This has been something that has been on my mind for quite some time now. I have some experience with Javascript and know that it has a function that can store files on a user's computer. My question is if it is possible to get virus from a website by just visiting it. Thanks is advance.
1 Answer
That is certainly possible. What did you think all those security updates and patches are for? ;)
A browser is a very complex application and it needs to be able to do a myriad of things. Not only that, but also it needs to make sure it does everything as fast and efficient as possible by making a lot of educated guesses about what's going to happen later on in a loaded website, in order to speed up buffering, pre-rendering and other efficiency boosters.
All this functionality is complex enough to allow for any numbers of combinations of code being thrown at it, which also means a large number of possible bugs in the form of combinations of factors that the developers and testers just didn't think of to build guards against.
A certain number of these bugs can lead to the browser doing things it wasn't supposed to do, like not correctly checking for possible problems. A certain number of these bugs can be exploited by attackers to run malicious code. Especially when combined with the same kind of "exploits" in operating systems, which is of course an even more daunting complex of functionalities, a "well-crafted" malicious website by a smart attacker can exploit these security holes and sneak a malicious payload past all the safeguards.
Modern browsers and operating systems are quite secure, and it takes a well versed attacker to exploit those holes structurally. BUT... The biggest exploit is of course the user, and users want to be able to download data from anywhere, even run downloadable code from anywhere. So no matter how good the developers were at security, there's always some hacker finding the weak spots in that security and inject something bad, or seducing a user to circumvent the very security put in place to protect him.
