Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I which forms can visiting certain sites compromise one's system security, taking into account that browsers keep a sandbox for each opened page?

Nowadays, can a malicious -or attacked- site really, for instance, steal all stored passwords from a client or infect him with a virus?

share|improve this question
add comment

closed as not a real question by Jeff Ferland, Iszi, Ninefingers, Chris Andrè Dale, Rory Alsop Dec 14 '11 at 18:10

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

Your initial assumption may be misguided in terms of security. A properly implemented sandbox should make you safe, however because people like a full featured Internet experience, there is rarely a properly implemented sandbox. Instead, you have flash, plugins, javascript etc.

So the simple answer is that yes, a malicious site can take complete control over your computer and look at, modify or destroy anything on your computer!

share|improve this answer
    
Precisely the reason why I use NoScript and DropMyRights. –  Amazed Dec 7 '11 at 18:18
add comment

Yes, a website can exploit holes in a browser and place a shell on the computer giving it total access to passwords, installing root kits, etc.

Don't take our word for it. Test it: http://www.offensive-security.com/metasploit-unleashed/Browser_Autopwn

But, I think you may have left out some assumptions from your question.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.