An attacker can also target an application that the browser uses to properly render a website. For example, an attacker can attack RealPlayer, QuickTime, or even the victim's antivirus program.
Defense against these types of threats should always focus on educating users not to click on links from strangers and to be wary of certificate errors. Security managers should spend some time considering which websites users need to go to do their jobs. Also consider developing a white-list approach to user Web access. The filtering would permit users to only access websites that are approved, while blocking everything else.
This was first published in October 2008