4

I found some website blacklisted on Google. I mean when you try to visit them, you get something like shown on this picture:

Reported Attack Page! This web page has been reported as an attack page and has been blocked based on your security preferences.

After a small search, I found that some of them have a malicious JavaScript file on few of their URLs.

My question: could a malicious JavaScript file (pointed on a URL www.example.com/pictures/malicious.js) harm the browser/computer in any way? I mean, could it be executed by the browser? Are there known attacks of this type?

Improve this question

2 Answers 2

Reset to default
7

In order to do any damage to your computer or data stored on it, the page would have to either exploit a security vulnerability in software on your computer or prompt you with an additional confirmation dialogue.

The warning may be due to the page exploiting a security vulnerability for which there is not yet a patch available, so the warning should be taken seriously. Unless it is very important for you to see the page, you should avoid it.

Continuing to the actual page without first installing all security updates (and restarting the browser), is practically asking to be infected.

It may be that the same warning is used for pages that are not attacking your computer directly, but rather attacking your data on other sites where you may currently be logged in. This would usually mean exploiting XSS or XSRF vulnerabilities in that other site.

Improve this answer
4
  • 4
    When I really want to see a page reported as malicious, I usually start a throw-away virtual machine, create a snapshot, use it to load the website and reset to the snapshot afterwards.
    – Philipp
    Jul 29, 2014 at 14:15
  • 1
    @Philipp That's a good precaution to take. But it does not mean it is safe to access the page with outdated software. It will be safe if you in addition to the described steps also ensure that both host and guest OS are fully updated. In theory malware could first exploit a vulnerability in the browser and next a vulnerability in the virtualization software to get control over the host.
    – kasperd
    Jul 29, 2014 at 15:37
  • 4
    I think in the case of @Philipp's comment, it'd be an acceptable risk since, however possible, the likelihood of that occurring is extremely low.
    – esqew
    Jul 29, 2014 at 16:44
  • @Philipp, I wouldn't even access the page from another computer. It might exploit a vulnerability in the browser, and then send you an email with a terrible attachment that will send you and your computer into the dark ages.
    – Paul Draper
    Jul 30, 2014 at 2:56
15

Yes there are known attacks of this type. The site you are trying to visit is one. That's why your browser is telling you not to visit the page.

Javascript files included on pages are always executed by the browser. That's what Javascript does. Whether or not it has the necessary privileges to do something malicious is where the battle is at. It is unlikely that your browser is going to allow it to do something it shouldn't be able to without your permission. The real problem is that it could prompt you for something and lie about what it is prompting you for tricking you into granting it permission to do something harmful to your system. Tricking you into downloading/running some piece of local software is the most likely attack vector, but there are certainly others.

If your question is "is this message baloney" or "should I take this message seriously", the answer is plainly the latter. Yes of course there are known attacks of this type, that's why it's warning you that something is the site code looks like one!

Improve this answer
3
  • 2
    What is stopping and attacker to create attack page that looks like the attack page warning which upon clicking 'Get me out of here!' infects your machine?
    – jnovacho
    Jul 29, 2014 at 13:33
  • "Javascript files included on pages are always executed by the browser", unless you use script-denying extensions such as NoScript. Note however that even without JS, a page can instruct you to run the file it provides you through a link or a redirect <meta>.
    – ElementW
    Jul 29, 2014 at 14:06
  • 1
    @jnovacho Most browser generated warnings include some indication in an out-of-page region of the browser chrome that the message is from the browser. Turning the address bar red for example, or having a tooltip that extends outside the page canvas. Be especially careful of "top bar" warnings asking you to download plugins etc. There are lots of social engineering exploits that rely on making these look like your browser is prompting you when in actuality its just a carefully styled page. The same goes for popups---that's why most browsers no longer allow no-toolbar popups.
    – Caleb
    Jul 29, 2014 at 14:18

You must log in to answer this question.