Hacking Without Exploits

July 29, 2008 – 2:05 PM

Cybercriminals increasingly are employing no-tech or low-tech techniques for making big money online — no exploits or sophisticated hacker tools required.

The techniques themselves aren’t new — some have been around for nearly a decade. But the Web model has made these schemes that capitalize on so-called business logic flaws more lucrative than ever, according to Jeremiah Grossman, one of the researchers who will pull back the covers on these insidious and often transparent methods of attack at Black Hat USA next week in Las Vegas.

Grossman, CTO and founder of WhiteHat Security, says these increasingly popular methods take advantage of weaknesses in online applications or business processes, and could eventually usurp the ubiquitous SQL injection and cross-site scripting (XSS) vulnerabilities as the biggest threats to the Web. “We find these in Websites all the time,” he says. And all it takes to exploit them is a browser, he says.

“In the last five years, cross-site scripting and SQL injection have been the imminent threat,” he says. “But the bad guys are increasingly looking to monetize [the Web], so we’ll see more of these business logic flaws [being exploited] in the next two years. They are way more difficult to detect.”

Intrusion detection systems (IDS) can’t detect them, nor can Web application firewalls block them, he says, so there’s really no way to know for sure just how prevalent these attacks are today. But Grossman and fellow presenter Trey Ford, director of solutions architecture for WhiteHat, will show some real-world attacks, including some data from WhiteHat’s own clients. “What we do know is that large dollar sums are being lost already,” Grossman says. Some bad guys are making up to seven figures a month using these methods of attack, he says.

Among the more popular venues for these attacks are online auctions and affiliate marketing networks, which help sites attract more traffic by sharing a percentage of the sales they drive to one another. These affiliate models can be easily abused to help pad hit numbers as well as to generate commissions, sometimes without even making a sale, according to Grossman.

Source:
http://www.darkreading.com/document.asp?doc_id=160306