3

I wondered how a virus infects our computer just by visiting a website, without user's assistance at all. I know that a malicious website can exploit some browsers' vulnerable features, such as JavaScript, Flash, HTML5, etc., and cause some error like buffer overflow and be able to deliver a virus into our machine.

But in the condition that we disable all of those vulnerable features, allow only bare HTML to be rendered without any additional features at all, Is the malicious website still able to deliver a virus into our machine? If yes, can you explain the mechanism how it is still able to do this?

4

It is not possible to achieve the condition of disabling all vulnerable features.

Features that may be disabled through a browser's user interface do not comprise anywhere near the complete set of potential vulnerabilities.

Consider text handling. There is no switch to disable processing of multi-byte unicode characters, yet improper handling of these has been the vector for a number of client-side attacks involving delivery and execution of exploit payloads. The underlying problem of parsing streams of bits and turning them into data structures is not securely solved.

There is also what sounds like an assumption in the question that somewhere in a piece of software there is a secure base or core, that functionality accretes, that vulnerabilities exist only in new functionality, that what we have to do to improve security is disable only the new functionality.

This assumption is faulty. Functionality accretes, and with accretion comes complexity and with complexity comes new bugs, but it is not the case that older simpler functionality represents some sort of security ideal.

Newer code is very often written with greater discipline and maturity and awareness of risk, and is often in an absolute sense more secure.

Older functionality may have been secure for the time in which it was authored, but would not survive for a moment against attackers of today. Older code is often of far worse quality than newer code, surviving with known bugs and vulnerabilities only because replacing it is too daunting or complex to realistically contemplate. Security issues may be carefully hidden under layers of intended protections, but they are still present, awaiting a clever enough attacker to find a vector through which to exploit them.

In short, there is no non-vulnerable software. Of course people speak in black and white terms and refer to some features as secure and others as insecure, but it is more accurate to remember in discussions about security the old joke of running faster than the other guy when being chased by a bear.

Chromebooks will be "secure" as long as they're less popular and not Windows. Were Chromebooks the dominant platform in the ecosystem, the rate of discovery of vulnerabilities would dramatically increase. The vulnerabilities would be different in character than ones found on other platforms and so given the current state of knowledge are harder to find than those on other platforms, but they are still there.

This trajectory isn't just true for software, it may be observed in any realm of human functional endeavor. There are incentives to tear down old buildings in Tokyo, even sacred ones, because they represent a danger in the context of making the city more resilient against earthquakes. Cars that are more than 5-7 years old are relatively speaking manifestly unsafe in accidents compared to newer counterparts.

In the end, it isn't vulnerabilities that matter, but safety. It doesn't matter if at a particular point in time a given attacker can't find a weakness in a particular place in a specific piece of software. Attacks are conducted with goals in mind, often economic, and the landscape is rich enough that if one approach fails there are dozens of others that can be profitably tried.

The most common attack that people fall victim to is phishing, which may but doesn't have to exploit any particular piece of technology, beyond using it to engage the victim.

So a browser may not have an extent or discovered vulnerabilities but from a user's perspective that does not make it safe. Simplicity and reduction of functionality can reduce the attack surface and increase the cost of targeting a particular user, but there is no magic combination of settings a user can tweak to enable them to forget about safety.

I hope that was the actual question being asked.

  • It seems that any software besides web-browser that take an input from the user would be susceptible to be exploited. Say, a music player program would be exploited by the malicious .mp3 file that is played by the program, right? – armamoyl Aug 11 '16 at 1:35
  • Thank you for accepting my answer. Yes, exactly. The act of interpreting data in a file in accordance with a complex format exposes the system to the work of a malicious actor who found weaknesses in that particular implementation. A recent example impacting popular software ImageMagick: arstechnica.com/security/2016/05/… – Jonah Benton Aug 11 '16 at 2:40
3

Even if you disable all plugins or ActiveX like Flash and also disable JavaScript the browser and OS together are still a complex beast and the attack surface does not get zero. With all these reduced features you could for example still do attacks by using bugs in image and video decoders. And there could also be bugs in the featureful and thus complex HTML rendering engine. Or the mime type of a served content could be associated with an external program like Acrobat Reader or an Office application and run an exploit by downloading the content and starting the vulnerable application.

BTW, if you take a look at the latest patches from Microsoft you will find fixes for handling of graphics, PDF, office documents etc. Many of these bugs allowed remote code execution, i.e. infection of the client.

Apart from that - how realistic is it in today's world to run the browser with JavaScript disabled on all sites? Many sites would simply stop working.

1

There have been bugs in the html parsing code of popular browsers (e.g. this one). Running a vulnerable version of IE would mean you just need to browse a prepared site and your browser would execute malware that is placed on the site (even if video etc. is disabled). You wouldn't notice much (maybe that the page you're visiting isn't rendered properly). So you do not necessarily need bugs in image or video renderers or flash to get remote code execution. Noone knows how many exploits like these are available for recent browsers in the dark net. Every now and then bug fixes are published which are said to fix "severe problems which could lead to remote code execution" without ever any details being published to the public. This means that most probably such bugs exist. Question is whether someone finds a way to leverage them for code execution. But given the amount of energy and resources cyber criminals have been investing in the past into building complex exploits I wouldn't feel too safe....

0

I'd say that the merely HTML page fetching involves browser execution through memory and therefore cache. The sole process of opening a browser requires storage of cookies, cookies means files and files open the possibility of a virus. Now you say that you have disabled (what it seems to be) all possible holes from which a virus can infect the computer, however (and this is theoretical), the HTML site itself could send malicious code to a cookie which in turn can load an auto execution routine and begin the infection process; now I'm no HTML expert, but I wouldn't discard that the HTML's site code could perform this action solely by displaying the website. Consider the possibility of a very well engineered HTML Injection attack.

Take a look here:

https://deadliestwebattacks.com/html-injection-quick-reference/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.