Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/24/2013
05:26 PM
50%
50%

WhiteHat Security Releases Web Browser To Fight Off Ads, Tracking

WhiteHat's Aviator browser promises better privacy online

WhiteHat Security has been involved in trying to secure the Web for more than a decade. But earlier this week, the company made a move to come at security from a different angle -- through the Web browser itself. The company pulled the covers off of a beta version of its own Web browser, nicknamed Aviator. Available as a free download, the browser's focus can be summed up in two words: privacy and security.

"Browser security has been a topic that both [WhiteHat security director of product management] Robert Hansen and I have been discussing publicly for years now," said WhiteHat CTO Jeremiah Grossman, in an email. "Many people ask us what browser we use, and our answer has always been 'my own.' That browser is Aviator. It is a browser that we feel confident in using not only for our own security and privacy, but one that we can now confidently recommend to family and friends when they ask. So, in that sense, it has been an internal, personal project for years."

In announcing Aviator, Hansen argued that the major browser vendors choose not to make changes that could run the risk of hurting their market shares or ability to make money, particularly when it comes to online ads.

"Pop-up blockers used to work wonders, but advertisers have switched to sourcing in JavaScript and actually putting content on the page," Hansen said. "They no longer have to physically create a new window because they can take over the entire page. Using Aviator, the user's browser doesn't even make the connection to Google's advertising servers, so obnoxious or potentially dangerous ads simply don't load. Aviator uses an extension called Disconnect, which doesn't block every ad in the world, but it does block enough that it's a significant improvement in both speed and safety."

The browser has been designed by default to run in a "private mode" that purges any cookies being stored when the browser is restarted. The browser has also made plug-ins such as Adobe Flash Player and Java click-to-play to limit their use in the name of tracking and malware attacks.

"A large percentage of malware is distributed through Java or Flash exploits via drive-by attacks," Hansen explained. "Often sites are compromised and malicious content is sourced in or is sometimes distributed through ad networks. By allowing the content to be load-only when the user wants, as opposed to at the whim of whoever has developed the Web page, it reduces the likelihood of exploitation by a huge amount through those commonly used plug-ins."

The browser is built off of Chromium. Right now, Aviator works only on Macs, but support for Windows and other operating systems may come in the future.

"Because WhiteHat is primarily a Mac shop, this initial version is Mac OS X," Grossman explains. "The feedback so far has been very positive, and requests for a Windows, Linux, and even open-source versions are pouring in, so we are definitely determining where to focus our resources on what should come next. But there is no definite time frame yet of when other versions will be available."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27486
PUBLISHED: 2021-04-12
The Fatek Automation WinProladder Versions 3.3 and prior are vulnerable to an integer underflow, which may cause an out-of-bounds write and allow an attacker to execute arbitrary code.
CVE-2021-3465
PUBLISHED: 2021-04-12
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-15942
PUBLISHED: 2021-04-12
An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile.
CVE-2021-22190
PUBLISHED: 2021-04-12
A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token
CVE-2021-24024
PUBLISHED: 2021-04-12
A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files.