How to make the Web more secure

web| security in a way, we can say that without the web, there would be no internet. In most cases, however, Web applications and Web sites tend to be vulnerable to a variety of attacks, and web data can be easily stolen or stolen during network transmission. So how to make the Web and data transfer more secure, is a problem that should cause wide attention.

Overall, the most important measure to protect your Web site from attack is to strengthen security awareness and improve security precautions.

In general, the main purpose of an attacker attacking the web is to:

1, illegal peeping;
2, disguised as a legitimate web site visitors;
3, disguised as a Web site administrator;
4, try to control the Web site host.

First, illegal peeping

The most effective way to prevent web attackers from listening to the behavior is to effectively encrypt the connection that is established between the Web site and the visitor. Almost all Web browsers and servers have the ability to send and receive data on encrypted channels, which are managed by two protocols related to SSL and TLS. Where SSL is generated by Netscape, TLS is compatible with SSL3.0. Figure 1 is the Internet option in Microsoft's IE5.0 browser software, which displays a protocol on security issues.

Figure 1 Various cryptographic protocols supported by IE5.0

Web browsers typically use HTTP (Hypertext Transfer Protocol) to connect to a typical Web site, and the URL in the address bar is generally in the form of http://www.somewhere.com. When a Web browser is connected to a secure site, the browser uses HTTPS (Hypertext Secure Transport Protocol) to establish an encrypted connection, and the URL in the address bar is usually in the form of https://www.somewhere.com

In order to establish a secure connection, the Web browser needs to first request a digital certificate from the Web server, which provides proof of identity. When the browser requests its digital certificate to the Web server, it also sends a list of the cryptographic algorithms it supports. When the server echoes the digital certificate and the encryption algorithm it chooses, the browser verifies the digital certificate by checking the digital signature and confirming that the URL matches the public name field of the digital proof. If these tests fail, the browser displays a warning message. As shown in Figure 2.

Figure 2 Authentication of the Web server to HTTPS

The communication between the browser and the server uses symmetric encryption. This means that the same key is used for encryption and decryption. When the server's certificate is verified, the browser generates a key that needs to be passed to the server in a secure way. In general, the use of double encryption to complete the transfer of key. The browser uses the server's public key to encrypt the key and then passes it to the server. The server uses its private key to decrypt the key and then sends a confirmation to the browser.

The above procedure shows an encrypted connection, and the browser and the server all have the same key, and they use the same encryption algorithm. Their subsequent communications will use this encrypted connection. The icon for the browser to display a yellow lock indicates that the connection is established. As shown in Figure 3, site visitors can verify the identity of the server by clicking on the yellow icon to check the server's certificate.

Establish an encrypted connection that requires only the server to obtain a certificate from an authoritative authority, such as VeriSign. But encryption can only prevent an attacker from seeing a site send
and received data, it does not prevent attackers from forging identities and malicious attacks on the site.

Second, legitimate visitors disguised as a Web site

Now we know how to identify a Web site, but how does a site identify its visitors? Here we go on to discuss the problem.

Most Web servers support two password Authentication schemes: Basic Password Authentication and classified password authentication. Two programs are sent to the browser by sending the authentication signal
Yes. When the browser first receives the authentication signal, it displays a dialog box asking the user's name and password. In the Basic authentication mode, browsers use a simple text
This form is passed to the user name and password. In the classified authentication mode, the browser transmits the message class for the username and password. If the server sends its confirmation, the browser
The login information is stored.

If you implement these authentication schemes with simple settings on the Web server, you do not need to add any code in your Web application.

An attacker's listening problem: If a visitor sends his user name and password in a simple text form, it is easy for an attacker to capture this information. Transfer
User information using SSL can easily solve this problem. As shown in the following example.

User ID: < input type= "text" name= "user" >
Password: < input type= "Password" name= "Password" >

If an attacker cannot listen to the communication between the Web site and the visitor, he will take a more despicable approach-disguised as your legitimate visitor. caused this
The cause of the situation is usually caused by the visitors themselves, because most network users are not very careful in the selection of passwords, their passwords are generally not very Ann
All. They like to use the same username and password when they log on to each site.

