New Vulnerabilities from next World Wide Web Kudo

New Vulnerabilities from next World Wide Web Kudo AT chroot. org

Outline u What is next WWW ? • From history stories • What’s the problem of current WWW • Introduce to next WWW New vulnerabilities u Demo u Conclusion u

From history stories u The Birth of WWW • In 1980 • By Berners-Lee • Solve the problem of data publishing between different file type. • Make sharing been easier.

From history stories Hypertext u HTML u URI u

From history stories u Web 2. 0 • Users can participate in the web publication. u Decentralization • Blog • Wiki • Community

What’s the problem of current WWW u Data sharing is not easy, especially at uploading

What’s the problem of current WWW Why not use FTP or P 2 P applications for uploading? u YES! But not intuitional u • It has nothing to do with WWW • You should open another window or install other programs. • What you see is lots of filenames, not a good, human nature view

What’s the problem of current WWW • Flickr Uploadr – 3 rd party application u Traditional FTP Client only have filenames view.

What’s the problem of current WWW In WEB 2. 0, it’s also centralize. u Data stores in center servers. u • Although users can participate, but not really own the data. • The long TOS. • The cases of wretch. cc u Personal secret

What’s the problem of current WWW In the other hand, service providers would finally yield themselves to the hardware cost, power cost u Since more and more people would surf the Internet. u How to save or distribute the cost ? u

What’s the problem of current WWW Could we get some idea from our history !? u YES! u

From: http: //www. pro-classic. com/ethnicgv/cmaps/others/ldf 06. htm

From: http: //www. wikilib. com/wiki? title=Image: Qinmap. png&variant=zh-tw

From: http: //www. wikilib. com/wiki? title=Image: Sanguo. jpg&variant=zh-hk

What’s the problem of current WWW u Workstation

What’s the problem of current WWW u PC World

What’s the problem of current WWW u WEB 2. 0 Model

What’s the problem of current WWW u P 2 P !!

Introduce to next WWW Inherit Windows UI/Behavior to WWW u Make users feel identical with local and Web. u • Different files view • Mouse drag More powerful browser u Or user land HTTP server u

Introduce to next WWW u Web + P 2 P • Share the duplicated data • Been relay for other people when they are offline u Applications • Photos • Video/Audio • E-Mail attachment

Introduce to next WWW u Possible bottleneck • Bandwidth • SPAM / SEX • Copyright • Security

New Vulnerabilities Inherit Windows UI/Behavior to WWW u In traditional/general Web programming, we cannot access local file system data (except upload form) u • HTML • Java script • AJAX

New Vulnerabilities u We need more powerful browser • Can access local file system data • File operation transforms to upload forms u It’s traditional CGI Security. • A more powerful client side script than Java. Script Malicious script u Gain your administrator u Copy malicious executables to your computer u

New Vulnerabilities u Web + P 2 P • You might store relay data from other people in your computer • You can extract these data A protected place in your computer, you cannot access there u Encryption u

New Vulnerabilities How could we do ? u Securely develop u Malicious script detection u

Demo NUWeb u Integrate WWW with local file system u User land HTTP Server u User land mplayer u User land Web application u • PHP Script … u… u

Demo

Demo

Demo Allpeers u Parakey u

Conclusion After Web 2. 0, there must be something u We provide some idea and forecast some potential security issue u Sorry that we have no more appropriate demonstrations, since the times is not going there u

Thanks Q&A Time