Thursday 8 June 2017

INSECURE BROWSER

The term "we", "our" and "us" refers to Snqzs' PG and Snqzs' PG developers.

I. Contents

  1. What does this message mean?
  2. What are the insecure browsers?
  3. What is the risk of using insecure browsers?
    • 3.1. WannaCry ransomware attack
    • 3.2. Risks of using an insecure browser
  4. How to resolve this problem?

Chapter 1: What does this message mean?

It means that your browser is not supported by its delevoper and will not recieve security patches should security flaws arise.

Chapter 2: What are the insecure browsers?

The term "insecure browser" is arbitary. For a notice to appear in our website (upcoming in UI v5.0), the browser have to be one of the following: 
  • Internet Explorer 10 and below
  • Firefox 51 and below
  • Opera 44 and below
  • Chrome 56 and below
What browser is still updated will depend on the developers. Do check on their website for more information.

Often, browsers that are not updated are considered insecure, as the program is not modified to fix any security bugs (unexpected defects, fault or flaws in the browser).

Chapter 3: What is the risk of using insecure browsers?

Outdated browsers have security bugs which allow malicious web developers to use algorithms to exploit these defects or imperfections to access all the data on your computer (Yes, that includes personal information) or remotely control your computer (Example: firing malicious code). These bugs are often called security holes, as they allow people to leak through and into your computer to get data. Below are real life examples of such people taking advantage of these holes to access one's computer.

Chapter 3.1: WannaCry ransomware attack

Have you heard of the case on the wannacry malware attack? This malware uses an exploit called EternalBlue, discovered by the National Security Agency (NSA), exploits a vulnerability in Microsoft's implementation of the Server Message Block (SMB) protocol, allowing someone to execute arbitrary code on a target computer. Wannacry is a ransomware that encrypts files on a victim's computer, rendering them inaccessable. Files can only be decrypted with a decryption key, which is held by the hacker in this case. The hacker will demand ransom to be payed in exchange of the decryption key, often in BitCoin (a cryptocurrency). It is not possible to guess a deryption key by brute force as, for example, an AES-256 key have 2 to the power of 256 possible combinations (that's about 57 896 044 618 658 097 711 785 492 504 343 953 926 634 992 332 820 282 019 728 792 003 956 564 819 968 [Try and read this haha: Fifty-seven quattuorvigintillion, eight hundred and ninety-six trevigintillion, forty-four duovigintillion, six hundred and eighteen unvigintillion, six hundred and fifty-eight vigintillion, ninety-seven novemdecillion, seven hundred and eleven octodecillion, seven hundred and eighty-five septendecillion, four hundred and ninety-two sexdecillion, five hundred and four quindecillion, three hundred and forty-three quattuordecillion, nine hundred and fifty-three tredecillion, nine hundred and twenty-six duodecillion, six hundred and thirty-four undecillion, nine hundred and ninety-two decillion, three hundred and thirty-two nonillion, eight hundred and twenty octillion, two hundred and eighty-two septillion, nineteen sextillion, seven hundred and twenty-eight quintillion, seven hundred and ninety-two quadrillion, three trillion, nine hundred and fifty-six billion, five hundred and sixty-four million, eight hundred and nineteen thousand, nine hundred and sixty-eight] possible combinations!). The victim often have to re-do the project that they have lost or restore from backup. Microsoft had released a security update 2 months prior to the attack, but many users had not updated which results in this ransomware's attack.
- To be continued -

Chapter 3.2: Abuse of keyloggers

You can read about Keyloggers and how it can be abused here: https://securelist.com/keyloggers-how-they-work-and-how-to-detect-them-part-1/36138/

The term "Keylogger" refers to a feature for programs which monitor all the keystrokes you've pressed on your computer. It also can be referred to a device with similar functions. 

Many programs used this feature to track keyboard inputs to create keyboard shortcuts in games and other programs to make using their programs more convenient. However, there 
- To be continued -

Chapter 4: How to resolve this problem?

If you are using an insecure browser, the best way is to upgrade your browser. If you are unable to do so, because it is not compatible with your Operating System (OS), you may need to upgrade your OS. If your computer does not meet the system requirements, you may need a new computer. Do note that technology had changed a lot since 2000, and therefore computers built in 2000 - 2010s may be obsolete now.

- This page is still under construction -

No comments:

Post a Comment