The way to solve this problem is for visitors to use a secure password when registering an account. Web sites have the best ability to prevent visitors from setting English words as secret
Code, it can advise users to use a combination of numbers and letters of the password.

Third, disguised as a Web site administrator

When a visitor logs on to your site, you will keep their identity valid until they leave the site. So how do you implement this function? Because
A permanent connection is not established between the browser and the server, so the server will only establish a separate connection after each page request is received.

How does the server confirm the identity of the user after a successful login?

The answer is that the browser saves the user's name and password. When the browser and the server connect again, the browser passes the user name and password that you have already stored.
The server uses the user database to verify this information and makes the decision to allow and deny access on this basis.

As we mentioned earlier, the browser confirms the identity of the server by comparing the URL with the public name of the digital certificate of the server. This is a good web
Security precautions. But it can't avoid all the attacks of the camouflage server.

The Domain Name Service system (DNS) resolves an easily readable URL (for example, www.yourunit.com) to an IP address, which is an easy hit in your secure link.
Click on the link. If an attacker accesses a DNS server and modifies a record pointing to his machine, the machine can take all of the
All requests to the www.yourunit.com site are redirected to www.attacker.com. In redirection, the visitor's browser displays the default address suffix. Such as
The string is so long that www.attacker.com is not in sight and most visitors will not notice it.

If an attacker gets a digital certificate issued by VeriSign for Www.attacker.com, the visitor's browser will and www.attacker.com establish a legal
The connection. If the visitor does not check the digital certificate, he will not know that he is on a hacker site. If the attacker had disguised his site as
Www.attacker.com Login interface, he can capture the customer's bank credit card account.

Four, try to control the Web site host

Some attacks exploit vulnerabilities in software running on a Web server to allow the server to execute an attacker's code. A notorious method of attack is to write a large amount of data to the cache to crash the cache. The following excerpt of a section of C + + code is vulnerable to this attack because it has no bounds checking.

void Byyourcommand (char* pszdata)
{char szbuffer[255];
strcpy (Szbuffer, pszdata); ...}

What happens if the strcpy () procedure is executed to overflow the stack? Figure 4 shows you the situation after the system stack overflowed. If an attacker writes too much data in the cache, it overrides the function call record. This is a data structure that contains registers that hold the entry code for the function, as well as the return address of the function. If the attacker's code overwrites the return address of the function, the attacker could execute any code on your computer.

Figure 4 by causing the cache to overflow, the attacker loads the attack code into memory,
Replace the return address of the function to execute the attack code

How does an attacker transplant his attack code onto your computer? The method he uses is to write code into the data cache, and the string that passes the example function can easily infect a hacker program such as a Trojan horse. There are a number of articles that have been introduced to this type of attack.

Hackers know that a vulnerable function (for example, the function cited above) is often invoked by code that responds to user input. An attacker sends an impossible long string to the server. If the cache overflows, the thread that handles his request will crash. The message prompted by an attacker to get an HTTP timeout indicates that the request thread has been corrupted.

How do you stop your Web site's applications from being exploited? First, add the latest security patches to the system software. Then, check the program code written using languages that allow direct access to memory (for example, C, C + +, and Delphi) to see if there are any security vulnerabilities.

Checking the code can give you endless confidence because you can find an application that is not easily attacked by a cache overflow. If you want to avoid such problems completely, you can only write code without using a language that accesses memory directly. You can use scripting languages (for example, JavaScript, Perl) or use explanatory language (such as Java). If you write code in a secure language, your Web site's operators can be freed from a security attack such as a cache overflow every day.

In addition, you should not blindly believe that all kinds of security technologies, although manufacturers in order to promote their products and make a good security quality commitment, but you know that there is no technology to ensure that your web is not subject to attack. So you need a certain amount of time and energy to study and discover the shortcomings of the web, and then find a way to solve the problem.

The security of the Web is very complex and wide-ranging, and in this article we discuss how to avoid the destruction and theft of Web applications and web data by preventing unauthorized users from unauthorized access to Web applications and improving the security of the Web site, from an external attack perspective.