4 ms·

> The more vulnerabilities they attempt to exploit the faster they're going to be noticed so that's a risky gambit. It seems your entire risk computation is ba

> The more vulnerabilities they attempt to exploit the faster they're going to be noticed so that's a risky gambit. It seems your entire risk computation is based on the premise that this is true, and that if true how much more likely they are to be noticed is significantly high enough to make it less worth the risk. Do you actually have data to back that up, or are you just going by an assumption? Because to me it seems likely that there are blobs of JS that look for a wide number of vulnerabilities floating around blackhat sites ready to be slightly tweaked for the individual case and then deployed. That's basically the entire premise of what script kiddies are, but with JS, so I don't see why it wouldn't at least be easily available. > The more realistic threat model is software being compromised and the auto-update feature pushing out malicious code to all of the users like what happened with the Transmission BitTorrent Client. That's possible. It would still be interesting to see more of the reasoning on this. I can think of a few things that might mitigate what I think you are referring to, but there's not much by the way of details to address.

Nadya 8y ago
>Do you actually have data to back that up, or are you just going by an assumption? An assumption. The idea is that conducting more malicious activity is generally easier to spot than conducting less malicious activity and trying a wide range of exploits is more likely to be noticed than a smaller, possibly more targeted exploit. Script kiddies attempt a wide range of exploits when they're going after a single target. For example, throwing any and all known vulnerabilities against a website hoping it is hosted with an outdated version of Wordpress in an attempt to gain access. But unless you're going for attention and de-facing the home page, once you're in you want to draw as little attention to what you're doing as possible. OTOH, they might throw everything and the kitchen sink in under the assumption that they'll be caught quickly so they want to capture as much as possible before they're kicked out. >...Because to me it seems likely that there are blobs of JS that look for a wide number of vulnerabilities floating around... I browse with Javascript disabled. I use Tampermonkey and Stylish to inject CSS and Javascript that I write (and therefore trust) to pages I use frequently enough to justify the time spent on restoring certain functionality.
- kbenson 8y ago
  > The idea is that conducting more malicious activity is generally easier to spot than conducting less malicious activity and trying a wide range of exploits is more likely to be noticed than a smaller, possibly more targeted exploit. I understand the idea, I just think some assumptions that go into it are wildly unproven. I would think you're just as likely (if not more likely) to be exposed through a high traffic site that is dangerous for a very short period of time than a low traffic site that's exposed for a longer period. E.g. if nytimes.com is exploited, there's probably a window of minutes to an hour before it's noticed and fixed, and the fix make take as long or longer to happen than the first notification of a problem. In that scenario, the amount of time unnoticed reduced by stacking every exploit you can think of is fairly minimal, and it likely doesn't reduce the time to fix after notification at all. So, if this assumption any less possible than yours? The only difference is that whether my scenario is right or wrong, it promotes behavior that doesn't leave you more vulnerable to exploitation by random sites, while for yours if you're wrong (and you act on it, as you are) it leaves you more vulnerable. >>...Because to me it seems likely that there are blobs of JS that look for a wide number of vulnerabilities floating around... > I browse with Javascript disabled. Okay, then image library exploits, or css parsing exploits, or any number of other things. For example, ambiguously listed stuff like this[1], or this[2] or this[3] or this[4]... or how about I just point you at a bigger list[5] (code excution exploits for Firefox reversed by date, with severity rating over 9. There are hundreds). It's not like Javascript has been the only attack vector of the last few years. I have no idea how many of these affect that Firefox version. My guess is it's more than two or three. 1: https://www.cvedetails.com/cve/CVE-2016-2807/ https://www.cvedetails.com/cve/CVE-2016-2807/ 2: https://www.cvedetails.com/cve/CVE-2016-2806/ https://www.cvedetails.com/cve/CVE-2016-2806/ 3: https://www.cvedetails.com/cve/CVE-2016-2804/ https://www.cvedetails.com/cve/CVE-2016-2804/ 4: https://www.cvedetails.com/cve/CVE-2016-1945/ https://www.cvedetails.com/cve/CVE-2016-1945/ 5: https://www.cvedetails.com/vulnerability-list.php?vendor_id=452&product_id=3264&version_id=&page=1&hasexp=0&opdos=0&opec=1&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=9&cvssscoremax=0&year=0&month=0&cweid=0&order=1&trc=447&sha=2ec9e591f4a35d9c40d5f6493400c4fb4ee1c03b https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
  - 8y ago
maceurt 8y ago
Software combating malicious sites routinely set up very easy targets using outdated software. Many exploit kits nowadays that constantly get updated to find new avenues of attack and to avoid obvious targets.
- kbenson 8y ago
  I imagine things meant to site on servers for as long as possible without detection that might expect weeks/months had a different defense strategy than something targeting a website that sees a lot of public traffic. If you expect discovery withing hours anyway, a lot of the benefit of keeping a low profile may be negated.

