News

2008: The Year of the Insecure Web Browser

• By William Jackson
• April 21, 2009

"It seems like the browser is really under attack," said Grossman, who gave a talk Tuesday on the top Web hacks of 2008 at the RSA Security conference being held in San Francisco this week. "The hackers have taken the client side and are really gong after that."

Why is the browser so attractive? "Browsers are not secure things," he said. "There are many reasons for this, the least of which is the user."

The primary reason is that gaining market share is the highest priority of the vendors, who will sacrifice security to get new, rich and functional products onto users' desktops as quickly as possible. "They try to get the best product they can," Grossman said, but that often means that security is bolted on as an afterthought.

Grossman, the founder and chief technical officer of White Hat Security, has made a point of collecting the new attack techniques that have been documented in recent years and ranking them according to which ones are most likely to be giving IT grief in the coming year, based on his own assessment and the opinions of others in the security community.

"It's the difference between what is possible and what is probable," he said.

Last year's crop was down marginally from 2007; just 70 new Web attacks were documented in 2008 compared with 80 the year before. However, that still amounts to about 1.5 new attacks a week, and a lot of the attacks were more complicated this year.

"The winner this year was head-and-shoulders above the rest" in the consensus of the experts he consulted, Grossman said. It was an attack named GIFAR -- one-half .GIF image file and one-half .JAR (Java Archive) file. It is a tool that can be used to get around restrictions in Web applications on the uploading of Java class files by disguising it as a valid image.

GIFARs got a lot of attention during last year's Black Hat Briefings in August. By including the .JAR in a .GIF, a Web site that allows images to be uploaded will allow it to be posted as a valid image file. When downloaded to the browser, it will be rendered as a valid image, but it also will be treated as a valid .JAR file for using a Java applet by the Java Virtual Machine.

Sun released a patch for GIFAR in December, and an exploit has not yet appeared in the wild, Grossman said.

"We don't know of a malicious use yet," he said. But that does not necessarily mean that it is not out there. "It's going to be difficult to see if there is."

In addition to the usual browser targets such as HTML and JavaScript, Flash, ActiveX and other third-party tools are being targeted, Grossman said. The problems with insecure browsers are well-known, and the third-party companies such as Google that use browser functionality in their business models will have to take a stand to improve security.

"They have to exercise their leverage with browser manufacturers," he said. "It's not their software and they can't control it," but they are the ones who ask the manufacturers for functionality for their users.