Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I use a portable web browser on a USB device like Google Chrome Portable how hard it would be to get infected by a malware/virus in the system to which the USB device is connected?

Google Chrome brings the flash player with the browser and java can be disabled in the settings of the chrome browser. Also there is the sandbox of the chrome browser, so the virus first must break out of that sandbox.

If I get on a website with malware is it possible that the virus can leave the USB device and setup in the system to which the USB device is connected?

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

It doesn't matter where your run your browser from. You can run it off of your USB drive or off a network share, it still goes into system memory. Malware that would exploit that browser would have the privileges of the user that ran the browser.

Use Chrome or any other browser to browse to file:///C:/ or about:memory. The browser like any other process, has access to all of your computer, provided the user has access there.

If malware breaks through the browser sandboxes and executes code then the malware takes control of the browser and can do whatever it wishes.

This is a Chrome exploit in action https://www.youtube.com/watch?v=c8cQ0yU89sk (allegedly)

share|improve this answer
    
o.k that makes sense. So it would a better solution to run the browser as a user who has minimized access to the system (e.g only his home folder if this is possible) so a malware will then also have only access to the home folder and can't access any other place in the system because the user who execute the browser can't access the places too? –  Jan Koester Jan 20 '13 at 19:12
    
for example, I create the user "ForBrowsing" on my Linux Machine and this user has only access to his home folder. I will put the portable chrome browser in the home folder and start the browser as "ForBrowsing" user. Will a malware only get access to the homefolder or is it possible to reach other places in the system? –  Jan Koester Jan 20 '13 at 19:14
    
Using a restricted user for browsing is always a good idea. Restricting that user more to certain folders is also good. Some people even use a virtual machine with an OS and browser completely separated from the main machine. There are even OSes based on this kind of separation where there are trust zones. Qubes is one qubes-os.org/trac/wiki –  Cristian Dobre Jan 20 '13 at 19:19
    
I will have a look at qubes this seems to be great. I have one last question, drink a cup of tee and will accept your answer :-) So if a (drive-by)-malware got the privileges of the user who started the browser, how is it even possible for them to setup deep in the system under a windows (With activated UAC) machine? Is it because flash or java runs with admin rights in the system (If an attack is introduced through a java or flash leak in this example)? –  Jan Koester Jan 20 '13 at 19:28
1  
Just like the malware escaped the sandbox of the browser, it has to escape from the "sandbox" the OS is creating for the user. That means bypassing security controls or exploiting other components that have elevated privileges. It is called en.wikipedia.org/wiki/Privilege_escalation Just the other week there was a local privilege escalation for nVidia drivers. seclists.org/fulldisclosure/2012/Dec/261 nVidia patched it in a week or so. theregister.co.uk/2013/01/08/nvidia_security_update –  Cristian Dobre Jan 20 '13 at 19:37
add comment

This would all depend on the privileges that the browser (portable or not) had whilst it was running.

The Google Chrome Sandbox is pretty secure, but there are ways that Malware can infect a system.

I think that this article will be of use.

http://www.theregister.co.uk/2011/05/09/google_chrome_pwned/

share|improve this answer
1  
Oups, sorry, I didn't see you adding the same video. For the record, you were first. –  Cristian Dobre Jan 20 '13 at 18:29
    
@MichaelJamesSwan Hey and welcome to stack exchange! Thanks for your useful answer - I have upvoted you. As a friendly heads-up, you do not need to add a signature or sign off when answering. This is usually discouraged on SE sites - see the FAQ. Cheers and happy answering! :) –  culix Jan 21 '13 at 6:22
add comment

Not 100% sure if you are wishing to securely use a USB/portable browser or are trying to prevent your users from doing so... But many companies will disable USB ports/flash drives for sensitive departments for this among other reasons.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.