Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This is a follow-up to the following question: Can a website determine what OS or web browser a visitor is using if the useragent is blanked/changed?

If I have understood the answers correctly, a website can't determine what OS the user is using if he's running NoScript, so that no Java applets or Javascripts gets executed. The user can still get infected if the exploit-kit is blind-exploiting exploits for several OSs. My follow-up question is the following:

Can you spoof the navigator.oscpu "variable", so that even if the user is having javascript enabled (with or without NoScript), the site gets the wrong information on what OS the user is running? Check this site about the navigator.oscpu: http://www.quirksmode.org/js/detect.html . Assume that the user haven't got Java installed, only javascript enabled.

If the variable is spoofable, would this be enough to escape from most vulnerability-attacks? What other methods can a website use to determine what OS a user is using, except Java applets, javascript and user-agent?

Thanks in advance!

share|improve this question

2 Answers 2

Since you're talking about navigator.oscpu, I assume that you're talking about Firefox, because it's the only browser that supports this property.

You can easily spoof the value of navigator.oscpu via the general.oscpu.override preference:

  1. Visit about:config.
  2. Create a new string called general.oscpu.override
  3. Set whatever value you want.

This is not the only way to detect that you're running on Firefox on Windows. There are several Mozilla-specific CSS media queries that can be used to detect whether you're running on Windows, including but not limited to -moz-os-version (Firefox 25+) and -moz-window-theme (Firefox 4+).

Browser plug-ins (such as Flash) can also be used to identify your OS. Either directly (by embedding the plugin) or indirectly, by looping through the navigator.plugins collection, while reading the file names of the plug-ins. To identify Windows, for example, just check whether any of the strings end with .dll. Here's an example that prints the list of filenames: http://jsfiddle.net/A8srr/show.
Note that this issue is going to be resolved in Firefox 28 by making navigator.plugins non-enumerable, see https://bugzilla.mozilla.org/show_bug.cgi?id=757726.

Although you can try to manually fix all properties of navigator (see my recent example for example on spoofing a property of navigator in a user script), do not rely on it for "protecting" your system.

If you want to guard your system against attacks from the web platform, use a virtual machine for browsing the internet (if you're on Windows, you can also try to use Sandboxie, because it integrates better than a separate VM).

share|improve this answer

Making your browser appear like a different browser to intentionally mislead automatic browser detection is definitely possible. Opera used to have such a feature for years (it got removed when "this website only works with browser X" messages went out of fashion).

But it is unlikely to be a practical protection against web-based exploits, because many infected websites don't care about what browser the user is using and just bombard it with a wide range of exploits for all kinds of browsers without checking which even have a chance to work.

share|improve this answer
    
Thanks for this answer! But my primary question was about spoofing OS, not browser. For example changing the navigator.oscpu variable. Can that be done, and how? –  The Phone Jan 1 at 10:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.