Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/24/2013
05:26 PM
50%
50%

WhiteHat Security Releases Web Browser To Fight Off Ads, Tracking

WhiteHat's Aviator browser promises better privacy online

WhiteHat Security has been involved in trying to secure the Web for more than a decade. But earlier this week, the company made a move to come at security from a different angle -- through the Web browser itself. The company pulled the covers off of a beta version of its own Web browser, nicknamed Aviator. Available as a free download, the browser's focus can be summed up in two words: privacy and security.

"Browser security has been a topic that both [WhiteHat security director of product management] Robert Hansen and I have been discussing publicly for years now," said WhiteHat CTO Jeremiah Grossman, in an email. "Many people ask us what browser we use, and our answer has always been 'my own.' That browser is Aviator. It is a browser that we feel confident in using not only for our own security and privacy, but one that we can now confidently recommend to family and friends when they ask. So, in that sense, it has been an internal, personal project for years."

In announcing Aviator, Hansen argued that the major browser vendors choose not to make changes that could run the risk of hurting their market shares or ability to make money, particularly when it comes to online ads.

"Pop-up blockers used to work wonders, but advertisers have switched to sourcing in JavaScript and actually putting content on the page," Hansen said. "They no longer have to physically create a new window because they can take over the entire page. Using Aviator, the user's browser doesn't even make the connection to Google's advertising servers, so obnoxious or potentially dangerous ads simply don't load. Aviator uses an extension called Disconnect, which doesn't block every ad in the world, but it does block enough that it's a significant improvement in both speed and safety."

The browser has been designed by default to run in a "private mode" that purges any cookies being stored when the browser is restarted. The browser has also made plug-ins such as Adobe Flash Player and Java click-to-play to limit their use in the name of tracking and malware attacks.

"A large percentage of malware is distributed through Java or Flash exploits via drive-by attacks," Hansen explained. "Often sites are compromised and malicious content is sourced in or is sometimes distributed through ad networks. By allowing the content to be load-only when the user wants, as opposed to at the whim of whoever has developed the Web page, it reduces the likelihood of exploitation by a huge amount through those commonly used plug-ins."

The browser is built off of Chromium. Right now, Aviator works only on Macs, but support for Windows and other operating systems may come in the future.

"Because WhiteHat is primarily a Mac shop, this initial version is Mac OS X," Grossman explains. "The feedback so far has been very positive, and requests for a Windows, Linux, and even open-source versions are pouring in, so we are definitely determining where to focus our resources on what should come next. But there is no definite time frame yet of when other versions will be available."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32615
PUBLISHED: 2021-05-13
Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
CVE-2021-33026
PUBLISHED: 2021-05-13
The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the ca...
CVE-2021-31876
PUBLISHED: 2021-05-13
Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a loss of funds, or a denial of service attack against downstream projects such as Lightning network nodes. An unconfirmed child transaction with ...
CVE-2019-10062
PUBLISHED: 2021-05-13
The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attri...
CVE-2020-23995
PUBLISHED: 2021-05-13
An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload.