(untitled)

Alright so sorry if this is an incredibly stupid question but I am still very new to cyber security and anything related. One of the biggest concerns I see in articles and on forums like this is Javascript... Everyone suggest installing Noscript and avoiding java-based sites and applications like the plague. What is it a Java-based website can do to you? Can it run a script or some sort of malware just by visiting the site? Does anyone have an example of this occurring? Again sorry for the dumb question but it's a good place for me to start.

Almost all browser exploits are JavaScript a based.

>>7167 I guess what's an example of a browser exploit? Can one for example sniff through Firefox cookies and find passwords/logs/etc.?

>>7168 https://www.exploit-db.com/exploits/45048 here is an example of an exploit >JavaScript Core - Arbitrary Code Execution

>>7169 thanks!

Java and Javascript are different things.

Even if it wasn't for security, I do not like to hear the fans running fast only for some browsing

>>7166 Java and Javascript are separate things, first of all. Two separate kinds of languages. Javascript is a language that your web browser can interpret (or run, if you will), to create dynamic moving content. It's a problem because you are, essentially, running someone's code in your browser and trusting it, and there can be privacy-related risks here. It's also likely that an exploit (which is a way of coercing your computer into running some lower level code it shouldn't) will make use of javascript, as again, it's a language that allows for dynamic content. >>7168 A browser exploit would allow an attacker to execute code on your computer in the context of your user. It would be able to do anything your user would do, so it would be able to steal your cookies or sniff passwords, etc. However, quite frankly, browser exploits aren't that common these days, and your browser probably auto-updates. If you had adobe flash or something similar installed, that'd be a larger concern. As an aside, you won't understand this and I'm ranting to myself, mostly, but generally, it's unwise to have Turing-complete interpreters in anything that handles untrusted input, but the web and all of those fuarrrking entrepreneurs who saw it as a business opportunity fuarrrked that up, so now we have pdfs and javascript and complex image formats.

Don't remember the details, but there was a JavaScript POC in wake of meldowns and spectres allowing to read arbitrary memory locations. Which means you can access whatever is in your memory without js/browser/os exploits. Pretty sure, it had a kludgy patch applied for a fix. But with such nasty cpu bugs running arbitrary code from the interwebz sound even less fail safe than ever.

>>7184 Thank you for clarifying. >>7185 Dear fuarrrk...that's frightening. Isn't that primarily on Intel CPUs though? I use AMDs and always have....not to say they're perfect obviously but less vulnerable at least?

>>7187 You're probably still vulnerable. See: https://react-etc.net/entry/exploiting-speculative-execution-meltdown-spectre-via-javascript Honestly, the practical difference between Intel and AMD is significantly less than 4chan's /g/ would like you to believe. That said, a) most modern browsers shouldn't still be vulnerable, and b) I question how effective those attacks would be outside of a lab scenario. I see a LOT of theoretical or complex attacks that get traction, but nobody uses them in practice because they're costly and unreliable.