Page 122 - Cyber Defense eMagazine February 2024

One of the most pressing concerns in browser security is the prevalence of zero-day vulnerabilities. Zero-
day vulnerabilities refer to the flaws that get exploited by attackers before developers can patch them.
These vulnerabilities, arising from coding errors or design flaws, provide unintended openings for security
threats. The exploitation of these vulnerabilities can lead to unauthorized access, data compromise, or
even remote control over systems. The time lag in detecting these vulnerabilities come at the cost of
security to the millions of users using the browser.

Take for instance the WebP vulnerability - a security flaw in libwebp library used to decode WebP images.
This flaw allowed attackers to execute code by exploiting the library's handling of Huffman coding, a
method for compressing data. Specifically, the vulnerability stemmed from the way libwebp built its lookup
tables for decoding. Malformed WebP files could create imbalanced Huffman trees with excessively long
codes, leading to buffer overflows. This meant that the decoder could write data outside the intended
memory area, potentially corrupting memory and allowing attackers to manipulate the program's
behavior.

Despite diligent maintenance by experienced developers, a single oversight in validating Huffman tree
structures in libwebp led to this critical vulnerability. The widespread adoption of WebP in various
software, including web browsers and operating systems, heightened the impact of this vulnerability.

Other than zero-day attacks, browsers are vulnerable to a host of attacks such as Cross-Site Scripting
vulnerabilities, malvertising, and even social engineering campaigns tricking users into downloading
malicious software under the guise of necessary updates.

Traditional endpoint security solutions such as antivirus softwares aims to protect users from various
cyber threats, primarily by blocking access to known malicious content and websites. Built on extensive
databases of malware signatures, these programs probabilistically identify and prevent recognized
threats. However, a significant limitation of antivirus software lies in its inability to understand the
intricacies of application behavior, particularly in complex applications like web browsers.

Antivirus systems lack insight into the specifics of application activities, such as which browser tab is
initiating certain network requests, or whether a string copied to the clipboard is being transmitted over
the network in a potentially harmful manner. This lack of detailed application-level awareness means that
antivirus programs can't accurately correlate observed data with its source or context within an
application. Consequently, this can allow malicious activities to go undetected, as the software struggles
to differentiate between benign and harmful actions based solely on the data observed. Moreover, when
antivirus solutions are overly aggressive in their blocking tactics, this can lead to a high number of false
positives. This can disrupt user workflows, mistakenly blocking or quarantining legitimate applications
and files, thereby causing significant inconvenience and potential data loss.

On the other hand, false negatives pose a more direct security risk. When antivirus software fails to
identify and stop a malicious program or file, it allows the threat to infiltrate the system. This can lead to
a range of issues, from data theft and system damage to ransomware attacks and identity theft.

Cyber Defense eMagazine – February 2024 Edition 122
Copyright © 2024, Cyber Defense Magazine. All rights reserved worldwide.