Why are web browsers insecure?

Question

Currently in the news is yet another hack, this time from NSO and it is reported that an attack vector is via a web link. This is far from unique, as we have got used to advice to not click on "dodgy" links. From this we can derive that web browsers allow remote code access to many if not all functions of the device.

For me, browsers have one job, to process code from the internet and appropriately display the result in the browser window. To perform this function it does not need access to any other data on the device. While I have never done any browser development, it seems to me it would be easier to build software that gives remote access to nothing outside of the page that is being displayed, than to give remote code access to everything, and then try and lock it down.

Why are web browsers built so these attacks are possible?

Answer 1

I think there are two fundamental misunderstandings here (or perhaps two statements of the same misunderstanding):

From this we can derive that web browsers allow remote code access to many if not all functions of the device.

Remote code execution doesn't imply that the application has allowed access, only that it has failed to prevent it in some way. Consider a burglar breaking into your house: you didn't allow them access, but they found a way to gain that access, against your wishes; maybe they spotted a window that was slightly loose in its frame, or a catch that could be reached from the letterbox.

it seems to me it would be easier to build software that gives remote access to nothing outside of the page that is being displayed, than to give remote code access to everything, and then try and lock it down

At the most fundamental level, all code running on a piece of hardware has access to that hardware; the only reason we can talk about "granting access" at all is that there are many layers of abstraction "locking down" that access. Taking the burglar example again, if your house is just a line on the ground, anybody can walk in; it is only by building walls that you can even hope to keep them out.

There is a grain of truth in what you say, though: if you provide a very small set of possible operations, the scope for evading the intended security is much smaller. If you have a house with only one door and no windows, you only need to defend that door against burglars - it might not be a very pleasant house to live in though. Similarly, you could build something resembling a web browser which was the only thing running on the computer (no OS, no other applications), and displayed only plain text (no styling, no interactivity) - good luck marketing that one.

The reality is that modern browsers are extremely complex pieces of software, running on top of and alongside other complex pieces of software (operating system components, applications for handling downloaded files, etc). Even though every piece is intended to restrict access in many ways, there are lots of places that attackers can probe. They are less like windowless bunkers with only one entrance, and more like grand palaces with hundreds of doors, windows, roofs, and chimneys, and the occasional loose brick that you can pry out if you spot the cracked cement.

Answer 2

In the distant Internet past, Browsers were indeed very insecure. The original Microsoft Browser ran Active-X by default, which essentially allowed anyone to run their code on your machine automatically. It was very powerful and very convenient, just not necessarily for you.

Current generation Browsers are quite secure and rapidly respond to exploits discovered. In most cases, attacks attributed to Browsers are not actually Browser exploits. Common attacks miss-attributed to browsers often run along these lines:

• Run this code (OK clicked by user)

  Often this is a request to install a special driver

• Download and run this file

  Usually a file that contains executable code that runs outside of the browser. An obvious one is a zip or similar. A less obvious code execution container would be a MS Word or Excel file. Adobe PDF's were notorious for carrying malicious executables.