Top 5 Web Service Security Flaws Identified

There is a new Top 5 threats list for web services. Surprisingly, many vulnerabilities come from open or standards-based technologies. Prepared by web services researcher Spire Security LLC and Forum Systems, a web service security provider of Web services-related threats. See how XML parsing and WSDL scanning can impact the security of your web service project.

by Vance McCarthy

Tags: Web Services, Attacking, Thief, Forum Systems, Web Service Security, Threats, WSDL,



Many of the threats will sound familiar to long-time web-based developers, but have a new web services wrinkle to take advantage of new loosely coupled technologies such as XML and WSDL, the report The report, entitled "Attacking and Defending Web Services, found

"The flexibility of Web services that is driving its adoption is also creating its greatest exposure. Companies are publicly publishing their WSDL documents as a handbook to connect with each other. But these documents also provide a handbook to attacking your business," said Mamoon Yunus, CTO of Forum Systems. "As attackers learn about the characteristics of the Web services world, they will -- and already are -- attacking the individual components," said Pete Lindstrom, research director for Spire Security.

The Spire/Forum survey identified five (5) categories of Web Services security vulnerabilities:

  • Vulnerability discoverysuch as "WSDL scanning": Like a thief searching for an open window or unlocked door. In the Web services world, the thief can then publish and even sell your weaknesses to others.
  • Probing attacks, such as "parameter tampering" and "replay attacks": Brute force attacks, like a thief jumping over the fence and then running back out, stealing bits and pieces of information.
  • Denial of (web) service attacks such as "coercive parsing,""recursive payloads,""oversize payloads" and "routing detours" attacks: Like a thief cutting the wires to a core system of a house -- the XML parser -- in order to gain access.
  • External reference attacks that target business-to-business collaboration. Inadvertently letting a stranger into your house who you think is a friend.
  • Malicious content, such as "schema poisoning" and "SQL injections":Broad and worst type of attacks that include virus infected XML documents. Like a thief delivering a package with a bomb in it. These can result in stolen identities, sensitive information leaks, fraudulent transactions and systems being put off line.

    For a more comprehensive list and analysis of threat profiles "Attacking and Defending Web Services" is available as a PDF download.

    back

    • Share
    Go