Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Assuming I have a defenseless client computer running Windows 7 that will happily allow any javascript code it comes across on the internet, what's the worst damage that could be inflicted?
I'm unclear on javascript's "reach". Could it erase files on the hard disk? Could it change user access permissions? What horrible fate is NoScript saving me from on a daily basis?
The intended reach of Javascript is limited so it can not access the desktop nor any files in your computer. The security of your computer is limited to how up-to-date the browser is (patching etc), and the associated Plugins.
On the other side, "bad guys" try to find holes in technology and use that knowledge to gain access to something they otherwise wouldn't. When this happens, and the vendor is aware of it, a patch is released.
A few bad things Javascript can do:
Javascript alone might allow all the information of a poorly written website to be sent to a "bad guy". This is called XSS / CRSF.
It can also cause your logged in account to make changes to websites (editing financial data of a different unrelated site) without you knowing.
Finally in regards to your local computer, the exposure depends what add-ins are installed (Flash, etc). If the client has an old version of flash installed, then your whole PC can have malicious software installed on it, or have security dialogs altered to confuse even an educated/informed user.
As a client on a web-browser, javascript doesn't typically present a threat to your file system or changing permissions. There have been a few exceptions/vulnerabilities e.g., this issue in jscript or this one in firefox 3.5 jit compiler, but these vulnerabilities are generally patched in the web browser (and relatively rare for plain-old javascript, esp compared to other plugins like flash/java applets).
The bigger danger with malicious javascript is cross-site scripting (XSS ) or cross-site request forgery (CSRF ). On a poorly configured website where untrusted user-generated content can put javascript that's executed on other people's pages, the javascript can perform actions from the perspective of the other user.
The other answers are probably best, but consider the following as well:
As mentioned before, if a host is on a domain, any domain resources are that much easier to reach. A single compromised host is often times enough to allow bad guys the entry point they need for the network.
This one is a little different, but a compromised host could be used to store illegal files. Not necessarily ideal for the bad guy, but you then become liable for any files found on your drive (should you be investigated by law enforcement).
