Tag Info

Hot answers tagged

15

It is very dangerous. You are correct in pointing out that the browser decides whether or not the connection is secure (HTTPS). The browser not only initiates the connection, it also chooses the symmetric key that will be used for the secure connection (assymetric keys are only used to set up the connection). Hypothetically, a browser could use a ...


7

Yes: CSS can contain malware, though in my experience, its usually been tied to a vulnerability, e.g. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3971 As far as it containing JavaScript, that's certainly a vector, though successful exploitation should generally be limited by vulnerabilities within the Browser, the OS and the JavaScript engine. ...


5

CSS rules can actually contain JS code (supported by at least some browsers), so from that perspective CSS can be "as bad as" JS. This SO answer might be helpful if you want more detail. http://stackoverflow.com/a/482088


5

In addition to the existing answers, I'd like to add: it provides an attack vector. Host flagrantly malicious content at www.evilstuff.com Add to my domain records the IP addresses for: cnn.com IP addresses microsoft.com IP addresses stackexchange.com IP addresses Wait for Google to detect said content on my server and decide to blacklist the domain ...


4

It isn't good to install any untrusted software, but the browser is obviously the holiest of holys. And I've seen quite a few applications begin to implement 'native' by using WebKit and local WebSockets. That itself isn't too terrible, yes technically the application could be used to open Facebook as well because it is using WebKit, but as long as it ...


4

Are you sure it's your ISP? Could it be a malicious program running on your system? You can try to get a Linux LiveCD somewhere, boot into it, and see if the code injection is still there. If you see the injected code, it's almost surely your ISP doing this. You could look at the contract you signed, and if you don't see anything related to code injection ...


3

Possibly because once the malware site is booted off its ISP or hosting company, the IP gets recycled to some other perfectly legitimate organisation. The domain name was clearly controlled by the malware owners, whilst the IP is owned by the ISP.


3

Firefox browser provides the easiest way to do such testing via the advanced settings in about:config where security.tls.version can be of the following values 0 - SSLv3 (set max and min value to this) 1 - TLSv1.0 2 - TLSv1.1 3 - TLSv1.2 What you will see when the website does not support SSLv3 is this: Please remember to set it back to max 3 and ...


3

It doesn't necessarily matter what your server uses by default - most servers and clients are configured to negotiate the highest protocol available. A major aspect of the POODLE attack is that an attacker can cause connection failures in a higher (non-vulnerable) protocol, and downgrade the victim to SSL3. Then they can exploit the vulnerability in SSL 3. ...


3

Normally you are forced to use a corporate proxy. This is necessary for the company to protect against the internet. But a side effect is, that the internet usage of every proxy user can be monitored by the company. This is something nobody wants. Technical details aside: what you are trying to do is to actively circumvent security systems which are ...


2

You are refering to proxy chaining, and it is not supported by any major browser that I know off. You can use some sofware like SocksCap or Proxifier to intercep Firefox network calls, and divert them to your corporate proxy, and configure Firefox to access the network through the second proxy.


2

as the website service panopticlick puts it "How unique and trackable is your browser?" there are many things that especially via scripting can be found out about your machine. This uniqueness estimation can include browser type browser version geometrics (screen size) average cpu usage / calculation power via script trial fonts (are a especially neat way ...


2

If you access a https:// page and the code is still there, then it's a local malware injecting code or a configured proxy. Your ISP can't inject it's own html-code into a https:// connection (unless for some very odd reason they act as a http-proxy of which you accepted the ssl certificate).


2

That's really interesting. I'd never seen this used by ISPs before. You sure any device connected to your LAN isn't compromised with malware? If it really is your ISP I would read over your TOS (Terms Of Service) like @Eric G recommended. If you're legally allowed to prevent it then: Method 1: Use proxy like @Eric G recommend. If your using port 80 and ...


2

Many times (smaller) websites are run on shared servers which uses the same IP address but distinguish by path/URI instead - also, IP addresses change, it's not hard to re-direct what IP address a particular domain name points to, it's just a DNS update away.


2

There is no reason that this should not work as long as third party cookies are enabled in your browser. HTML form POSTs can be used, or in the case that the forms are a multi-stage process then this will be more useful to run as XHR requests as your attacking page can then control the requests and issue them in turn - just as your are doing. Make sure ...


1

There's actually a simple solution to this: build an application that takes a single command line parameter (the URL) and launches the browser directly with that URL after a confirmation box is shown. Set this application as the default browser. When the system sees a ShellExecute or CreateProcess with a http:// URI as the target, it passes off execution to ...


1

Another solution is to build or modify a existing browser, to not allow any type of external URL typing. You could even have it to use a screen keyboard or such to prevent malicious programs from using SendKeys(); and you could have scrambling screen keyboard and much other security features, And user confirmation if the browser is called externally with a ...


1

It can't hurt. ABP (and similar software) blocks known ad providers and patterns that look like ad providers. If one of them gets popped and starts serving up malware, ABP will save you. If the site you're on is the compromised one, ABP can't help (unless the compromise is to point at a compromised ad network that's already blocked... seems complicated). ...


1

If they are injecting scripts into every page, this would indicate that they may be tracking you, may be doing ads, etc. They are executing their code and since it loads dynamically they may change what they are doing and when at any time. On the blocking part, you would need to check with your ISP terms of service and possibly government regulations in ...


1

There are number of different ways that this can be accomplished. IP Addresses Typically, most host machines stay within a family of IP addresses. These addresses are assigned to your ISP, who in turn, assigns you an IP address when you purchase a subscription. If you login to your account from a different block of IP addresses, then they may know you ...


1

Contrary to some answers here, I'd say it could be extremely dangerous. If you're a target, I'd love to sit in your browser and watch you as you reveal your accounts, passwords, thoughts etc. It's almost as good as taking over your computer, because 90% of your communications with external world would probably go through your browser(s). It's even easier to ...


1

The more I read about TLS, the more I get convinced that the browser is the weakest link in the chain. I don't think so, because I think the user itself is the weakest link: The user can often be convinced to follow insecure links, even if the browser explicitly warns against it. The user can be convinced to install any other software, like dubious ...


1

I'll have a shot at addressing this one. Is this acceptable, first of everything, from a security standard (i.e. accepting an unsigned software)? Accepting unsigned software that is trusted for some other reason in itself isn't an issue. Accepting ActiveX isn't considered acceptable at all. I'd suggest running the browser that uses ActiveX within its own ...


1

There are two different types of issues with untrusted data: It can contain malicious code to be executed directly (malware) It can be crafted in such a way that it will cause your legitimate applications to behave erratically (exploit) and perform something bad (payload) JavaScript really is in the first category. When browser or PDF writer vendors (or ...


1

Chrome and Firefox seem to no longer support UTF-7 in any format. The HTML5 specification says: User agents must support the encodings defined in the WHATWG Encoding standard. User agents should not support other encodings. User agents must not support the CESU-8, UTF-7, BOCU-1 and SCSU encodings. [CESU8] [UTF7] [BOCU1] [SCSU] Support for ...


1

Yes it would increase security, as (malicious) cross-domain information leaks aren't possible between browser instances. You can also minimise the use of plug-ins and add-ons in high security browser environments, as they expose additional attackable surface. Another way to mitigate the risk of malicious code running in your browser are ad blockers and ...


1

Let's get into the details of what a guest session is on Ubuntu. You've asked 'is it more secure for the system to use a guest session rather a normal account?', and the answer is yes, but only slightly. Guest sessions use a tmpfs instead of a home, so data does not get written to disk but stays in RAM. This means a prolongated session with important ...



Only top voted, non community-wiki answers of a minimum length are eligible