Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know malware can be gotten by downloading and running stuff, but is there a real possibility of just viewing a webpage and getting one?

I'm not using IE.

Please give some support to your answer. Not just yes or no.

share|improve this question

closed as not constructive by random Jul 23 '12 at 22:42

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Welcome to SuperUser! This question will invite a lot of discussion because there is no absolutely correct answer. This is more of a topic of opinions and reasoning, which while valuable, are not on-topic for SuperUser. The closest thing to a correct answer that can be said about this question is the old adage that nothing is ever perfectly secure, no matter what you do. But since that is the only right answer, and since that answer in itself is not very educational, this will become a discussion of opinion. –  ÃŁŁǫǛȉЖΦΤїҪ Jul 23 '12 at 20:35
1  
Do you want to know how "drive-by malware" works, or do you want to know how to protect yourself from it? Or do you have another question? –  Michael Hampton Jul 23 '12 at 20:39
    
@MichaelHampton, they are (legitimately) wondering why people are frequently warned these days about getting infected from merely visiting a web page and how exactly that would even be possible since traditional malware requires purposely running a program. –  Synetech Jul 23 '12 at 22:18

3 Answers 3

Yes, there is a possibility. Not a large one but it is possible.

Example: In 2004 there was a problem in Microsoft's Graphic Device Interface Plus (GDI+). It contained a vulnerability in the processing of JPEG images.

The quote the MS website: This vulnerability may allowed attackers to remotely execute arbitrary code on the affected system. Exploitation may occur as the result of viewing a malicious web site, reading an HTML-rendered email message, or opening a crafted JPEG image in any vulnerable application. The privileges gained by a remote attacker depend on the software component being attacked. Description

Now that bug has been fixed. So this specific bug will not harm you unless you run a really old OS and failed to install the security patches. But similar problems are being found all the time, and not just in XP.

So consider this:

  • There are problems in any large OS
  • These problems are sometimes found
  • If they are found and reported then the problem eventually gets fixed (this can be next week, or sometimes it takes years).
  • If someone finds them and decides to exploit them then your computer can get infected.

Some of these exploit require you to do stupid things (e.g. open mail from someone you do not know). Some of them get triggered without any human interaction. The JPG picture and the GDI+ problem is such an example.

share|improve this answer
    
This is also true with Adobe Flash and maybe Java . –  jftuga Jul 23 '12 at 20:41
    
Yes, it is true for any installed program which may get called. So basically do not install anything which you do not need. (e.g. no flash or shockwave on a server. No need for java on most desktops, no unused toolbars in browsers, etc etc). –  Hennes Jul 23 '12 at 20:43
    
Thank you for the answer. –  Startup1 Jul 23 '12 at 20:54

While a web-browsers allow code to be “executed” (JavaScript, Flash, Silverlight, etc.), these plugins and engines are specifically designed to be sandboxed from the system so that they cannot do any harm. As such, there is no built-in or default way of remotely/spontaneously executing/running code to infect a machine.

That said, browsers and plugins are not foolproof and due to their complexity, they often have vulnerabilities that can be exploited to infect a system.

Aside from using security software, another way to reduce exposure is to reduce the size of the attack vector by installing as few plugins as possible, keeping plugins and the browser itself updated with the latest patches, and disabling plugins when not being used or configuring them to be blocked by default and selectively allowing them on trusted sites.

There’s little benefit in re-writing a detailed explanation and examples, so I’ll just point you to this question that asked about getting infected from media files. I gave a detailed answer there that must be clear and informative because it seems to be pretty popular.

share|improve this answer
    
Thank you for the answer. –  Startup1 Jul 23 '12 at 22:31

Most definitely yes. Consider the Malware infections that "emulate" an Anti-Virus program. You must know someone who complained about a mysterious program that just appeared one day, telling them they had 30-some infections, and if they wanted the program to remove them, they had to purchase the program. The names were varied, WinAV for example. All those people who got infected didn't download a program first, and then find themselves infected. I know from observation that all it took was visiting a web site.

Everything you do with a browser downloads information to your computer. So, there is always something being pushed to you. There are steps you can take to limit what is downloaded, but for those just using a vanilla install of IE (the most targeted browser), there was a real danger of getting infected depending on where they went on the web.

It wasn't just limited to seedy sites either. In the mid 2000's, Sears.com would install spyware on visitors machines. NHL.com was used maliciously by one of it's advertisers to infect visitors with malware. Then there is Myspace. I've cleaned customers machines from fake AV infections after they spend a night surfing friends pages at Myspace.

Now, are you asking if it is possible for you specifically to get an infection that way? Well, you don't use IE, and that helps, but otherwise, since we really know nothing about your surfing habits and the other software on your system, it is impossible to say.

share|improve this answer
    
Often people do not realize that the most common vector is your plain ordinary website. What these criminal organizations will do is purchase advertising with one of the large advertising firms ( i.e. Wall Street Journal does not use Google for their ads ) and serve an infected ad. Because this ad is served to ALL of their customers ( including WSJ in a case like this ) it is quickly reported. However, at this point, hundreds of thousands of users could have be infected without their knowlege because of an exploit in lets say Java or Flash. –  Ramhound Jul 24 '12 at 11:50
    
@Ramhound Isn't that what I said with "NHL.com was used maliciously by one of it's advertisers to infect visitors with malware."? Interesting that you would agree with me, without giving me credit for agreeing with me or voting me up. Not surprising, but interesting. Continues to prove the true tone of SU. –  Bon Gart Jul 24 '12 at 12:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.