37

I do understand that there is a risk of phishing, and that it downloads files that may cause harm when opened. But is there any risk of something bad happening when I simply open a website? In that case, what can happen?

0

8 Answers 8

55

Web browser are programs that can have vulnerabilities just like any other software.

This means that simply browsing a web site with a web browser that has a remote code execution vulnerability could in the worst case lead to an attacker being able to execute code with the permission of the web browser.

Modern web browsers use a sandbox system that should prevent such code from causing damage, but again these systems aren't perfect and hackers may find ways to escape from the sandbox and infect your system.

The developers of web browsers like Google, Mozilla, Apple close those vulnerabilities when they get to know them, but a number of vulnerabilities occur as "zero day vulnerabilities" which means that they are first used to attack users and then they get notices, e.g. by anti-virus companies that then inform the web browser developers. Then a fixed version has to be developed and distributed to all users, which can take some time.

In conclusion you can say that surfing web sites can harm your computer if you are unlucky and there is an unfixed vulnerability in your web browser.

As a large number of those vulnerabilities require JavaScript it is a good idea to disable JavaScript for suspicious web pages. You can do so e.g. using add-ons like NoScript.

8
  • 7
    @norway-yv Not sure what you mean by "virtually". There is danger because zero day vuln. exists (in general) and you never know when the next zero day has been found by some attackers. From the time such a vuln. has been found until your web browser receives the final patch against this vuln. you are vulnerable. This time span can be days or weeks.
    – Robert
    Commented Mar 14, 2022 at 12:30
  • 8
    They called these "drive by infections" back in the day they first started. No user interaction other than visiting the malicious website.
    – Moab
    Commented Mar 14, 2022 at 15:02
  • 5
    @norway-yv: "...a couple of weeks after I received it..." That won't make a difference: Yes, your browser will have received updates in those weeks, but the website owner can update the malware on their web site as well.
    – Heinzi
    Commented Mar 14, 2022 at 19:43
  • 9
    One of the most interesting security vulnerabilities in recent times was the Spectre/Meltdown family of vulnerabilities whose researchers actually managed to construct some ECMAScript code which when compiled by V8's JIT compiler produced the necessary machine code to exploit it. While Google changed the JIT compiler even before the paper was published and thus closed the hole, this is interesting because as we know, Spectre/Meltdown allows you to access all of a computer's memory even if you are running inside of a VM, here they demonstrated that you can do that even remotely with code that … Commented Mar 15, 2022 at 5:09
  • 10
    … runs sandboxed inside of a browser. With this particular vulnerability you could run a sandboxed web browser in sandboxed environment in a sandboxed VM and just by visiting a website and running some sandboxed "interpreted" ECMAScript code, the remote server can read all of the memory in the computer. Commented Mar 15, 2022 at 5:13
12

If you take a look at this and previous generation of video game consoles (PlayStation 4 and 5, Xbox One and Series), the web browser is what is used to exploit bugs in the firmware to gain access to features that aren't normally available. The user who wants to exploit their console visits a specially prepared website and that's basically it. The same exploits can be used for malicious purposes.

And yes, this is a good analogy to PCs: these consoles are running an operating system like any personal computer and their browsers are based on Webkit - the same engine that powers overwhelming majority of desktop browsers*.

Why are exploits like this not so common on the PC? I suppose mostly because desktop browser vendors are much better at keeping their browser up to date. All major browsers are evergreen, ie. they auto-update to the latest version as soon as it's released. With consoles, the browser is bundled with the firmware and they don't seem to do a very good job keeping it up to date - possibly because it's more tightly integrated with the rest of the system and they can't afford to re-test everything thoroughly every time a minor patch is released.


* More precisely, Chrome and some of its relatives are powered by the Blink engine, which is based on Webkit. Firefox is the most popular Webkit-free browser as of now, but the same principles apply.

0
8

Websites could be dangerous if browsers have vulnerabilities. But even if there aren't any vulnerabilities in your browser, they could be dangerous depending on your definition.

