0

The question surmises it all. If my firefox browser puts something like "..Gecko/xxyy Firefox/nn.mm.." in the USER_AGENT attribute, then from security point-of-view, isn't it an open invitation to the webserver: come and exploit all vulnerabilities in my xx.yy version ?

Many online users are know not to upgrade their browsers for a long time (especially those using stable distributions like debian or centos). Here, they are openly exposed to any known vulnerability being exploited in their outdated browsers.

Some years back, you could have argued that the web-server might output a compatible content based on the browser type (IE/Firefox/Safari/etc..), but with the standardization of HTML,CSS,etc. I don't thing this argument holds now in 2013. If anything, this adds one more hole in a plethora of complexities that already need to be dealt with in network security. Don't you think so?

Improve this question
4
  • 3
    Those stable distributions usually back-port security fixes. And an insecure browser is insecure, no matter if it attempts to hide its version number.
    – CodesInChaos
    Aug 10, 2013 at 23:12
  • "an insecure browser is insecure, no matter if it attempts to hide its version number" - Agreed, but it still makes it so easy. For instance, just by looking at the server-logs, you can say - 'Aha, this IP seems to be having browser x.y vulnerability, so let me exploit it'. Hiding version info would prevent this from happenning.
    – Prahlad Yeri
    Aug 10, 2013 at 23:19
  • 4
    Or you could just send all exploits anyway and see which one triggers.
    – Lucas Kauffman
    Aug 10, 2013 at 23:24
  • @LucasKauffman - Which is what most current infection servers do anyway. Bright idea security by obscurity question which is trumped by reality.
    – Fiasco Labs
    Aug 10, 2013 at 23:56

2 Answers 2

Reset to default
2

It also is an open invitation to use the appropriate version of scripts that are supported by the browser. Unfortunately, to have a usable web, the server needs to know what kind of browser it is dealing with and make adjustments based on this information. Yes, it does make it easier to target an attack, but someone could also just put a bunch of attacks on the page and hope one of them works. It's a fairly limited risk with a whole lot of benefit. The most paranoid browsers disable or fake it, but it comes at a cost of reduced functionality on sites that are visited.

Improve this answer
1

What's the attack model of the server. If you're doing a javascript or active X based exploit on the browser then analyzing the User agent string might narrow it down a bit, assuming that the browser in question is telling the truth. But given how quickly it could execute code I'd imagine it would be just as easy for the malware author to target the platform where their payload will work and fire off the exploit indiscriminately. If you were saving ip addresses for later reconnaissance then I think that the user agent string might be a useful tool in picking which targets to scan first.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.