Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Assuming I have a defenseless client computer running Windows 7 that will happily allow any javascript code it comes across on the internet, what's the worst damage that could be inflicted?

I'm unclear on javascript's "reach". Could it erase files on the hard disk? Could it change user access permissions? What horrible fate is NoScript saving me from on a daily basis?

share|improve this question

3 Answers 3

The intended reach of Javascript is limited so it can not access the desktop nor any files in your computer. The security of your computer is limited to how up-to-date the browser is (patching etc), and the associated Plugins.

On the other side, "bad guys" try to find holes in technology and use that knowledge to gain access to something they otherwise wouldn't. When this happens, and the vendor is aware of it, a patch is released.

A few bad things Javascript can do:

  • Javascript alone might allow all the information of a poorly written website to be sent to a "bad guy". This is called XSS / CRSF.

  • It can also cause your logged in account to make changes to websites (editing financial data of a different unrelated site) without you knowing.

  • Finally in regards to your local computer, the exposure depends what add-ins are installed (Flash, etc). If the client has an old version of flash installed, then your whole PC can have malicious software installed on it, or have security dialogs altered to confuse even an educated/informed user.

share|improve this answer
1  
Since jscript explicitly provides for integration with native code applications on the client - if the code can get out of the sandbox it can do just about anything on an MSWindows machine. –  symcbean Feb 7 '12 at 13:56
    
Likewise, it may be possible for javascript to get out of the sandbox and affect Mac and Unix machines as well. –  makerofthings7 Feb 7 '12 at 14:35
    
No - even outside of the sandbox ECMAscript is much more limited in what it can do. –  symcbean Feb 29 '12 at 9:42
    
Currently it is not possible to do any harm on client's computer in Google Chrome, by just using JavaScript. –  Derek 朕會功夫 Mar 18 '12 at 1:57

As a client on a web-browser, javascript doesn't typically present a threat to your file system or changing permissions. There have been a few exceptions/vulnerabilities e.g., this issue in jscript or this one in firefox 3.5 jit compiler, but these vulnerabilities are generally patched in the web browser (and relatively rare for plain-old javascript, esp compared to other plugins like flash/java applets).

The bigger danger with malicious javascript is cross-site scripting (XSS ) or cross-site request forgery (CSRF ). On a poorly configured website where untrusted user-generated content can put javascript that's executed on other people's pages, the javascript can perform actions from the perspective of the other user.

share|improve this answer

The other answers are probably best, but consider the following as well:

  • As mentioned before, if a host is on a domain, any domain resources are that much easier to reach. A single compromised host is often times enough to allow bad guys the entry point they need for the network.

  • This one is a little different, but a compromised host could be used to store illegal files. Not necessarily ideal for the bad guy, but you then become liable for any files found on your drive (should you be investigated by law enforcement).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.