3

We all know that attacks on web browsers are entirely possible. This includes attacks such as drive-by downloads, MITB (man-in-the-browser) attacks and keylogger browser plugins/extensions.

However, although we know how these attacks are carried out, the question here is how do these browser attacks succeed in being carried out? Is it due to ignorant browser users? Unverified extensions? etc.

3

While there are still Drive-by-Downloads attacks which exploit vulnerabilities in the browser itself most of the web-based attacks today are different. This is because Drive-by-Downloads got harder since the major insecure technologies (ActiveX, Java, Flash) got mostly banned and the browsers themselves got more robust against attacks too.

The major attacks today are probably done by tricking the user, i.e. phishing. There is for example credential phishing done (usually linked from mails or other messages) with look-alike sites or sites which promise import information after login. There are sites for (usually illegal) streaming or download of videos which claim to require some plugin or software update in order to access the content. And there are sites which create windows or popups which look like system error messages in order to trick users into downloading some fake antivirus or call some fake Microsoft hotline or similar.

There are also seemingly innocent browser plugins or extensions which later change the behavior into malicious ones, either because this was intended from start or because the ownership of the extension was transferred to some shady party. Since extensions are usually updated automatically this attack is based on using the initial trust a user had in the extension for silently adding malicious behavior.

Is it due to ignorant browser users?

While it would be simple to just blame the users for their ignorance it would not be fair. One cannot expect the average user to have lots of experience with detecting attacks. Most users are unable to properly cope with all the different web sites with different user interfaces and different behavior, sporadic error messages from web sites and from the operating system. They are used to get nagged by the various software they have to install updates before they can continue. All they want is to get things done. And in most cases they can do this by ignoring error messages or choosing the recommended option in a dialog they don't really understand. The attackers can therefore rightly expect that enough users will do almost anything just to continue, especially if this involves just to click some button or to quickly install some software - since this is what they are trained to do anyway.

Educating users and keeping them alert can only go so far. While this might shift their behavior to be more suspicious this also results in being more suspicious to perfectly benign login prompts, dialogs or update requests, since it is often impossible for the average user (and sometimes for experts too) to properly distinguish good from bad. This therefore usually leads to accept even unexpected behavior in order to proceed since in most cases it is actually innocent.

| improve this answer | |
  • I agree, the point raised was to not blame browser users for being dumb, but rather for ignorance itself. The news has talked about maintaining best security practices whilst communicating and browsing, yet they seem to revel in the fact that "it doesn't matter much, as no one wants to attack me" – rshah Oct 25 '19 at 20:34
  • 1
    @rshah: I've removed the 'dumb' since it does not anything useful to 'ignorance'. Still, the users have to deal with complex systems and inconsistent (which means in their eyes unexplainable) behavior of web sites and applications. They get overwhelmed with dialogs they don't understand and with regular messages nagging for an update of the software. If they would follow all the advice to be careful they would also find innocent stuff suspicious. This can actually be regularly seen at this site where users come to ask about unexplainable (but normal) behavior since the assume malware. – Steffen Ullrich Oct 25 '19 at 20:59
  • One common issue is that, unlike Google which does Google Account login under google.com only (not google.co.uk f.ex.), official websites don't have always one well known domain for all authentication requests. So the user was sometimes trained to provide his ID on multiple domains by the legitimate websites! – curiousguy Oct 26 '19 at 2:25
2

Without going into the details, I want to say: do not underestimate the ongoing risk from unpatched (and sometimes unknown, that is, true 0-days) vulnerabilities in browsers. Browsers are exceptionally complicated pieces of software, and face the pressures of continuously increasing their speed, adding support for new features of HTTP/HTML/CSS/JS, maintaining compatibility with legacy sites, and providing user-facing features. All together, this is a daunting set of requirements against which security must compete. Although browser security has gotten much better in recent years - itself a major undertaking, considering not only the complexity of the software but the fact that most browsers support multiple operating systems with different security features - critical new browser vulnerabilities are still discovered (and patched) every year. The long-called-for declines of Java and Flash on the web have closed some of the most historically common exploit vectors, but browser's JIT-compilers for JS and their complex, performance-optimized sandboxes still present considerable attack surface.

There are some things that can be done to mitigate these threats. Look up which browser withstand attacks the best (Chrome has withstood the last few Pwn2Own challenges, for example, though vulns in it have still been found and patched). Use extensions like "NoScript" to block unnecessary or unexpected scripts from running. Use ad blocking to prevent one of the most common vectors for distributing malicious scripts. Don't turn off security features of browsers, or run them with more privileges than are needed. Avoid sketchy or malicious-seeming sites (for example, just clicking on a link in a phishing email exposes your browser to a malicious site, even if you never enter any credentials). Don't install extensions (and definitely don't install plugins) that either aren't from trusted sources or that you don't need; even if they aren't inherently malicious they may introduce new vulnerabilities. Most vitally, keep both your browser and your OS up to date, by installing updates promptly and restarting the browser and/or OS when needed.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.