Top porn sites 'pose growing malware risk' to users

[Wanderer]

I do a bit of work on security and often my research takes me to websites which contain malicious code. To mitigate against my PC getting compromised, I switched to running machines under VMWare for high risk activities.

If one of the VMs gets compromised I can easily contain the system and examine what happened to better understand the attack vector used or just throw the VM away and start a new one....

Another good solution for visiting risky sites is to use one of the Linux distributions. CentOS, Mint and Ubuntu (before they fecked up the GUI with Gnome 3) are all dead easy to install and pretty much bullet proof security wise unless you do something Really Dumb. You can even give a Linux system to the kids to use and they are working pretty hard to trash it.

[AtW]

I do a bit of work on security and often my research takes me to websites which contain malicious code. To mitigate against my PC getting compromised, I switched to running machines under VMWare for high risk activities.

It's much safer to keep PC turned off.

Milan.

[MarillionFan]

It's much safer to keep PC turned off.

Milan.

What's a PC???

DodgyAgent

[doodab]

What's a PC??? Someone who beats up miners.

DodgyAgent

FTFY

[administrator]

Indeed. How is it even possible for Javascript, which is downloaded, compiled and run in the browser to do anything harmful to your computer?

Having had some experience of the hacks on the ad server on this forum and attacks on other sites I host I have a little bit of experience with this. Often the JavaScript is used to sniff what OS / browser / Java version the end user is on and a payload is then triggered if known exploits exist for that combination.

It's users who are the problem, not browsers.

Nah, it is the browser that is often the problem:
PWN2OWN results Day One – Java, Chrome, IE 10 and Firefox owned | Naked Security

No getting away from the fact that end users are gullible but really the OS should protect even the most stupid end users.

[AtW]

Indeed. How is it even possible for Javascript, which is downloaded, compiled and run in the browser to do anything harmful to your computer?

If it runs then it can escape.

Everything that parses data - runs it.

Switch off your PC now

[xoggoth]

Why not make that search engine thing of yours into a specialised porn finder? You could make a fortune.

[AtW]

You could make a fortune.

What for?

[Wanderer]

Indeed. How is it even possible for Javascript, which is downloaded, compiled and run in the browser to do anything harmful to your computer? I could write something in C++ in 2 minutes that'd delete all your files, but that's because it's native code. Sandboxie appears to be about protecting you against downloaded programs. Well don't download them.

Attacks are getting more and more sophisticated because there is real money in it. There have been vulnerabilities found in browsers that can be exploited by simply visiting a malicious page. A researcher who finds one of these can pass it to the software vendor or sell it on the black market to organised criminal gangs with teams of developers who exploit them to compromise computers for identity/data theft and botnets. It's no longer script kiddies doing it for laughs or people doing patently stupid things which result in their PC being compromised (though there are still a lot of these too), it's big business now.

No doubt this is mostly about people who still run IE6. And in this instance, I feel it's justified to add a .

Agree that anyone who runs IE6 (including many large companies who should know better) suffers from terminal stupidity but as above - these attacks are increasingly sophisticated and organised so it's a running battle to keep ahead.