0

Currently in the news is yet another hack, this time from NSO and it is reported that an attack vector is via a web link. This is far from unique, as we have got used to advice to not click on "dodgy" links. From this we can derive that web browsers allow remote code access to many if not all functions of the device.

For me, browsers have one job, to process code from the internet and appropriately display the result in the browser window. To perform this function it does not need access to any other data on the device. While I have never done any browser development, it seems to me it would be easier to build software that gives remote access to nothing outside of the page that is being displayed, than to give remote code access to everything, and then try and lock it down.

Why are web browsers built so these attacks are possible?

3
  • 4
    The fact that the attack vector is a malicious link does not necessarily imply that a web browser vulnerability is being exploited. For example, if someone emails me a link to a PDF file, and I click on the link, my system opens the PDF document using my PDF reader, not my web browser. So, it may be that a vulnerability in some other program (linked to a certain type of file) is being exploited. The articles that you reference (as well as others) seem to point to vulnerabilities in WhatsApp.
    – mti2935
    Commented Jul 20, 2021 at 14:49
  • all major browsers have a "sandbox" which does separate local/remote. Though there are always bugs. Avoid extensions/plugins/addons... turn off Web Assembly... don't open/execute files downloaded from untrusted sources. (Though lately the attack vector is to infect the code of trusted sources...) That'll help make your browser more secure. Commented Jul 20, 2021 at 17:26
  • 1
    "browsers have one job, to process code" - and that's why they have vulnerabilities ...
    – schroeder
    Commented Jul 20, 2021 at 18:51

2 Answers 2

2

I think there are two fundamental misunderstandings here (or perhaps two statements of the same misunderstanding):

From this we can derive that web browsers allow remote code access to many if not all functions of the device.

Remote code execution doesn't imply that the application has allowed access, only that it has failed to prevent it in some way. Consider a burglar breaking into your house: you didn't allow them access, but they found a way to gain that access, against your wishes; maybe they spotted a window that was slightly loose in its frame, or a catch that could be reached from the letterbox.

it seems to me it would be easier to build software that gives remote access to nothing outside of the page that is being displayed, than to give remote code access to everything, and then try and lock it down

At the most fundamental level, all code running on a piece of hardware has access to that hardware; the only reason we can talk about "granting access" at all is that there are many layers of abstraction "locking down" that access. Taking the burglar example again, if your house is just a line on the ground, anybody can walk in; it is only by building walls that you can even hope to keep them out.

There is a grain of truth in what you say, though: if you provide a very small set of possible operations, the scope for evading the intended security is much smaller. If you have a house with only one door and no windows, you only need to defend that door against burglars - it might not be a very pleasant house to live in though. Similarly, you could build something resembling a web browser which was the only thing running on the computer (no OS, no other applications), and displayed only plain text (no styling, no interactivity) - good luck marketing that one.

The reality is that modern browsers are extremely complex pieces of software, running on top of and alongside other complex pieces of software (operating system components, applications for handling downloaded files, etc). Even though every piece is intended to restrict access in many ways, there are lots of places that attackers can probe. They are less like windowless bunkers with only one entrance, and more like grand palaces with hundreds of doors, windows, roofs, and chimneys, and the occasional loose brick that you can pry out if you spot the cracked cement.

0

In the distant Internet past, Browsers were indeed very insecure. The original Microsoft Browser ran Active-X by default, which essentially allowed anyone to run their code on your machine automatically. It was very powerful and very convenient, just not necessarily for you.

Current generation Browsers are quite secure and rapidly respond to exploits discovered. In most cases, attacks attributed to Browsers are not actually Browser exploits. Common attacks miss-attributed to browsers often run along these lines:

  • Run this code (OK clicked by user)

    Often this is a request to install a special driver

  • Download and run this file

    Usually a file that contains executable code that runs outside of the browser. An obvious one is a zip or similar. A less obvious code execution container would be a MS Word or Excel file. Adobe PDF's were notorious for carrying malicious executables.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .