0

I asked a question before about how you can tell that a website is safe to visit (to prevent yourself from getting hacked) and I was told that it can not be done. A virus scan with virustotal will not be proof that a website is not malicious. It can tell you about threats but even if it says that a website is safe, it might not be. Is this correct?

Assuming that is correct, if someone visits a website that is trusted by millions or billions of users like Facebook, Twitter or YouTube, is it possible for the people running the website to hack into the computer of specific user secretly?

If it is possible then how do organisations like ISIS (enemy of USA) or foreign governments with bad relations to USA, make accounts on Twitter and YouTube?

Aren't they afraid of getting hacked? What precautions do they take?

4
  • 1
    You can serve different pages to different users based on their user ID, so why wouldn't you be able to serve specific users malware? Organizations like ISIS can make accounts because the website operators do not remove them.
    – user
    Nov 19 '19 at 16:14
  • @user : My question was how do they know they won't get hacked? What precautions do they take? And Twitter has removed ISIS accounts. Nov 19 '19 at 16:19
  • ISIS is a very valuable target. How do they know that the US government won't force Twitter to install malware on their computers? Nov 19 '19 at 16:45
  • Or if you think USA is not a good example, then can a person or group whom the Chinese government doesn't like, use one of its social websites safely? Nov 19 '19 at 17:18
3

Your misunderstanding is here:

is it possible for the people running the website to hack into the computer of specific user secretly?

As a general rule of thumb, you can't just "hack" into a specific person's computer from a website. In fact, browsers are typically one of the more difficult channels through which to attack a user's computer. Doing so requires a zero-day vulnerability in the browser that the user is using. Such vulnerabilities do exist but are rare and quickly patched. Targeting someone in particular also means targeting their particular browser, and if they are using a browser without a known zero-day vulnerability then it is quite literally impossible.

This can be made slightly easier though if you find a zero-day in a common library or browser plugin. This was a common way of attacking browsers back in the days when Adobe Flash was more common, but like browsers themselves, this is becoming harder to do - Flash in particular is on its way out due to its long history of security vulnerabilities.

If the US government wanted to hack a particular person they have much better and more direct ways to doing it rather than convincing a third party (e.g. Youtube, Twitter) to do it on the government's behalf. Especially if the government wanted to keep it a secret. The best way to keep something a secret is by involving as few people as possible, so getting a third-party to do the work for you is usually a bad idea anyway. Finally though you have a coherent question at the end which is answerable:

What precautions do they take?

If you are worried about someone trying to hack you through your browser then you should take the same precautions that everyone is told to take: use a modern browser and keep it up-to-date. This simple protection will keep you safe against 99% of the threats out there, most likely including any government attempts to hack you through your browser.

7
  • 1)What do you mean hacking through a website is difficult? Aren't there javascripts which do just that? That is what no script is for. 2)The pegasus spyware could take over the iPhone when a person just visited the wrong link. 3) Isn't it true that you can take over a person's computer through mitm attacks? I have seen videos of it. If it is then the owner of a website should find it easier to hack into the computer of someone who is trusting them. Nov 19 '19 at 18:37
  • @Linux_user0987 Yes, hacking through a website is difficult. With the exception of a very rare zero-day vulnerability, there are is no javascript that can just do that. The pegasus spyware was probably using such a rare zero-day vulnerability, and I'm sure it has been patched and can no longer do that. A MitM attack is a very broad concept, but no, that can't just take over a person's computer. Nov 19 '19 at 18:49
  • @Linux_user0987 everyone knows that browsers are a attractive target, so browser vendors spends lots of resources on securing browsers, and patch cycle is rather frequent. As of this writing, Chrome 78.0.3904.108 is the latest Chrome release. It was released yesterday. The previous one? November 6. That's 12 days.
    – vidarlo
    Nov 19 '19 at 19:43
  • @ConorMancone : I don't think it's as difficult as you make it sound. I have pasted three links. Were all these zero day vulnerabilities? Anyway the total number of infected users is in thousands. google.com/amp/s/www.wired.com/2014/08/operation-torpedo/amp google.com/amp/s/mobile.reuters.com/article/amp/… google.com/amp/s/gizmodo.com/… Nov 19 '19 at 20:32
  • @Linux_user0987 thousands of infected users is nothing. Yes, such things happen, and yes such things are possible, but no, they are not easy to do, and it wouldn't be my primary concern if I was involved in illegal activity. Obviously you disagree though, which you're welcome to do. Nov 19 '19 at 20:47
1

1.) You can never be sure that a website is 100% safe. A recent scan from VirusTotal definitely helps but you can’t be sure.