Nadya 8y ago

>Do you actually have data to back that up, or are you just going by an assumption? An assumption. The idea is that conducting more malicious activity is generally easier to spot than conducting less malicious activity and trying a wide range of exploits is more likely to be noticed than a smaller, possibly more targeted exploit. Script kiddies attempt a wide range of exploits when they're going after a single target. For example, throwing any and all known vulnerabilities against a website hoping it is hosted with an outdated version of Wordpress in an attempt to gain access. But unless you're going for attention and de-facing the home page, once you're in you want to draw as little attention to what you're doing as possible. OTOH, they might throw everything and the kitchen sink in under the assumption that they'll be caught quickly so they want to capture as much as possible before they're kicked out. >...Because to me it seems likely that there are blobs of JS that look for a wide number of vulnerabilities floating around... I browse with Javascript disabled. I use Tampermonkey and Stylish to inject CSS and Javascript that I write (and therefore trust) to pages I use frequently enough to justify the time spent on restoring certain functionality.

kbenson 8y ago
> The idea is that conducting more malicious activity is generally easier to spot than conducting less malicious activity and trying a wide range of exploits is more likely to be noticed than a smaller, possibly more targeted exploit. I understand the idea, I just think some assumptions that go into it are wildly unproven. I would think you're just as likely (if not more likely) to be exposed through a high traffic site that is dangerous for a very short period of time than a low traffic site that's exposed for a longer period. E.g. if nytimes.com is exploited, there's probably a window of minutes to an hour before it's noticed and fixed, and the fix make take as long or longer to happen than the first notification of a problem. In that scenario, the amount of time unnoticed reduced by stacking every exploit you can think of is fairly minimal, and it likely doesn't reduce the time to fix after notification at all. So, if this assumption any less possible than yours? The only difference is that whether my scenario is right or wrong, it promotes behavior that doesn't leave you more vulnerable to exploitation by random sites, while for yours if you're wrong (and you act on it, as you are) it leaves you more vulnerable. >>...Because to me it seems likely that there are blobs of JS that look for a wide number of vulnerabilities floating around... > I browse with Javascript disabled. Okay, then image library exploits, or css parsing exploits, or any number of other things. For example, ambiguously listed stuff like this[1], or this[2] or this[3] or this[4]... or how about I just point you at a bigger list[5] (code excution exploits for Firefox reversed by date, with severity rating over 9. There are hundreds). It's not like Javascript has been the only attack vector of the last few years. I have no idea how many of these affect that Firefox version. My guess is it's more than two or three. 1: https://www.cvedetails.com/cve/CVE-2016-2807/ https://www.cvedetails.com/cve/CVE-2016-2807/ 2: https://www.cvedetails.com/cve/CVE-2016-2806/ https://www.cvedetails.com/cve/CVE-2016-2806/ 3: https://www.cvedetails.com/cve/CVE-2016-2804/ https://www.cvedetails.com/cve/CVE-2016-2804/ 4: https://www.cvedetails.com/cve/CVE-2016-1945/ https://www.cvedetails.com/cve/CVE-2016-1945/ 5: https://www.cvedetails.com/vulnerability-list.php?vendor_id=452&product_id=3264&version_id=&page=1&hasexp=0&opdos=0&opec=1&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=9&cvssscoremax=0&year=0&month=0&cweid=0&order=1&trc=447&sha=2ec9e591f4a35d9c40d5f6493400c4fb4ee1c03b https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
- 8y ago

maceurt 8y ago

Software combating malicious sites routinely set up very easy targets using outdated software. Many exploit kits nowadays that constantly get updated to find new avenues of attack and to avoid obvious targets.

kbenson 8y ago
I imagine things meant to site on servers for as long as possible without detection that might expect weeks/months had a different defense strategy than something targeting a website that sees a lot of public traffic. If you expect discovery withing hours anyway, a lot of the benefit of keeping a low profile may be negated.