Does AV software protect web applications (Twitter, Facebook, etc) from attacks? (CSRF, etc)

Question

Is it correct to say that AV software focuses on downloaded executables and locally malicious activity, and it doesn't actively scan HTTP/S content for web based attacks such as CSRF, XSS, phishing URL's and other attacks?

Is there anything that can be installed on a desktop (Mac, PC or Linux) that can protect against this class of threats?

Note: Since asking product recommendations are generally frowned upon on this site, I'm looking for a keyword or technology to search for.

(sample fictitious keywords: Facebook Firewall, AV 2.0 + social media protection, CSRF Shield)

Answer 1

Antivirus suites often do have frameworks and processes in them to monitor web browsing sessions and email for malicious files or sources. In addition, browsers have been moving to reputation-based URL filtering where they will often notify a user if you are browsing to a malicious site regardless of your AV.

However, if you want to strengthen your posture against CSRF and XSS attacks I would suggest approaching that with browser configurations and add-ons such as NoScript, Ghostery, and HTTPS-Everywhere. These add-ons do great things restricting XSS and CSRF attacks, as well as by preventing execution of malicious content and protecting your Internet privacy.

There are also normal suggestions to make such as keeping your software up to date, disabling Java unless necessary, etc.

If you really want to deep dive browser security I'd recommend NSS Lab's browser security reviews, and Accuvant lab's web browser research (See links below).

https://www.nsslabs.com/reports/categories/endpoint-security/browser-security

http://www.accuvant.com/sites/default/files/images/webbrowserresearch_v1_0.pdf

Answer 2

The main problem with attack vectors like XSS and CSRF is that they are largely the responsibility of the web application that is being browsed to rather than the client browser itself. Both are in the OWASP top 10 coding errors and suggested approaches are to fix the validation of user input on the website itself - so there's not a great deal you can do to protect from the client point of view.

However, having said there is a small subset of XSS that relies on malformed JavaScript will only operate on certain versions of browsers. Keep the browser up to date solves that problem.

Answer 3

I know that some virus scanners now include "online security" suites that try to identify phishing sites, but I don't know how well they work. As far as CSRF and XSS, those are pretty much going to be website dependent and would need to be handled on that end.