0

If someone buys a brand new PC with NO antivirus program, and:-

  1. Never opens ANY emails/attachments

  2. Never visits shady/malicious websites

  3. Never downloads anything,

  4. Never connects an infected removable drive to the PC.

  5. Never clicks any advertisement

...but just browses YouTube, Wikipedia, and some other educational and trustable sites, how can a hacker put malware on their PC? Is there any way they can do that?

Not going to buy a new PC, but just trying to understand how hackers put malware on PC.

5
  • 5
    This is a bit like asking "If I buy a car and never go above the limit, nor through a red light, and always maintain it, how can I have an accident". The short answer is: once you connect your PC to the internet, anything is possible. Although a site is itself trustworthy, if they display external content (e.g. ads), it's exploitable. Is it probable? I wouldn't worry about it, but it's a nonzero possibility. It's theoretically possible – just as having a car accident; yet we still drive
    – user218666
    Commented Dec 15, 2020 at 11:47
  • @DigitalDracula I like the analogy, but I also mentioned that "no ads were clicked". That means no ads were clicked even from trustworthy sites. So never went to an "external content". Can you elaborate how merely connecting to the internet leaves someone vulnerable? Commented Dec 15, 2020 at 11:49
  • 1
    There are more ways than just those for a computer to get malware on it. Also critical: keep your computer up to date! Commented Dec 15, 2020 at 12:32
  • 1
    The only way to really be sure you won't get a virus is to not connect to the internet, not connect ANY devices or install any software. And even then some bad actor could still do it when you weren't paying attention ...
    – aslum
    Commented Dec 15, 2020 at 15:52
  • The computer (or device) doesn't even need to be connected to be compromised... Hardware backdoor exists. (Not to mention, many of them are rootkits) If I would ref. 1 if the sources of this I would say; the Snowden Leaks. (I mean, really - the device I suppose can get compromised without it being turned on, or even before one have "got" it from the online-store - quite hard to detect if we talk adv. Threat actors but, wanted to add this point Commented Mar 18, 2021 at 19:54

2 Answers 2

5

A website does not need to be malicious. But the implementation of the website, the web server that hosts it, the OS that it runs on or the database may have vulnerabilities. Such a vulnerability may be exploited (by XSS, SQL injection, directory traversal etc.) and suddenly turns the trustworthy website into a malicious website without you (or anyone else) noticing it.

3
  • 1
    Just because a website is compromised doesn't mean your computer itself is compromised. Besides being extremely annoying and asking for escalated permissions, a website can't do anything unless you give it those escalated permissions, like the permission to install browser extensions. The web is sandboxed Commented Dec 15, 2020 at 13:16
  • @CarsonGraham: it seemed to me that OP was quite clear that it is possible to break out of the sandbox Commented Dec 15, 2020 at 13:22
  • @CarsonGraham - it should be sandboxed, but that is not 100% true...
    – Rory Alsop
    Commented Dec 15, 2020 at 15:19
5

This question is difficult to answer since there can be numerous ways for your PC to get infected once it is connected to the internet.

One way you can end up with malware is (as @DigitalDracula pointed out) through untrusted content served through a trusted website. This usually in the form of ads. Even if you do not click on an ad, the untrusted content is still rendered in your web browser (assuming you do not use an adblocker), which means that a specially crafted ad by a malicious entity could exploit a vulnerability in your browser to execute code and install malware. The vulnerability exploited could be a zero day (a vulnerability the vendor is not yet aware of) but that is relatively unlikely. It would more likely be a known vulnerability which has been patched but is still exploitable on your system because you have not updated your browser.

Another way you could get infected is through a remote code execution vulnerability in your operating system. In this case, you could potentially get infected by simply connecting to a network which also has infected devices connected. Again, this vulnerability could be zero day (less likely) or a known vulnerability because your OS is not up to date. The (in)famous WannaCry worm exploited exactly this type of vulnerability to spread.

This is by no means an exhaustive list and there are other methods as well. The takeaway is that you should keep your system up to date to minimize the risk of infection. However, no computer connected to the internet is completely immune to attack.

7
  • 1
    In short: keep your software updated Commented Dec 15, 2020 at 13:17
  • @ConorMancone does more up to date also mean more secure? I doubt that no update ever introduces a new vulnerability.
    – Haukinger
    Commented Dec 15, 2020 at 18:04
  • 1
    @Haukinger Ofcourse updates do introduce new vulnerabilities sometimes. Occasionally they even introduce backdoors. But updates include patches for any new publicly known vulnerabilities, which are the ones which are most commonly exploited (since they can be exploited by pretty much anyone), and therefore present the greatest risk to normal users
    – nobody
    Commented Dec 15, 2020 at 18:17
  • @nobody Indeed. Commented Dec 15, 2020 at 19:13
  • @Haukinger that's not the first time I've had that "gotcha" thrown at me, but just consider this: do you think you would be more secure by refusing all upgrades? :) Commented Dec 15, 2020 at 19:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .