
Various injection attacks against websites have compromised some and turned them into covert malware distributors. Google has a few tips on keeping sites safe.
 | | Webmasters Shouldn't Be Insecure |  |
Perhaps it's only fitting that in the wake of Google's debut of Gadget Ads that webmasters receive some friendly advice about trusting widgets.
"If you're considering installing an application provided by a third party, such as a widget, counter, ad network, or webstat service, be sure to exercise due diligence," Nathan Johns wrote at the Google Webmaster Central blog.
A JavaScript- or Flash-laden widget could be a conduit for malware, one that could take a site's otherwise trusting visitors for a trip to computing frustration.
Webmasters need to be aware of the need to keep not just the core operating system updated with necessary patches, but applications and databases as well. Even though Microsoft gets all the publicity over its regular Patch Tuesday monthly updates, companies like Oracle also push out patches on a routine basis.
No one wants their site to be a handy outlet for criminals looking for a boost to their traffic at the expense of a legitimate site. There have been a number of incidents where pages of links to crooked sites have appeared on sites in the .gov and .edu domains.
Johns suggested regularly taking a look at one's site in search engines by using the site: operator, and seeing what has been indexed. Users of Google's Webmaster Tools can find detailed information on possible hacks of their sites, if a problem has been spotted.
Some of the more problematic issues with websites can be corrected with proper configurations. Apache and Microsoft have resources on securing their respective servers (and yes it is possible to tighten down IIS 6.0 effectively.)
Many recent website problems have come from cross-site scripting attacks, and SQL injection. These can succeed when sanitization of input doesn't take place, and a site processes what turns out to be an attack against its resources.
Johns suggested resources at Owasp for more information on XSS and SQL injection attacks. Both attacks are easy for someone to attempt and succeed at on a vulnerable website, but can be thwarted.
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
