13

I've heard that websites that download malicious data onto the user's computer without their consent do exist, but is this possible on an iMac as well as Windows and other operating systems? How about iPhones?

Basically, can websites download content onto your Apple device without your consent? I've heard that Apple devices are much more secure than Windows and Android and that they aren't as widely targeted.

  • 27
    How do you define download? – CodesInChaos May 29 '17 at 11:08
  • 1
    If you use chrome, yes as it exposes a filesystem api for writing. This is how mega.nz downloads work. But these files are only temporary. – Kaspars May 29 '17 at 13:51
  • 1
    Yes it can; otherwise it would not be possible to display any webpage. Just keep software you use updated, and use Time-Machine every day (or however you value your data), I doubt you are so important that every hacker wants you pwned. – Kyslik May 29 '17 at 15:33
  • @CodesInChaos: Usually, the definition is "server=up, client=down". Might be difficult with P2P protocol, but the web (HTTP) is pretty unambiguous. Basically, the problem questioned here is that the webpage which is requested(downloaded) comes bundled with more content, and that said content escapes from the browser environment. – MSalters May 29 '17 at 15:41
  • 4
    @MSalters The direction part is clear. But do you count downloads into a cache (temporary internet files & co) as downloads? – CodesInChaos May 29 '17 at 15:50
7

The OS part is mostly irrelevant here. A web page is built from:

  • a general part containing text and global structure: the HTML file itself
  • various auxiliary files: presentation (css), images or other media files, and scripts

The browser by itself downloads the main HTML page and all its declared components and then executes the scripts. Things can become rather complex at this moment, because the scripts can do many things:

  • change (partially) the browser configuration
  • download other files or components
  • make the browser point to another page

Normally, the browser cannot by itself execute something directly at the OS level, but everything is kept at the browser level in a kind of sandbox.

Additionally, some particular content are not directly executed by the browser but require a plugin. Flash video or games are typical of that

Thus there are different kinds of threats:

  • a vulnerability in the browser that allows direct execution of code - it can be mitigated by keeping the browser and the OS updated with all security patches
  • a vulnerability in a plugin. Flash plugins often have a poor reputation, but there are many plugins around
  • an apparently harmless user action that will actually execute a malware or create a security breach by installing a vulnerable plugin. That is generally the simplest and most efficient way:
    • click here to install that hyper cool background on your computer
    • you current video player will not be able to support the special effects of this movie. You should update it from here
    • you can get [choose your favorite feature here] from here

You are just right in one part. Apple OS is less used than Windows on desktops/laptops or Android on smartphones, and Apple developer environments are much more expensive than Windows or Android development kits (you can get the latter for free). That is a reason why you can find more malware targeted at Windows desktops/laptops than at Apple, Linux, or BSD systems, because of the cost/gain ratio from the malware developer. But I would not bet a coin that Apple system is so robust that it contains no vulnerabilities. Because any addon can come with its own vulnerabilities and I do not think that any iOS app has been thoroughly reviewed on a security point of view before being added to the App Store.

As it is signed by its developer, an app should not carry a malicious payload, but it can simply contain a vulnerability that could later be exploited by a malicious site... Slightly more complex, but still possible.

  • 1
    As it is signed by its developer, an app should not carry a malicious payload well nothing should contain a malicious payload. – PyRulez May 29 '17 at 20:52
  • 4
    You should only trust an app as much as you trust the developer, and there are a lot of developers I've got no reason to trust. A signed app just means that nobody else tampered with the app, not that the developer (app) is trustworthy. – David May 29 '17 at 21:39
  • @David: a malicious payload can be discovered. I really do not think that a developper can be ready for the legal consequences of willingly putting a malicious payload in his app - but letting a vulnerability inside may be only eventual... – Serge Ballesta May 29 '17 at 22:54
  • Apps in the iOs app stores are supposed to be checked before release, while android ones were released at once if they complied to google play's guidelines. Dont know how much different things are now since supposedly play store reviews the apps before release but it used to be much more dangerous to use uknown apps in androids than in ios due to this. – Leon May 30 '17 at 8:09
  • @SergeBallesta An organization with something to loose (Apple, Google, Microsoft, etc...) is not going to knowingly put out a malicious app, but I would be concerned about all those games or screensavers or one-off utility apps from authors with just a couple apps to their name. Those people have little to lose, or their developer account might be a total fabrication. This is why it's really important to check app permissions. – David May 30 '17 at 17:56
8

In certain cases, yes it can, what it is usually called is a "drive by download": JavaScript exploits, Java exploits (or even you approving the download), and other exploits can indeed infect your computer, if you believe a website is risky you can download the NoScript extension or disable active plugins like Java or JavaScript entirely.

But please know that attacks where a malicious website can download malware onto your computer without your input [downloading a file. approving a prompt, etc], are very rare and will require a zero day exploit which is very expensive. This is why you are often asked to keep your software up to date, because any exploit found in a certain version can only be fixed in a later version, it isn't going anywhere.

8

The point of @leethax is technically almost OK except the fact that they are not very rare at all

Such infections exploitations are driven by what is called Exploit Packs // Exploit Kits which are basically toolkits that help exploiting client side vulnerabilities (this goes from the browser to java passing by flash or whatever client side stuff)

Common exploit targets have been vulnerabilities in Adobe Reader, Java Runtime Environment and Adobe Flash Player.

