Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet.

Of course this does not protect me against careless browsing attitude. For exampple If I post my credit card informations on a wrong/bad website.

The question is if a browser which works only with HTML (HTML5 too) and Images is secure against malware. So is malware infection only possible via scripts, flash-plugin, java applets etc. (beside the fact that the browser itself could have bugs/leaks but this is not the point in this question)

Let's say I use a text-only browser like links2 for Linux am I save for malware and is this also true for pure HTML and image active in browser?

share|improve this question
    
Even links2 may have vulnerabilities! –  Henning Klevjer Jan 17 '13 at 13:42
    
of course, but I will assume - only for understanding - that the malware does not hit on a browser vulnerability because this is always a point. I think the 100% secure system/programm is not possible –  Jan Koester Jan 17 '13 at 13:45
1  
You may want to look into something like sandboxie. en.wikipedia.org/wiki/Sandboxie –  ponsfonze Jan 17 '13 at 13:58
    
thx for the link :-) I know the sandbox mechanism and I often use the chrome browser because it delivers a sandbox for every tab. My question is if it is enough to disable scripts, flash, java etc. or if I need additional protection mechanism software like e.g sandboxie –  Jan Koester Jan 17 '13 at 14:13

2 Answers 2

up vote 1 down vote accepted

There is a lot of exploits against libjpeg for sample. Who could be triggered even without javascript.

100% sure don't exist anyway, but. Each functionality present in your host are subject to security faillure and related exploit.

While quantity of faillure existing or maybe existing is related to complexitiy of software, more a functionality is complex (rich), more they are subject to hold some non discovered vulnerabilities.

Most faillures in statics libraries and small utilities like libjpeg or video codecs seem already reviewed, chance to find new non discovered vulnerabilities in such libraries are very smaller than chance to find vulnerabilities in complex programming language (like javascript). Note that in propretary libraries like flash or java, who depend from a hierarchical decision struture may be even lot more considerable.

So the right choice for your configuration is to do between no trust ( su - nobody -c "links" or even better: keep your pc down and cut every cable! ;-) and feel good ( all plugins and codec automatically downloaded and installed... )

share|improve this answer
    
You bring up a good point, if you load up ANY file that is actually designed to exploit a bug, it woudln't matter if you have Java, Flash, and Javascript disabled within your browser. There are tons of Adobe Acrobat bugs that have been fixed, tons of Word and Excel bugs that have been fixed, most allowed additional software to be installed –  Ramhound Jan 17 '13 at 16:56
1  
@Ramhound As I know (a little) open-source software, I can say that tons of faillures was fixed in open-source libraries, like libjpeg, ghostscript and gimp-print (for following some exploit using postscript files, for sample). For myself, I've already done both: fixed some bugs of mine, but some other was more worked around. I don't know effectively propretary work, but I suspect that TONS of propretary fix are in fact only work-around. –  F. Hauri Jan 17 '13 at 17:07
    
Which is exactly my point. I know there was a period of time where I would worry about loading a link on a forum which was clearly an image but not knowing if the image was safe to view. All it takes is for a bug to exist in the file format for somebody to load a malicious file onto your system. –  Ramhound Jan 17 '13 at 19:05

A browser which is configured or designed to accept, parse and render HTML and images only is not enough to protect against malware. It does however considerably reduce your window of exposure.

There has been multiple vulnerabilities in images, html, fonts parsing libraries/engines used by web browsers or others. These vulnerabilities can be sometimes exploited to trigger malware injection and execution.

share|improve this answer
2  
It also doesn't plug the stupid user hole if this is simply being applied to the computer of someone who is otherwise clueless. They'll still click to see if they won $1 bazillion dollars or to get rid of the viruses that the random website mysteriously detected on their system. But yes, even an educated user can still be compromised even with no-script on, though it is a lot harder. –  AJ Henderson Jan 17 '13 at 14:32
    
+1 for that. So it is possible to get infected with a malware in a web browser only through an image? Have you a link to some source informations or news about this fact? –  Jan Koester Jan 17 '13 at 15:07
1  

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.