2 ms·
It definitely improves security, but you'll still be screwed against a targeted attack against a specific website. The attack against Forbes.com is a good exam
by eeeeeeeeeeeee 12y ago
It definitely improves security, but you'll still be screwed against a targeted attack against a specific website.
The attack against Forbes.com is a good example. That is a site you would have whitelisted and the attackers compromised that website to then elevate access to the people browsing that site (government employees specifically targeted).
http://www.forbes.com/sites/thomasbrewster/2015/02/10/forbes-com-hacked-in-november-possibly-by-chinese-cyber-spies/ http://www.forbes.com/sites/thomasbrewster/2015/02/10/forbes...
- rudolf0 12y agoI work in incident response and actually investigated that watering hole firsthand at our organization. The SWF was hosted on a separate domain, so NoScript in fact would have prevented that specific attack from working even if you whitelisted forbes.com. NoScript will very often block exploit chains from occurring even if it won't necessarily always block stage 1.