Developer's Guide to Web Application Security

Recognizing the

Impact of Mobile Code Attacks

Plain HTML code does not have the power to make decisions or access information

on a system. If you add mobile code to the mix, however, it allows third parties to

send in little “agents” to do the dirty work.These agents can be silent, sneaky, and

malicious.They can retrieve information about your system, or from a user, and send

it back to a server on the Internet.

A firewall offers little safety when it comes to mobile code. If users have Web

browsing access, mobile code can also come into their systems.There is, unfortu-

nately, no realistic way to cut off e-mail messages and programs that originate fr ...