Using Lynx on potentially malicious websites

Question

After needing to refresh how to unpack an android ramdisk, the site I remember having good information comes up with something similar to this:

Being cautious, but still wanting to get what was on the page, I turned to lynx.

Finding that lynx -dump http://website.com > /where/i/want/it would get what I need, I am wondering: Am I still open to some sort of attack?

On this Mozilla page it seems pages like this are geared more towards tricking someone into clicking something then downloading malware.

Would I be safe from other common attack methods as well? Since I am just pulling off text, I am assuming lynx doesn't run many of the scripts necessary to start rogue downloads etc.. But I don't know a whole lot about these things =)

Answer 1

You are greatly reducing your surface of attack by using lynx or similar, for example they don't run Javascript nor try to decode and display images so any vulnerabilities in these components don't affect it.

But in theory, you are still vulnerable. Even in Lynx there are still components that parse HTML, interact with the network, keep track of cookies, etc (tip: use curl or wget to just download the page without even parsing it to be even more careful). That is still quite a big attack surface, though I would consider it safe enough at this point. Maybe not safe enough against a targeted attack from a powerful attacker, but definitely safe enough for random Android websites.

Note that while the site itself didn't compromise you, any tools you would download and execute from there could be malicious, including the Android ROM or whatever you wanted to download - I suggest you carefully check out why was the site blocked and make your own assumptions about whether it's safe (I would say it's not safe unless it comes from the phone's manufacturer, Google or a known open-source project and I can verify the file is authentic by checking hashes published over HTTPS or a GPG signature).

Answer 2

As the warning message you got, the website you visited is likely to perform a drive-by download attack that does not require necessarily the user's interaction with the webpage.

But using lynx command will NOT lead you to be a victim of such attacks because all types of drive-by download attacks succeed only by either exploiting, via malicious crafted JavaScript code with which lynx has no business, the vulnerabilities that your website may have or the ones that the browser extensions you installed may suffer from.

However, lynx may be vulnerable to other vulnerabilities just as similar command lines:

• wget 1.15 (leaks memory of earlier connections and own state)
• curl 7.36.0 (https, FTP/IMAP/POP3/SMTP with --ftp-ssl)

Note that prior lynx versions to 2.8.5dev9 did not check at all for certificate validity (not supporting SSL) and depending on the version you are running, it may be prone to errors that an attacker may be could exploit.

In addition to this, lynx command is known to be vulnerable to other types of attacks. For instance, versions 2.8.4rel.1, 2.8.5dev.8, 2.8.3rel.1 and 2.8.2rel.1 are vulnerable to CRLF injection allowing an attacker to add other HTTP headers when the victim views a webpage using this command.

You also need to check if your lynx version is not vulnerable to know attacks:

1. CVE-2008-4690: arbitrary code execution
2. CVE-2006-7234: arbitrary code execution
3. CVE-2010-2810: arbitrary code execution, DoS and Heap-based buffer overflow
4. CVE-2012-5821: man-in the middle attack to spoof SSL serers

Answer 3

While no software is 100% safe too use chances are high that using something like lynx, curl or wget does not lead to an infection because these tools are not able to deal with Javascript, Flash, Java etc at all and thus the typical attack vectors will not work. But it might also be that you don't see with these tools the same information you get when visiting with a normal browser, because lots of sites actually depend on working Javascript inside the browser.