3

In enterprise environments, I have found great benefit to use binary white-listing, web security gateway and end-point AV to help protect the end-user/system. Unfortunately, I still see the browsers being compromised. That being said, with this layered approach, the typical use of a dropper is prevented from secondary execution by the binary white-listing. The anti-virus is typically able to pick up the dropper a few days later (once a signature is available) lying dormant on disc. This works fairly well, but the browser is still being exploited. In my experience, relying on patches, AV signatures, IP reputation, domain reputation and HIPS have left me still vulnerable. Both invincea (www.invincea.com) and blade defender (www.blade-defender.org) show promise, but what else is there?

With that in mind, how can one prevent that initial code execution?

Improve this question
2
  • 2
    Throw your machine out of the window, then set it on fire? That's pretty much the only way to be sure. You're always going to have holes - good security is about reducing the risks to an acceptable level, and having an action plan for when something is compromised.
    – Polynomial
    Jan 1, 2013 at 16:55
  • Centralize your infrastructure if you can afford it and apply strong machine policy to limit human interaction with i/o
    – happy
    Jan 1, 2013 at 19:05

3 Answers 3

Reset to default
4

Code execution? You say it like it's a bad thing :)

The fundamental problem with information security is that we've built Turing complete, computationally universal systems that can have any state and then we realize that some states aren't desirable and we can't control the system to not go into those states.

The best you can do is be security minded and layer multiple security controls starting from the hardware to the browser. But remember that there is a tradeoff between security and usability.

Qubes is an open source operating system designed to provide strong security for desktop computing. It is based on a secure bare-metal hypervisor (Xen) and you can use it to segregate your trust zones. Code execution in one environment would be isolated and be deleted when the environment reverts to the safe state.

Improve this answer
1

An awful, inefficient and distasteful, but nevertheless effective way to keep your browser uncompromised is to run it on a very little used architecture. Most exploits out there are for x86 processors, and for ARM (for the current crop of smartphones and tablets). Buy a PowerPC-based system off eBay (some of the latest ppc Mac still have some non-negligible muscle), install a not-too-common OS on it (i.e. not MacOS X; use Linux, NetBSD...), and there you go: a Web-able machine which no attacker will bother to write exploits for. It is not even security by obscurity, it is one step below: security by attacker's laziness. And yet it works !

Of course, this will not help you against your arch-enemy who is after you, specifically, and knows the ins and outs of your computer architecture better than you (by definition). But it will keep the rate of casual compromise very low.

(Caution: browsing the Web with such an architecture can be frustrating at times. No PowerPC browser currently has a Javascript JIT compiler, so everything which is heavy on Javascript will be slow. There will be no Flash. Videos with decent resolution may also prove too much for old CPU.)

Apart from such drastic measures (which are not entirely a joke: I do that at home), there is no miracle. Web browsers are human endeavours, they are no more bug-free than any other software. Use the classical mitigation measures:

  • Keep the browser up-to-date (the automatic update features of Chrome and Firefox are good for that).
  • Keep out of the less reputable parts of the Web.
  • Use your brain: the fingers click, but the mind should be in charge.
  • Sandboxing the browser within a virtual machine can help as damage containment.

Ultimately, Web browsers have morphed into full-fledged operating systems running code which comes from the outside (Javascript code, mostly), so it seems that Web browser security is an inherently doomed project. But we can try...

Improve this answer
1

Microsoft EMET has been shown to prevent some categories of exploits. The software we use has and will have security bugs. There is nothing practical that we can do to prevent that. What we can do is prevent exploited software from infecting the rest of the system. Containment. This can be done with sandboxing software like Invincea that you linked or Sandboxie (more popular). Also, Google Chrome has a built in sandbox and has been proven to be relatively secure.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .