Update: for commenter Rob, the presentation that sparked this post centred on a demonstration of beef.

At work the other day an ex-employee who specialises in security gave us a presentation which could be summarised thus: if you want a safe, normal web-browsing experience, you are doomed. Your browser will be compromised, your secret details stolen, and your PC turned into a zombie. This is not merely possible, but likely, and ultimately inevitable.

The slightly longer summary could be turned into bullet points like this:

• Traditionally, security focussed on protecting servers, and assumed that clients were not desirable targets.
• This isn’t true. Your PC is a desirable target:
  • You use your PC to do things of interest (like online banking)
  • Your PC can be used to attack other PCs.
• Your browser runs code (JavaScript) from untrusted sources.
• Browsers carefully run this code in a “sandbox”, with no access to your computer’s disk or to memory outside the browser, in the belief that this will protect your PC from malicious code. This won’t work:
  • First, your browser can do interesting things like make naughty requests to hack into other PCs.
  • Second, there are plenty of things that you do care about in your brower’s memory (like your online banking session) which are totally accessible from within the sandbox  can be taken advantage of.
• Many sites (wrongly) allow users to inject Javascript into pages other people can see. That Javascript can seize control of your browser when you visit such a site. (This is called “cross-site scripting”).
• It is no use expecting sites you visit to protect you. Even when the owners are told about cross-site scripting problems, they often can’t be bothered fixing them. Among them are plenty of high-profile sites which you might well visit.
• That injected Javascript can:
  • “phone home” to a master server;
  • upload any data accessible from within the sandbox;
  • make naughty requests of other computers;
  • download further instructions from the master.
• There are already automated tools out there to do all this.
• Conclusion: any time you run a browser with Javascript on, and you visit a site with injected Javascript, your browser is no longer under your control. It will cough up details of any existing secure sessions and make requests elsewhere on behalf of its new controller. YOU ARE PWNED.

This is… disappointing. Much of the fun and even some of the utility of the modern web relies on the execution of Javascript. Is there any alternative to turning off Javascript?

There are some.

1. Use Firefox with the NoScript extension. This is probably ok for people who have the time and skill to evaluate scripts and decide for themselves whether they are safe to run.

2. Whenever you use a site to do secret stuff, close all browser sessions first. Then open a fresh one. As soon as you have finished what you are doing, close your browser again. This is a painful, error-prone practise to keep up; a stop-gap measure.

3. Use Prism, and only Prism, to run things that you care about. Prism is a standalone browser based on Firefox but with no menus, no location bar, and no tool bar. When you launch a Prism-hosted application, it will run in its own browser process, unconnected to any other browser sessions. So you install Prism and configure a launcher for your online banking, a launcher for your webmail, a launcher for your sharebroker, and so on. Your session can’t be hijacked unless an attacker has compromised the actual server hosting your application.

Tags: security