Can JavaScript be used to install malware?

Question

Looking at the Pwn2Own contest got me thinking:

http://arstechnica.com/security/2013/03/pwn2own-carnage-continues-as-exploits-take-down-adobe-reader-flash/?comments=1

If you have all plugins turned off on a browser, and all you have is HTML, CSS, and JavaScript running in the browser, can you still become infected with malware? I suppose I never gave it much thought, but just how is it that these viruses can "install themselves"? If you uninstall these plugins and have your browser prompt you for all downloads, you should be "safe" right?

Answer 1

Even with just Html,CSS, and javascript an attacker or malicious site could still attempt to exploit bugs in the browser that would allow them to exploit a machine. Or create dialogs and attempt to trick a user into allowing permission to install malware. This was one example I found by googling javascript and malware install. If anything plugins create a wider attack surface, but without them that doesn't eliminate the attack surface relative to the browser that you use. For example if there is a browser vulnerability that allows remote code execution a malicious website could potentially use javascript to exploit the vulnerability. Hope that helps some.

Answer 2

Essentially all BROWSER vulnerabilities (ie. not vulns. in plugins like java or flash) involve and rely on JavaScript (JS) running. This is because JS is incredibly powerful. When visiting a web page with JS you're running someone's program in your computer. It is your browser that interprets JS and decides what to do. Since it's such a large, powerful, and complex language, it leaves a lot of room for bugs in the implementation which potentially turn into vulnerabilities.

http://web.nvd.nist.gov/view/vuln/search-results?query=javascript&search_type=all&cves=on

Answer 3

An answer has been accepted here, however I don't think the answers provided address the question very well.

Classically the asset targeted by malware was the same machine where the malware is eployed - but in a networked world, that's just not the case any more. If javascript or even just html in some cases is loaded and processed by a browser it can have undesirable effects without having to be installed or even stored on the victim's machine - it may be targeting a service on a different machine, e.g.

• a DDOS targetting an HTTP server
• a CSRF, perhaps exploiting 'remember me' functionality to create fraudulent transactons
• running a host/port scan inside a protected network (yes, this can be done quite easily with javascript and without the use of websockets)

Note that first and second don't even require javascript.

If the browser (or plugin) processing the potential malware does have security vulnerabilities, then malware can exploit these to damage the client system and or deploy itself/further malware directly on the clients long term storage.

Answer 4

Firstly, a malicious website can fill up your hard disk using localStorage (see FillDisk, be sure to click the "stop this madness" button before leaving the site. Or don't click that link and just see the explanation here). I don't think there have been any cases of malware being saved on a computer via localStorage, since the data is stuffed into a small database.

Besides this, on Chromium/Firefox, a website can make you download and install an extension/userscript. You are asked for confirmation first, but once the extension is installed, it potentially has access to all your data on all sites (including passwords).

On Chrome, it is harder to force you to install an extension since you can only install via the Chrome Web Store, though someone may be able to bypass this via clever clickjacking.

Another thing JS can do is launch an application (like iTunes or Ubuntu Software Center) via a custom URL scheme, and if you have a downloader application (or something that can be used as one), this may be exploitable. This asks for confirmation though.

Aside from that, JS can't get EXEs/etc onto you computer.