Forest Global Training Partners

Cyber Risks · Krebs on Security

Blocking Java Script in the Browser

Summary: Krebs on Security recommends disabling JavaScript by default and selectively enabling it per site, noting that a huge percentage of Web-based attacks use JavaScript to deliver malicious software, and that even legitimate sites can run malicious code through tainted ads in major ad networks. The post compares browser options: Firefox's NoScript extension allows permanent or session-only exceptions and can block third-party scripts, Chrome's built-in blocking offers fewer options and required a manual page refresh in testing, and Internet Explorer 9 offers only on, off, or a prompt option that produces incessant pop-ups.

What's compelling: The post's core admission is that whitelisting known safe sites will not block all malicious scripting attacks, because scammers sneak tainted ads into the major ad networks that legitimate sites rely on - so the trust boundary sits with every third-party script a page loads, not with the site's brand.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related