Skip to content

JA5. Safe Web Browsing

Statement

In this unit, we have learned about different types of cyber threats and how they can be mitigated or prevented from damaging your computer networks and data. To reflect your learning, please respond to each of the following questions:

  • Describe the most interesting facts you learned about cyber threats and their mitigation in this unit. Think about reasons why you noticed these facts, your impression, and your plans for further exploration of “cyber threats and their mitigation”.
  • Describe how you exercise safe web browsing and the use of web applications for your personal needs. What is it that inspires you?
  • List the additional facts about cyber threats and their mitigation you would like to explore based on this unit’s concepts.

Solution

Here are some of the most interesting facts I learned about cyber threats and their mitigation in this unit:

  • The main purpose of XSS attacks is to steal cookies from the user’s browser. The attacker can then use the cookies to impersonate the user, as their malicious code will eventually send details back to the attacker when it is executed (XSS, 2021, 1).
  • CSRF attacks involve social engineering to trick the victim into doing something they did not intend to do; but the attacker usually does not gain access nor steal any information from the victim (Fullstack Academy, 2017, 2).
  • A 1KB of deeply nested XML entities can expand up to 3GB of data, which can cause a DoS attack; Billion Laughs, Yaml bombs, and External Entities are some examples of XXE attacks (Mgeeky, n.d., 3).
  • Stack-based overflow attacks are the most common type of buffer overflow attacks. They occur when a program writes more data to a buffer than it can hold, causing the extra data to overflow into adjacent memory space. If this is executed well, this could overflow a specific memory address over the return pointer of the current function; that address contains a malicious code that the attacker put and it will start executing (Buffer overflow, 2021, 4).

Here is how I exercise safe web browsing and the use of web applications for my personal needs:

  • I keep my operating system, browser, and other programs up-to-date.
  • I do not click on suspicious links or download files from untrusted sources.
  • I consider some programs as untrusted no matter what; like Telegram.
  • I keep all permission to the minimum to any website; whenever I need to use the camera (for example), I change the permissions to allow, then turn it off when I am done.
  • I rust Google, thus I always use Chrome as my browser; I believe that Google created an environment where everything that runs on the browser is somewhat isolated from the local system.

Here are some of the additional facts about cyber threats and their mitigation I would like to explore based on this unit’s concepts:

  • I understand how XSS, CSRF, and XXE attacks work, but I would like to know how the attacker can change the user’s client-side code without social engineering.
  • I have a theory that buffer overflow attacks are no longer relevant as modern OSes and programming languages have built-in protection against them. I would like to verify my theory after doing reliable research.
  • Whenever I try to search for cybersecurity topics, threats, issues, and statistics, I find it difficult to find a reliable source that I can blindly trust. I would like to determine one or more reliable sources that I can use in the future.

References

  1. Cross-site scripting (XSS) attack tutorial with examples, types and prevention. (2021, November 29). Software testing helps. https://www.softwaretestinghelp.com/cross-site-scripting-xss-attack-test/ ↩

  2. Fullstack Academy. (2017, September 29). CSRF tutorial - a guide to better understand and defend against cross-site request forgery (CSRF) [Video]. YouTube. https://www.youtube.com/watch?v=13QPmRuhbhU ↩

  3. Mgeeky. (n.d.). XML vulnerabilities and attacks cheat sheet. GitHub Gist. https://gist.github.com/mgeeky/4f726d3b374f0a34267d4f19c9004870 ↩

  4. Buffer overflow. (2021). Open Web Application Security Project. https://owasp.org/www-community/vulnerabilities/Buffer_Overflow ↩