Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The question surmises it all. If my firefox browser puts something like "..Gecko/xxyy Firefox/nn.mm.." in the USER_AGENT attribute, then from security point-of-view, isn't it an open invitation to the webserver: come and exploit all vulnerabilities in my xx.yy version ?

Many online users are know not to upgrade their browsers for a long time (especially those using stable distributions like debian or centos). Here, they are openly exposed to any known vulnerability being exploited in their outdated browsers.

Some years back, you could have argued that the web-server might output a compatible content based on the browser type (IE/Firefox/Safari/etc..), but with the standardization of HTML,CSS,etc. I don't thing this argument holds now in 2013. If anything, this adds one more hole in a plethora of complexities that already need to be dealt with in network security. Don't you think so?

share|improve this question
3  
Those stable distributions usually back-port security fixes. And an insecure browser is insecure, no matter if it attempts to hide its version number. –  CodesInChaos Aug 10 '13 at 23:12
    
"an insecure browser is insecure, no matter if it attempts to hide its version number" - Agreed, but it still makes it so easy. For instance, just by looking at the server-logs, you can say - 'Aha, this IP seems to be having browser x.y vulnerability, so let me exploit it'. Hiding version info would prevent this from happenning. –  Prahlad Yeri Aug 10 '13 at 23:19
4  
Or you could just send all exploits anyway and see which one triggers. –  Lucas Kauffman Aug 10 '13 at 23:24
    
@LucasKauffman - Which is what most current infection servers do anyway. Bright idea security by obscurity question which is trumped by reality. –  Fiasco Labs Aug 10 '13 at 23:56
add comment

2 Answers

It also is an open invitation to use the appropriate version of scripts that are supported by the browser. Unfortunately, to have a usable web, the server needs to know what kind of browser it is dealing with and make adjustments based on this information. Yes, it does make it easier to target an attack, but someone could also just put a bunch of attacks on the page and hope one of them works. It's a fairly limited risk with a whole lot of benefit. The most paranoid browsers disable or fake it, but it comes at a cost of reduced functionality on sites that are visited.

share|improve this answer
add comment

What's the attack model of the server. If you're doing a javascript or active X based exploit on the browser then analyzing the User agent string might narrow it down a bit, assuming that the browser in question is telling the truth. But given how quickly it could execute code I'd imagine it would be just as easy for the malware author to target the platform where their payload will work and fire off the exploit indiscriminately. If you were saving ip addresses for later reconnaissance then I think that the user agent string might be a useful tool in picking which targets to scan first.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.