Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/24/2013
05:26 PM
50%
50%

WhiteHat Security Releases Web Browser To Fight Off Ads, Tracking

WhiteHat's Aviator browser promises better privacy online

WhiteHat Security has been involved in trying to secure the Web for more than a decade. But earlier this week, the company made a move to come at security from a different angle -- through the Web browser itself. The company pulled the covers off of a beta version of its own Web browser, nicknamed Aviator. Available as a free download, the browser's focus can be summed up in two words: privacy and security.

"Browser security has been a topic that both [WhiteHat security director of product management] Robert Hansen and I have been discussing publicly for years now," said WhiteHat CTO Jeremiah Grossman, in an email. "Many people ask us what browser we use, and our answer has always been 'my own.' That browser is Aviator. It is a browser that we feel confident in using not only for our own security and privacy, but one that we can now confidently recommend to family and friends when they ask. So, in that sense, it has been an internal, personal project for years."

In announcing Aviator, Hansen argued that the major browser vendors choose not to make changes that could run the risk of hurting their market shares or ability to make money, particularly when it comes to online ads.

"Pop-up blockers used to work wonders, but advertisers have switched to sourcing in JavaScript and actually putting content on the page," Hansen said. "They no longer have to physically create a new window because they can take over the entire page. Using Aviator, the user's browser doesn't even make the connection to Google's advertising servers, so obnoxious or potentially dangerous ads simply don't load. Aviator uses an extension called Disconnect, which doesn't block every ad in the world, but it does block enough that it's a significant improvement in both speed and safety."

The browser has been designed by default to run in a "private mode" that purges any cookies being stored when the browser is restarted. The browser has also made plug-ins such as Adobe Flash Player and Java click-to-play to limit their use in the name of tracking and malware attacks.

"A large percentage of malware is distributed through Java or Flash exploits via drive-by attacks," Hansen explained. "Often sites are compromised and malicious content is sourced in or is sometimes distributed through ad networks. By allowing the content to be load-only when the user wants, as opposed to at the whim of whoever has developed the Web page, it reduces the likelihood of exploitation by a huge amount through those commonly used plug-ins."

The browser is built off of Chromium. Right now, Aviator works only on Macs, but support for Windows and other operating systems may come in the future.

"Because WhiteHat is primarily a Mac shop, this initial version is Mac OS X," Grossman explains. "The feedback so far has been very positive, and requests for a Windows, Linux, and even open-source versions are pouring in, so we are definitely determining where to focus our resources on what should come next. But there is no definite time frame yet of when other versions will be available."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15132
PUBLISHED: 2019-08-17
Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses (e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocki...
CVE-2019-15133
PUBLISHED: 2019-08-17
In GIFLIB before 2019-02-16, a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp in dgif_lib.c if the height field of the ImageSize data structure is equal to zero.
CVE-2019-15134
PUBLISHED: 2019-08-17
RIOT through 2019.07 contains a memory leak in the TCP implementation (gnrc_tcp), allowing an attacker to consume all memory available for network packets and thus effectively stopping all network threads from working. This is related to _receive in sys/net/gnrc/transport_layer/tcp/gnrc_tcp_eventloo...
CVE-2019-14937
PUBLISHED: 2019-08-17
REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to compromise all data.
CVE-2019-13069
PUBLISHED: 2019-08-17
extenua SilverSHielD 6.x fails to secure its ProgramData folder, leading to a Local Privilege Escalation to SYSTEM. The attacker must replace SilverShield.config.sqlite with a version containing an additional user account, and then use SSH and port forwarding to reach a 127.0.0.1 service.