Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

While browsing the web, many websites executes scripts (mainly javascript) that are executed without the user noticing. How big is the risk, to get Malware unnoticed while surfing with scripting enabled? To elaborate on the how much: is scripting in browser more problematic than other contents like CSS or images? What are these problems?

share|improve this question

4 Answers 4

Man-in-the-browser is the number one risk. I would say that enabling more efficient malware delivery is secondary.

Things like the Browser Exploitation Framework (BeEF) -- http://www.bindshell.net/tools/beef/ -- should provide a better explanation through its implementations.

share|improve this answer

There is definitely a risk - scripting essentially allows execution of code on the browser. The vulnerabilities range from reading your browser's history to installing malware to phishing your bank credentials - each of which can potentially cause you "harm" in some way.

However, given that most of today's web sites rely on scripting, there's a huge loss in turning scripting off, up to and including the site no longer showing up in your browser. Turning off scripting also won't protect against other ways for bad things to happen to your computer, so the return for the inconvenience isn't incredibly high.

Probably the most common use of scripting is analytics, which allows the webmaster for that site to gain information about who is accessing which pages, thus potentially improving the flow of the site and the information presented. However, the flip side of analytics is targeted advertising, which allows advertisers to follow users across multiple sites.

The majority of scripts on websites are "mostly" harmless, just like the majority of software that's available is "mostly" harmless. Security folks focus on the malicious side of things, and continually re-learn that there's a trade-off between usability and security.

What I personally do is use Firefox with the add-ons NoScript and Ghostery. Between those two - NoScript especially - the chance of having scripts injected into the page I'm viewing is greatly reduced. I still expect to get pwned at some point, but the tools I have will do a reasonable job of keeping me aware of what's happening as long as I continue to pay attention.

share|improve this answer

Today a lot of sites requires scripting enabled, otherwise user might experience problems with usability and overall site functionality. Sure, you can disable JavaScript, for example, but even that does not fully prevents from been exploited. Also you would need to disable Java, Flash, what else there comes as plugins and additional functionality. But that would make browser quite useless today. In recent times in modern browsers there comes built-in solutions that should increase security - like IE's, Chrome's anti-XSS. For Firefox there is well-known extension "NoScript" that allows to manage list of sites that allows JavaScript/Flash/Java. But even these preventive measures are not enough - they have been bypassed and who knows when next time again. In these days you should watch out. To my mind, best solution is to surf internet from Linux box inside virtual machine. But that comes in cost of comfortability.

share|improve this answer
    
+1: comprehensive answer and I second linux+VM for browsing (especially for ie) –  rox0r Dec 20 '10 at 16:14

If the usability goes to zero, people will find a way around your anti-scripting lock down. As mentioned before, NoScript is a really nice plug-in for allowing certain sites to run scripts.

Drive-by downloads are probably a much larger risk for unsophisticated users. You don't need any scripting to show the user a fake flash media player that says "upgrade required" and when the user clicks the fake "play button," it downloads malware that they install. Game over.

And flash has had a number of buffer overflows and vulnerabilities.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.