“JavaScript is ubiquitous. Everywhere you look, something has been created, at least in part, using JavaScript. JavaScript is easy to learn and use, with many easy-to-incorporate, open-source libraries like jQuery, React.js, and Frameworks such as Backbone.js, Angular.js, and Ember.js.
But the most important fact is that JavaScript is very dynamic and versatile.
Companies have acknowledged this language’s power and use it to build almost anything important to them. This raises concerns as more sensitive logic is developed in JavaScript and more data and intellectual property move to the client side. If companies focus only on protecting the server, as they have until now, they will leave their front door open to attacks such as user-experience tampering, malware injection, data leakage, MiTB, Intellectual Property Theft, and code theft.
According to Statista, over three billion people access the internet globally, giving cyber thieves a very big pond to fish in. Last year alone, researchers found that nearly one billion Android handsets could be hacked with a single SMS. Also, so-called rogue app stores are becoming a serious concern for banks. Subtly altered versions of popular apps, often available for free, are appearing more often on smartphones. In some cases, these apps can steal mobile banking passwords or redirect text messages containing passcodes.
Traditionally, code protection meant storing as much code on the server as possible. This kept your code safe from prying eyes and let the server do the heavy lifting, performance-wise. Even today, storing your code on the server still offers the best protection, though it has some disadvantages.
Web Security: The Challenges
One challenge is forcing an internet connection; if you’re developing an application you want to work on offline, that’s not feasible. Another consideration is performance. Server calls take time. Not an issue for simple apps, but for high-performance apps like games, excessive latency can ruin the user experience.
A question that often crops up is, “Why can’t I just encrypt my JavaScript code?” Seems like a great solution at first, but it doesn’t quite work that way. You can encrypt the files, but then the browser can’t use them. You’ll need to decrypt them to make them readable to the browser, which takes you back to square one.
Keep in mind that, to date, organizations have relied heavily on endpoint security solutions to protect the client side, yet solutions such as antivirus have a low success rate of around 40 percent. If we consider that an application encompasses both the server and client side and that the client-side solution doesn’t necessarily have to be endpoint security, then we understand that every client app has its own cloaking system and defense.
To date, companies have focused on server-side threats and paid little attention to the hidden dangers of client-side hacks. Often, when we meet with IT teams, they are unaware of the risks they face if the client side isn’t protected enough. Our technology is designed to detect tampering with the application on the client. This means development and security teams are alerted and can execute a plan to prevent the attack from succeeding. We make the assumption that execution takes place in an unsafe environment, so we take every measure possible to allow the app to execute safely.
As HTML5 and JavaScript become more ubiquitous, more of an app’s logic shifts from the server side to the client side. This requires developers to focus much more on security. Applications need comprehensive protection.
An additional layer of security allows an application to become self-defensive, ensuring it can detect tampering and derail the program’s execution. Also, if you need real-time notifications, you can use settings to warn you if your application is tampered with or used in a different environment or date than the one you defined.
Conclusion
JavaScript is the de facto language of the web. As we incorporate more important information, logic, and assets on the client side, the battlefield expands. Attacks are happening now without effective countermeasures.
We need to recognize and understand the real dangers of not protecting the client side, rather than relying solely on antivirus-type solutions and other server-side security. It’s time to make a stand on security to better protect your precious web assets.”
Originally published in SC Magazine UK on January 20, 2017.
