Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/24/2013
05:26 PM
50%
50%

WhiteHat Security Releases Web Browser To Fight Off Ads, Tracking

WhiteHat's Aviator browser promises better privacy online

WhiteHat Security has been involved in trying to secure the Web for more than a decade. But earlier this week, the company made a move to come at security from a different angle -- through the Web browser itself. The company pulled the covers off of a beta version of its own Web browser, nicknamed Aviator. Available as a free download, the browser's focus can be summed up in two words: privacy and security.

"Browser security has been a topic that both [WhiteHat security director of product management] Robert Hansen and I have been discussing publicly for years now," said WhiteHat CTO Jeremiah Grossman, in an email. "Many people ask us what browser we use, and our answer has always been 'my own.' That browser is Aviator. It is a browser that we feel confident in using not only for our own security and privacy, but one that we can now confidently recommend to family and friends when they ask. So, in that sense, it has been an internal, personal project for years."

In announcing Aviator, Hansen argued that the major browser vendors choose not to make changes that could run the risk of hurting their market shares or ability to make money, particularly when it comes to online ads.

"Pop-up blockers used to work wonders, but advertisers have switched to sourcing in JavaScript and actually putting content on the page," Hansen said. "They no longer have to physically create a new window because they can take over the entire page. Using Aviator, the user's browser doesn't even make the connection to Google's advertising servers, so obnoxious or potentially dangerous ads simply don't load. Aviator uses an extension called Disconnect, which doesn't block every ad in the world, but it does block enough that it's a significant improvement in both speed and safety."

The browser has been designed by default to run in a "private mode" that purges any cookies being stored when the browser is restarted. The browser has also made plug-ins such as Adobe Flash Player and Java click-to-play to limit their use in the name of tracking and malware attacks.

"A large percentage of malware is distributed through Java or Flash exploits via drive-by attacks," Hansen explained. "Often sites are compromised and malicious content is sourced in or is sometimes distributed through ad networks. By allowing the content to be load-only when the user wants, as opposed to at the whim of whoever has developed the Web page, it reduces the likelihood of exploitation by a huge amount through those commonly used plug-ins."

The browser is built off of Chromium. Right now, Aviator works only on Macs, but support for Windows and other operating systems may come in the future.

"Because WhiteHat is primarily a Mac shop, this initial version is Mac OS X," Grossman explains. "The feedback so far has been very positive, and requests for a Windows, Linux, and even open-source versions are pouring in, so we are definitely determining where to focus our resources on what should come next. But there is no definite time frame yet of when other versions will be available."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31458
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...