  • They could exploit vulnerabilities in other websites, for example to steal your account, or bypass the firewalls between the internet and your local network. Or they simply attempt DDoS to another website using your browser, which may do damage to that website, or get you blocked from the other website, or both.
  • They could run mining scripts of a cryptocurrency.
  • They could make your system freeze simply by using a lot of resources in some cases.
  • If the link is specifically designed for you, it would leak your IP and location information, some system information and settings, and the fact that you actually clicked it, implying you have read the message.
  • In case you are hiding your activities from your ISP by using some kinds of proxies, in theory they could know you if you visit a given website, by measuring the bandwidth.
  • Might not be intended, but they could make some 3rd party ad platforms show unfriendly ads in the next days.
  • Some captcha providers say they could analyze the user's behavior and simplify the process to just one click in some cases. I don't know how it works. But if it works, in theory they could break it by copying your behavior.
4

It might not target the hardware but a website could be designed to specifically exploit the risk some people have to induced epileptic seizure and in that way actually be medically dangerous to the user. I could well see an argument that such a website would in fact be more dangerous than one that merely exploits random security flaws.

5
  • while technically true, thats not what the OP was asking about
    – Keltari
    Commented Mar 15, 2022 at 2:03
  • 1
    But it is a good point though... It can be harmful. But not in a superuser way, more in a health way.
    – yrjarv
    Commented Mar 16, 2022 at 11:29
  • @Keltari that may be so, but this answer demonstrates how creative attacks can be.
    – stevec
    Commented Mar 16, 2022 at 11:31
  • 1
    The question may be ill-defined about the "danger". In this case, some other examples may include inducing heart failure (e.g. due to jump scare) or triggering PTSD (with text/image).
    – Andrew T.
    Commented Mar 16, 2022 at 16:56
  • @AndrewT. I am inclined to agree, but that is a bit like answering "do it by hand" on StackOverflow: SuperUser is there for IT questions and answers, and then I think it is obvious that I meant "to your computer or similar" because that is what this site is about.
    – yrjarv
    Commented Mar 30, 2022 at 5:28
4

Yes. Even simple images without any HTML, let alone any active content, can be used to exploit vulnerabilities in image viewers, including browsers.

Here is an older example. As-is it "only" crashed the browser but I think as a general rule such bugs can potentially be used to execute code.

1

It's possible there is High-level exploit in some specific but commonly used hardware. Example: Slide-to-jailbreak on (Very) old iOS devices. You open site. You slide visual control. Devices got jailbroken and Cydia installed. Slide part could be removed. Some malicious payload could be used instead of Cydia.

I don't think it's rather minor issue on properly updated Windows/Linux/macOS system. Also, using good but non-default modern AV with traffic inspection capabilities will help (now site have to also overcome it's protections).

1

Yes it can. Check out NetworkChuck's video "I HACKED my wife's web browser". He shows how easy it is for a bad website to hurt you even though you don't download anything.

For example, a website can log anything you type, do social engineering to get access to LastPass accounts, or even Rickroll you.

Disclaimer: I am in no way associated with NetworkChuck, his channel, or any of his sponsors. I just found the video to be very informative.

3
  • I see. But this "social engineering", how does it accomplish its goals? If I am vigilant and aware of the fact that the site is fraudulent, is it still imaginable that the "social engineering" will function?
    – yrjarv
    Commented Mar 17, 2022 at 6:36
  • 1
    If you are fully aware that it is a fraudulent website then social engineering won't get much from you. But the website can use information gained about your browser, OS, IP address, computer and etc. to find vulnerabilities on your computer, other computers and devices on your network, and check for holes in your firewall. How does it do this? By running scripts without your knowledge. Because they can run scripts on your computer means they can do damage even though you didn't download anything.
    – Fred
    Commented Mar 17, 2022 at 13:10
  • 1
    It is also possible that the fraudulent website has a signed certificate. Making it even harder to identify that the website is indeed fraudulent.
    – Fred
    Commented Mar 17, 2022 at 13:14
1

As already covered in other answers, the website can be dangerous to the visitor's own computer or system.

But also when a user visits a website it can act maliciously to compromise/attack some other resources using the victim's system.

For example, the basic idea of DNS rebinding attack is that the victim visits attacker's website and downloads malicious JavaScript code that targets some other resource on the network. In this attack the attacker manipulates the DNS records of his domain to change the IP address of the resource from which the script was downloaded to the IP address that belongs to a system that is being attacked, therefore circumventing the same-origin security protection. It can even be a system in the internal network, not directly accessible to the attacker.

So, yes, it can be dangerous to visit a website. There can be many possible ways for some harm to occur, depending on the threat model.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .