Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it correct to say that AV software focuses on downloaded executables and locally malicious activity, and it doesn't actively scan HTTP/S content for web based attacks such as CSRF, XSS, phishing URL's and other attacks?

Is there anything that can be installed on a desktop (Mac, PC or Linux) that can protect against this class of threats?

Note: Since asking product recommendations are generally frowned upon on this site, I'm looking for a keyword or technology to search for.

(sample fictitious keywords: Facebook Firewall, AV 2.0 + social media protection, CSRF Shield)

share|improve this question
up vote 2 down vote accepted

Antivirus suites often do have frameworks and processes in them to monitor web browsing sessions and email for malicious files or sources. In addition, browsers have been moving to reputation-based URL filtering where they will often notify a user if you are browsing to a malicious site regardless of your AV.

However, if you want to strengthen your posture against CSRF and XSS attacks I would suggest approaching that with browser configurations and add-ons such as NoScript, Ghostery, and HTTPS-Everywhere. These add-ons do great things restricting XSS and CSRF attacks, as well as by preventing execution of malicious content and protecting your Internet privacy.

There are also normal suggestions to make such as keeping your software up to date, disabling Java unless necessary, etc.

If you really want to deep dive browser security I'd recommend NSS Lab's browser security reviews, and Accuvant lab's web browser research (See links below).

share|improve this answer

The main problem with attack vectors like XSS and CSRF is that they are largely the responsibility of the web application that is being browsed to rather than the client browser itself. Both are in the OWASP top 10 coding errors and suggested approaches are to fix the validation of user input on the website itself - so there's not a great deal you can do to protect from the client point of view.

However, having said there is a small subset of XSS that relies on malformed JavaScript will only operate on certain versions of browsers. Keep the browser up to date solves that problem.

share|improve this answer

I know that some virus scanners now include "online security" suites that try to identify phishing sites, but I don't know how well they work. As far as CSRF and XSS, those are pretty much going to be website dependent and would need to be handled on that end.

share|improve this answer
XSS is a client side attack vector and can be protected against by many current browsers – Mark S. Nov 28 '12 at 18:04
@MarkS - XSS allows injection of client side scripts but does not have to originate from the client side. A virus scanner could at best look for suspect activity from any browser and check user form input originating from the machine to ensure a malicious script doesn't try to use a trusted site for permission elevation, but the website itself has to be vulnerable in a way that allows for compromised client side scripts to be returned by the legitimate trusted host. The only information about browser protection I can find is the CSP flag, which only handles certain cases. – AJ Henderson Nov 28 '12 at 19:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.