Hacker News Reader

Comment by talklittle | Hacker News Reader

Yes it sounds like it's primarily about the Java browser plugin, based on the examples in the article.

> Most legitimate Websites will not use hidden or obfuscated JavaScript, and few will redirect users without authorization, he explained.

Those make sense as example heuristics for detecting malware-serving sites. What part doesn't make sense? I don't know of legitimate websites that obfuscate their JS. (Minification doesn't count.) Presumably they've found malware websites in the wild that obfuscate.

Redirecting users in a jarring way is something malware sites actually do. Like going to example.com and it immediately redirects you to adsfa8sdjfa9sd8jfasd.com. The security guy isn't saying redirects are categorically bad, just that it's another heuristic that raises the chance you're currently viewing a malicious site.

View on HN

> I don't know of legitimate websites that obfuscate their JS. (Minification doesn't count.)

What exactly is the difference between obfuscation and minimization? Could you write a program to tell the difference between a JS file that's been benevolently minified versus maliciously obfuscated? For that matter, how do humans tell the difference between minification and obfuscation?

I think that, if you define "obfuscation" as "transforming source code into a less readable form," then most automatic program transformations -- especially those specifically intended to reduce the size of the resulting code -- will also be obfuscations.

Of course, if only malware authors would make their products comply with RFC 3514, these problems would go away; security sandboxes and antimalware programs could simply and effectively filter based on the intent of a program's author, rather than static or dynamic analysis of the program's code [1].

[1] http://tools.ietf.org/html/rfc3514

> What part doesn't make sense?

The part where the article is about Java security vulnerabilities and instead switches to talking about JavaScript, as if they were the same thing?

I get the difference and don't need the education. I was wondering what this had to do with Java. If you care to explain that, I'll be happy to hear it ;)

> At the top of the list is a need for some form of behavior detection that monitors a user's chain of events before they land on an exploit. "For example, is a user requesting a Web page that included obfuscated JavaScript, and is the user being redirected?" Gundert asked.

The article is about Java exploits, and then they discuss the potential to recognize what happens before the payload is delivered.

If the web page includes obfuscated JavaScript, and the user is then redirected, that could be a sign that a (probably Java) exploit is in the user's near future.

> If the web page includes obfuscated JavaScript

Ok, but how do you know that "obfuscated JavaScript" is "bad"? I obfuscate all of my javascript, it's called minimization, that's now inherently bad?

Maybe browsers should require approval of redirects? Or make it an option? I mean that technique could apply to any sort of browser plugin (flash, or anything, not just java), what does obfuscated JavaScript have to do with redirects or Java in particular? The article is just being dishonest. I don't disagree that the Java plugin has had issues, but JavaScript redirects have nothing to do with it.

Don't get me wrong, there are tons of inherent risks to the online experience, but let's not make shit up at the same time! Which is what it seems this article does.

Reply on news.ycombinator.com