Q

Do WebKit exploits escalate risk of Web browser attacks?

The WebKit framework suffers from several vulnerabilities that can be exploited to conduct Web browser attacks. Expert Michael Cobb discusses the risk.

Can you comment on the security issues related to the WebKit framework? It was exploited in a variety of attacks or proof-of-concept demonstrations in the past year, but to what extent is it a concern for enterprises in regard to Web browser attacks?

WebKit is an open source Web browser layout engine designed to enable Web browsers to render webpages, follow links, manage a back-forward list and a history of recently visited pages. WebKit is used in Google Chrome and Apple Safari, which together have more than 20% of the browser market. It is also used in the Silk browser included with Amazon’s new Kindle Fire tablet, as well as the browsers in the iOS, BlackBerry, Symbian and Android mobile operating systems. Applications on a variety of platforms use it to render email messages that include HTML such as Apple's email client Mail on the Mac and Microsoft's Entourage personal information manager.

A large number of security vulnerabilities were recently discovered in the WebKit browser and JavaScript engines, enabling WebKit exploits. If anyone using a browser based on WebKit was tricked into viewing a malicious website, a remote attacker could exploit a variety of flaws, including cross-site scripting attacks, denial-of-service attacks, and unexpected application termination or arbitrary code execution.

Ubuntu recently fixed 22 vulnerabilities in the WebKit framework that's part of its operating system, while Apple has implemented new sandboxing techniques in the WebKit framework. (Sandboxing is a method of isolating a process and the resources it has access to in order to prevent any malicious or faulty code in it from interfering with other running processes and system resources.)

All browsers suffer from security vulnerabilities, and due to their complexity, this is unlikely to change anytime soon. The only difference with the security issues in WebKit is many users will be unaware they are even using a WebKit-based browser. WebKit is used in many mobile devices but this is not immediately apparent unless you do the research to fully understand how different devices provide the services they offer. Anyone responsible for running an enterprise IT infrastructure needs to be aware of which sub-components the devices they operate are running.

With any software that comes preinstalled on devices your enterprise manages, or that you subsequently install, it is imperative that you subscribe to the security alerts and updates provided by both the software and device vendors, as well as any related security forums to ensure you keep up to date with the latest vulnerabilities and patches. You can then take informed decisions and actions to keep your enterprise secure.

This was first published in December 2011

Dig deeper on Web Server Threats and Countermeasures

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close