Web Development 701 ~ Security

Though web development is not a main focus (or at least front end), I don’t spend much time investigating many web technologies/concepts. That being said computer security is a general topic that interests me, and learning the subset internet security is something that one should know. Internet security involves WWW (world wide web), browser, and networking security. Since the internet is insecure, internet securities “objective is to establish rules and measures to use against attacks over the Internet.” ~ [1] These attacks can include, but are not limited to; phishing, malware, distributed/denial of service (DDoS or DoS), etc…

Phishing is a form of social engineering, when a user is targeted rather than software/hardware. Normally the goal of phishing is to gain information considered to be sensative (login details, card information, etc…). Phishing is usually in the form of an email or a website which pretends to be a known and trusted entity. An example would be if you were to recieve an email from HR containing a PDF file, you click the pdf to view/download which contains malware. Now the malware has infected the system and can either execute or lay in wait until the device is needed. A follow-up to activation of malware is something like ransomware, where the malware encrypts the entirety of the data and sells the private key to the victim.

Malware is a general term for any malicious software. Malware comes in all forms and does all sorts of things. A botnet for example, is a conglomerate of zombie computers that are controlled to preform an attack on a specified target. This attack could involve something like the ping of death. My good friend Sam told me about this botnet that produced < 1Tbit/s. Take a second and understand how big 1Tbit is, and then imagine how many devices are out in the world and are connected to the internet. Now think of it this way, every single one of those devices is vulnerable to some form of exploit and can be infected to start adding to that 1Tbit/s+ request. What this botnet did was scan and gain access to any vulnerable internet connected device it could, replicated itself onto the zombified device, and amplified the attack. The botnet does so much more under the hood though, so I strongly suggest that one reads the wiki. To give you a perspective of how fast attacks are there is a DDoS attack that occurred in 2016 called the 2016 Dyn cyberattack. It started at 7am and was dealt with by 9:20am. In that time (2hours and 20 min); services like amazon, github, reddit, visa, paypal, spotify, xbox live, playstation network, tumblr, verizon commucations, and more were down.

This brings me to the next example; D(enial) of S(ervice). A DoS attack is when a server can no longer serve due to the server being over-capacitated. botnet like the example above preforms a DoS attack with all of its infected devices, which makes this form of DoS a D(istributed)DoS attack. These are much more powerful as the attack comes from an exponential amount of sources rather than single or few. A form of protection for a DoS attack is to imploy load balancing.

In class the tutor brought up XSS(cross-site scripting), which I have had experience with before since I use C(ross)O(rigin)R(resource)S(haring) when making a website with say flask. Flask in particular makes the employment of CORS easy, an example can be found below …

“A Flask extension for handling CORS, making cross-origin AJAX possible… This means no mucking around with different allowed headers, methods, etc. By default, submission of cookies across domains is disabled due to the security implications, please see the documentation for how to enable credential’ed requests, and please make sure you add some sort of CSRF protection before doing so!” [1]

from flask import Flask
from flask_cors import CORS

app = Flask(__name__)

CORS(app)

@app.route('/'):
def serve_index():
    return 'hello world from a CORS enabled web application!'

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=9123)