If you've surfed the Web recently, you've almost certainly seen scripts at work performing some of the most common tasks of today's Web pages, from helping users search pages to scrolling text across the screen and launching new windows. In the wake of a government advisory about a newly recognized Web scripting security threat, software providers fear scripting is getting a bum rap despite security protections built into the top scripting implementations. Web scripting is the method most sites use to create moving parts. Compilers translate programming instructions written by humans into a language a microchip can understand. With scripts, browsers essentially do that work on the fly.
Scripts are powerful enough, however, to do real damage when written maliciously.
Chief among these bug hunters is the Bulgarian security consultant Georgi Guninski, who has numerous scripting exploits to his name for the major browsers provided by Microsoft and Netscape. In a recent example , Guninski showed how Microsoft's Outlook Express mail reading application let a malicious user embed a script within a message to expose the mail of the targeted user while the initial message window remained open. Security experts point out, however, that the government's advisory did not pinpoint any flaw on the scripting side of things, but rather with Web sites' implementation of forms that permitted the introduction of potentially malicious scripting tags. Despite the frequency of scripting-related security problems, Microsoft stresses that the hazards come with the technology territory. It is up to each customer to decide what sites they want to allow to perform scripting and which they don't.