Characteristics of Exploit Kits

A key characteristic of an exploit kit is the ease with which it can be used even by attackers who are not IT or security experts. The attacker doesn’t need to know how to create exploits to benefit from infecting systems. Further, an exploit pack typically provides a user-friendly web interface that helps the attacker track the infection campaign.

Some exploit kits offer capabilities for delivering payload that remotely controls the exploited system, allowing the attacker to create an Internet crimeware platform for further malicious activities.

You can check this, this and this for more information

  • 11
    This would be a great comment but it's not a self-contained answer because it addresses another answer rather than the question. – David Foerster May 29 '17 at 10:23
  • 8
    This answer claims that the exploits are not rare at all and then talks about the existence of exploit packs. Those two things are not really correlated, hence the statement (browser exploits are not rare at all) remains unfounded. – xDaizu May 29 '17 at 10:39
2

First, no website can download content onto any computer. From the website's perspective, the content is being uploaded to you, not downloaded. If a file is going from a website to you, then either you are downloading it or the website is uploading it.

Second, any website can get your computer to download arbitrary content. Your operating system is irrelevant, because it's necessary and desirable functionality. That's what a website is, basically. If I want to put an image on your computer, I just include it in the web page I'm serving to you, and your computer will download it so that it can display it. But there's no reason to worry about that. It's executing an arbitrary file that's a security risk, not just downloading it.

  • So can a website "upload" a virus, for example, onto my computer or mobile device without me knowing (as in, put it onto my computer like you would an app) and then have the virus infect my device? – George B May 29 '17 at 6:40
  • 3
    It can upload it to your computer, but it can't get your computer to execute it and thus deliver its payload unless it finds an unpatched vulnerability in your browser or operating system. – Mike Scott May 29 '17 at 6:47
  • 3
    @MikeScott I feel that this is technically true but misleading - the default case is that unpatched vulnerabilities exist, so instead "it usually can't unless it happens that there's a vulnerability" it should be phrased as "it usually can if it tries hard enough, unless it happens that there are no vulnerabilities" – Peteris May 29 '17 at 8:21
  • 1
    @George B In short, yes. Nothing is impossible in the real computer world. But of course, there are some requirements. I.e. vulnerable browser as Mike Scott mentioned. – Fis May 29 '17 at 10:37
  • @GeorgeB you should edit your question to make clear that this is your concern, because a malicious website could still put you in trouble even if it cannot remotely execute its payload. For instance, it could plant child pornography in your browser's cache, where it could later be found by a forensics investigator. – b0fh May 29 '17 at 12:25
0

Yes, if and only if there is an exploitable vulnerability in the browser or OS, which there frequently is. For example see https://www.cvedetails.com/vulnerability-list.php?vendor_id=49&product_id=2935&order=3, all the ones that say "execute arbitrary code".

  • 1
    @schroeder JailbreakMe was a good example of a vulnerability exploited on early iOS versions. – tangrs May 29 '17 at 16:36
0

I'll answer this question from a rather theoretical perspective.

"I've heard that websites that download malicious data onto the user's computer without their consent do exist, but is this possible on an iMac[...]?"

Yes. As others pointed out, this is independent of the operating system.

A web page contains or refers to — and thus causes the browser to load — data in various formats. As Serge described, the first thing loaded is plain HTML. It may have modern extensions like style sheets. The HTML may embed or refer to media of various kinds like images, sound files, videos, scripts or flash animations which may be downloaded and opened (i.e. decoded and then played or displayed) by the browser without any user interaction beyond opening the original page.

The problem is that in principle any decoder for a data format, including plain HTML, may have bugs which can be exploited. (1) This includes data which is normally totally "passive" like images (for an example with JPEG images see this Microsoft security bulletin from 2004). A trivial example from 20 years ago was a (formally correct) GIF file which expanded to a huge bitmap. An attempt to display it in a browser of viewer simply crashed the computer, which is a blunt denial of service attack. For an exploit the data presented on the page would be specially crafted to produce a misbehavior of the specific decoder which eventually allows the attacker to place executable code in the computer's memory which will then be executed. The original code can be small, say a jump to an operating system routine starting a shell.

The obvious mitigation strategy is to disable as many data formats as possible in the browser. No videos, no sound, no images, no scripting.


It may be worthwhile to repeat the mantra of the German blogger and security expert, Felix von Leitner. He is adamant that virus scanners only offer fake protection (he calls them snake oil). One reason is that they are never perfect and thus need a responsible user anyway. The second reason, relevant here, is that the virus scanner itself is a huge attack surface! Think about it. Modern scanners open and parse a dazzling plethora of file formats — the very process we have established as the main attack target. Felix lately linked to a project by Tavis Ormandy. He wrote a framework to load and run Windows DLLs under Linux. His motivation, as he writes in the README, was to fuzz test the MS security core engine:

MsMpEng is the Malware Protection service that is enabled by default on Windows 8, 8.1, 10, Windows Server 2016, and so on. Additionally, Microsoft Security Essentials, System Centre Endpoint Protection and various other Microsoft security products share the same core engine.

The core component of MsMpEng responsible for scanning and analysis is called mpengine. Mpengine is a vast and complex attack surface, comprising of handlers for dozens of esoteric archive formats, executable packers, full system emulators for various architectures and interpreters for various languages. All of this code is accessible to remote attackers.

The reason to mention this here is that even if your browser handles everything well, your anti virus program may, ironically, betray you, because it opens all files for you.


(1) leethax0r1337fawkes has a point though that known bugs of this kind are rare and get fixed asap, for obvious reasons.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.