2.) It is a pretty safe bet that a website with billions of visitors can be trusted to NOT try and exploit your browser. Having said that, I’ve been apart of IR’s that a popular website is compromised by attackers and temporarily used to exploit people. But it’s very very unlikely the website developers for big sites would intentionally do it.

3.) Anybody can make accounts on Twitter and YouTube.

7
  • I am not talking about the site themself. Why couldn't the US government secretly ask Twitter to not delete ISIS accounts and let them try and spy on them. If you think that is not possible in USA then what about a country like China? If the Chinese government is really interested in someone who uses Alibaba, could they not ask or force Alibaba to install malware on the person of interest? Nov 19 '19 at 16:38
  • The company could stop it. But, this has already happened in the USA with NSA and telecoms (spying). So it’s real. And yes, Chinese could do the same. Knowing how much the Chinese govt has over media and industries there, they could do the same.
    – pm1391
    Nov 19 '19 at 16:45
  • I am not sure if I understood your comment correctly but I think you are saying that the government could force a website to hack a target's computer. Then why does ISIS an enemy of USA try to use Twitter? How does it know USA government won't target them? Nov 19 '19 at 16:53
  • Yes they could. ISIS likely uses twitter to reach a large base of people. ISIS likely doesn’t use twitter for strategic operations. So they probably know, but don’t really care.
    – pm1391
    Nov 19 '19 at 16:59
  • By saying target them, I meant their computers. Do you think ISIS uses separate computers for accessing Twitter? Because if they get infected then other things on the computer would be exposed. And since ISIS needs to hide its operations, if there computers get hacked wouldn't they reveal the location? Nov 19 '19 at 17:05
0

You can never be completely assured that whatever website you're connecting to is not serving you something malicious. However, there are multiple reasons why installation of malware on a specific user's machine would be difficult.

Browser security

Typically speaking, whatever browser you use has its own security measures preventing the installation of malware. Code running in a properly working browser (theoretically) can do limited damage. (doubly so if you just do one thing on the browser, close it, and restart to do whatever you need to do next) If you're using an open source browser the likelihood of it being malicious is lower as you can just build from the source and everyone can see and audit the source if they so choose. If you're using a closed source browser, it's easier for a government to slip in malicious code by bribing the right people, but...

Publicity

In addition to having to sneak in an exploit into a browser, they would also have to sneak in malicious code for a server to serve up. What a normal person views clearly isn't malicious (if it were, someone would likely notice quite quickly as well), so they'd have to serve up something specifically malicious for the target, which leaves room for discovery if a glitch occurs. Furthermore, exploits aren't laser-guided munitions. Once they're found out (and browsers are amongst the most actively probed software for vulnerabilities given their wide use by the public), anyone can exploit them and they will need to be patched out to protect the normal, innocent civilian (at which point your target has access to the security patch). This will harm the browser's reputation, leading to decreased usage and presumably decreased revenue. (much more so if it is found out to be intentional)

Cost-benefit

That said, if you upset a nation-state (or any exceptionally well-funded) actor enough, they can get around all that. Browsers aren't completely secure and you can buy existing zero-day exploits to bypass security measures, but they're a scarce resource and don't come cheap. (and you might need multiple to exploit someone) Bribing organisations also comes with a hefty price tag. At some point even if you really don't like someone, any benefit you might get outweighs the cost.

Instead, they may consider things like... just looking at the video being posted and attempting to figure out where it's being filmed (which if you believe 4chan, they've done and got the Russians to bomb an ISIS training camp, probably with something like a man-week of effort) or subpoenaing the website for IP access logs in case they aren't going through a VPN and then trying to use an exploit on other out-of-date software. Might even come with a free digital fingerprint even if you are accessing the site in a secure manner. Why spend hundreds of thousands of dollars or more if you can get the desired result for pennies on the dollar?

They could also just operate non-surreptitiously and force you to install spyware yourself. Or make you identify yourself to use most services. (to my understanding, this is fairly common in South Korea)

Or they could just bypass all that, and bribe one of your likely poorly-paid flunkies to give them the info they need. Or just indiscriminately drone strike places they think you might be since their citizens don't care too much about that sort of thing.

So really, the best defence is to not upset such organizations too much.

-1

There is no need to hack a root (or an Administrator) account if you are that user! That said, anyone with that "privilege" can put anything in the server, no matter what his/hers "boss" advise or demands. If that "anything" will be (or is) found is not known. After all so many bugs are exposed everyday, both in closed and open source, which probably where not in the mind of their creators.

1
  • This answer does not make a lot of sense. I'm not sure that you understood the question.
    – schroeder
    Nov 19 '19 at 22:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.