Unpatched software poses no risk by themselves. They're only problematic when someone exploits it.

How could malware get into my system if I do have unpatched software in general and I'm connected to an infected network,

but none of my ports are open except for that very one HTTP port which I use to browse the internet using a secure up-to-date fully-patched drive-by-download-immune text-only browser?

I don't do self-injury by downloading anything. The only one thing I download is if there is a patch for my browser and I would verify the file's checksum multiple times before running it. The checksum is itself obtained via HTTPS/TLS from multiple trustable sources.

Assuming the text-only browser I use is has no security vulnerabilities, how could malware enter my system?

  • Why do you have unpatched software you're not using? Or, if you are using it, how can you be sure someone can't exploit those unpatched vulnerabilities, e.g. by emailing you a Word file? And what about the patches that fix actual operational flaws instead of vulnerabilities? – Bob Brown Dec 20 '14 at 15:19
  • @BobBrown, I don't do downloading. The Word file in the email wouldn't even get into my system. I'm using the unpatched software. They are working fine and edge-case operational flaws wouldn't affect my system's security. You could for example use Notepad++ version 10 just fine even if the latest version is version 20. There are exploitable vulnerabilities with the software but hackers cannot exploit them if they do not have access into the system (none of my ports are opened as mentioned). – Pacerier Dec 20 '14 at 18:13

By closing unnecessary ports you just decreased your attack surface, which is a good practice.

But by running a modern operating system and web browser, you still have a relatively large (or should I say huge?) attack surface.

For example, a secure up-to-date fully-patched drive-by-download-immune browser may not protect you from:

  • Vulnerabilities in unpatched third-party browser plugins (Adobe Reader, Adobe Flash Player, Microsoft Silverlight, Apple QuickTime, etc., may or may not sandboxed by web browser)
  • Vulnerabilities in image parser (if implemented by operating system)
  • Vulnerabilities in SSL/TLS implementation (currently not protected by any browser sandbox)
  • Vulnerabilities in font parser (usp10.dll, win32k.sys, happened multiple times)
  • Vulnerabilities in DNS system service (or do you only use IP addresses?)
  • Vulnerabilities in network stack device drivers and any software that install hooks on the network stack (firewalls, content filters, tcpip.sys, etc.)
  • Vulnerabilities in graphic card device driver (can be exploited by WebGL)
  • Auto-update MITM vulnerabilities in unpatched software on your system (https://github.com/infobyte/evilgrade)
  • And many other stuff that could go wrong...

Web browsers does not live by itself, they are running on top of the operating system.

They are at most as secure as the operating system itself, and usually only as secure as the most buggy software on that operating system.


Your key assumption is impossible. A "drive-by-download-immune browser" capable of surfing the modern web does not exist. Even if no known public vulnerabilities exist for a certain browser, there is always the possibility of zero-days.

You don't download anything, but every time you visit a website with Javascript enabled, you are allowing arbitrary code execution on your machine and the only thing protecting you is your browser's sandbox. Refer to the previous point about zero-day vulnerabilities.

Sure, you can have a very secure system by turning everything else off and surfing the web with a text-only browser but that is a highly unusable system.

  • A secure text-and-image-only browser does not do Javascript. How could a text-and-image-only browser be vulnerable to drive-by-downloads? – Pacerier Dec 20 '14 at 15:11
  • Windows metafile exploit, maybe? (Yes, that's patched every place there's a place, but what about the next one?) – Bob Brown Dec 20 '14 at 15:17
  • 1
    @Pacerier: Like anything else can be vulnerable - a buffer overflow could cause arbitrary code to be executed on your system by the attacker if the HTML or image parsing code in the browser contains a flas. This is what drive by download means - it doesn't have to be an actual file that is downloaded either by you or automatically. – SilverlightFox Dec 20 '14 at 19:21
  • @Pacerier: *flaw – SilverlightFox Dec 20 '14 at 20:13
  • @SilverlightFox, Yes, but how buggy would my secure text-only browser be? Buffer overflows are dangerous, but most programs don't have them (e.g. over 90% of Java apps are unoverflowable). – Pacerier Dec 21 '14 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.