Billy Hoffman, manager of HP Security Labs, gave a presentation on advanced Ajax security. He discussed how Ajax applications are prone to attacks due to increased exposure, direct API access, and ease of reverse engineering. He provided examples of real-world Ajax applications with security defects and demonstrated techniques like JSON hijacking, function clobbering, and defeating logic protection. His key recommendations were to not trust client-side code and enforce controls on the server.

1. Advanced Ajax Security Billy Hoffman ( [email_address] ) Manager, HP Security Labs

6. API Domino Effect June 2, 2009 holdSeat(flightID) makeOffer(price, flightID) debitAccount(price) bookSeat(flightID)

7. Overly Granular Application API June 2, 2009 Insecure More secure

8. Polling Status Call June 2, 2009

9. Real-world Example June 2, 2009

10. Web 1.0 to Web 2.0 Conversion June 2, 2009

11. Premature Ajax-ulation! June 2, 2009

12. Exposed Administrative API June 2, 2009 Malicious use Intended use

14. All Your Obfuscation Are Belong To Us!

18. Enumerating All Functions

23. JavaScript Namespaces

25. Clobbering System Functions: alert()

26. Prototype’s Ajax.Request()

34. JSON Hijacking Example

35. JSON Hijacking Example

44. Advanced Ajax Security Billy Hoffman ( [email_address] ) Manager, HP Security Labs