Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Can a computer be infected when it accesses a malicious web page?

Why is not a web browser 100% safe? What web resources, such as Java Script, Flash or a HTTP connection, can infect a computer?

share|improve this question
    
It depends on which browser you are talking about.. –  Pacerier Apr 29 '12 at 0:27
add comment

3 Answers

up vote 9 down vote accepted

Yes you can. Usually a proper Anti-Virus program will intercept these attempts though. Of course, browsers don't have "built in" backdoors/vulnerabilities but they can exist nevertheless. When such a vulnerability is found by a hacker or other malicious user, that vulnerability can be exploited to infect the visitor of the web page.

If something could be made 100% safe, there wouldn't be any need of Anti-Virus programs at all. There's always some creative solution that can be found to infect people anyway and such an exploit can only be patched after it has been discovered.

It's like typing an entire book on your keyboard, without checking for typos. You will only discover your errors when you start reading/reviewing whatever you typed. Reading in this case, would be to just "use" the browser.

Most exploits are in 3rd party plugins (such as Flash, PDF reader plugins, media, etc.) so the browser maintainers don't have full control over what is run in their browser. It's like having a house built by 4 different contractors who don't know exactly what the others are working on or how they are doing it...

share|improve this answer
    
I love the implication that metaphor has; "code is written start to finish without being read through" :P –  RJFalconer Feb 12 '11 at 21:22
    
@RJFalconer It's true right ;)? At least, you won't find most of the bugs until you've executed it... –  BloodPhilia Feb 12 '11 at 21:23
    
I would like to know some old Firefox exploits and understand –  Squall Feb 13 '11 at 22:23
    
@Squall there are several exploits that were made public. Try googling for "exploit plugin add-on firefox" –  BloodPhilia Feb 15 '11 at 13:02
2  
I disagree. 99.99% of the time is the user downloading and executing some rubbish. And no, an antivirus cannot intercept unknown exploits. –  gd1 Jul 16 '11 at 21:36
add comment

Squall,

Software is intrinsically difficult to get right. For a glimpse at why, I recommend an article by Cem Kaner, an expert software tester. The article is called "The impossibility of complete testing." Also read his article on "Software Negligence and Testing Coverage"

A short answer is that software is complicated, demands perfection, and humans are imperfect. With limited resources, competition, and limited knowledge, a lot of software developers do the best they can. Those who are careful to produce even more secure software will never be able to compete--their products will be more expensive, late to market, have fewer features, etc. On the other hand, security is becoming an important customer consideration; while customers (and most developers) can't tell what's secure by looking at it, there are experts, analysts, and historical trends that teach us about security, and help us make better decisions about the products we buy and use.

Sometimes the more secure products will be more expensive, or lack other qualities we desire beyond just cost (features, usability, performance, etc).

In the world of software security, we generally accept that if an adversary has enough funding, motiviation, and/or resources, nothing is truly secure.

Security costs money, and it's a tradeoff.

share|improve this answer
add comment

Yes, those are called "drive by infections".

The term “drive-by infection” describes the process of malware (malicious software running harmful activities against users' wishes) infecting a user’s computer merely by visiting a website. Affected websites often contain legitimate offers, but have been compromised by hackers introducing malicious code to the website to then distribute malware. Just surfing to an affected website is sufficient to infect a computer.

Why a web browser is not 100% safe? Prime example here

See a video of a drive-by infection in action here:

http://www.youtube.com/watch?v=9_PYdgwkxx0

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.