Lets say,

  • My firewall is configured to block any incoming connections
  • My browser doesnt allow any traces and scripts
  • I have vpn on
  • My browser always asks before downloading files
  • My browser doesn't allow to download exe files

Is it possible to get hacked based on those settings?

A lot of people say is it possible, but how?


Is it possible to get hacked based on those settings?

There is no such thing as 100% security - security measures only help to reduce the risk but will not fully eliminate all risks.

While you've cared about some aspects of security you either did not care about others or did not find them worth to mention. There is for example the physical security, i.e. who might have physical access to your computer and will you be able to detect if somebody unauthorized got access and changed parts of the system. Note that just having a strong password is usually not enough against physical attacks: the attacker might boot with its own OS to make changes to your system from "outside", the attacker might install key loggers, ... And if you are a really valuable target then an attacker might break into your home or bribe or blackmail persons you trust to mount the attacks.

There are also several other aspects you did not discuss, i.e. is web browsing really the only thing you do or do you also read mail with a mail application, play games which have their own online connection, have software installed which will fetch its updates from the internet ... - all these are also possible attack vectors. For example it is not uncommon that software updates are not (properly) signed and not transferred securely, so a man-in-the-middle attack might maybe replace the software update with something malicious.

Speaking of man-in-the-middle attacks: There are lots of vulnerabilities in routers and some attacks against routers can be made from outside by using the browser as trampoline. In this case it does not matter if all connections from outside are blocked since these kind of connections origin from inside, i.e. from your browser. And, for many of these CSRF attacks no Javascript is needed, so switching this off might not be sufficient to defend against these attacks. And a common attack against routers results in reconfiguring the router to make man-in-the-middle attacks possible.

And finally lets have a look what you actually do with your browser. Even if script is off you will probably look at images and videos and also load fonts. While you are probably aware of images and videos you might not be aware that many sites load fonts from the internet to display the content. And, malicious fonts were in the past several times a successful attack vector. Similar image and video are actually complex file formats and display engine are commonly optimized to display the content fast and efficient and do commonly not to expect malformed content. Thus in the past it was possible to exploit systems also with prepared images.

As for the VPN: it protects only the path from your computer to the VPN endpoint. It does not protect the path from the VPN endpoint to whatever server you visit. Apart from that you really have to trust the VPN provider since he is able to modify all of your content, i.e. both what you send to some server and what the server sends to you. For example in the past there were malicious Tor exit nodes which added malware to downloads on the fly.

And, this is only a part of the possible attacks. Do not forget that there are also brute force attacks, in the literal interpretation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.