Sunday, October 13, 2024
HomeCyber Security NewsBrave New Privacy Feature to Limit Website Access to Local Resources

Brave New Privacy Feature to Limit Website Access to Local Resources

Published on

Malware protection

Brave version of 1.54 for desktop and Android will include more powerful features for controlling which sites can access local network resources and for how long.

Malicious requests from websites to access local host resources act as a fingerprinting technique which concerns users’ privacy and security at risk.

The conventional desktop version of web browsers like Chrome, safari, firefox, Mozilla, etc., allows secure and nonsecure public sites to access your local host resources.

- Advertisement - SIEM as a Service

Local host resources are nothing but images and web pages that are hosted by other software on your local machine.

Reason to Access Local Host Resources:

Browsers allow websites to access localhost resources for various reasons, but the main two reasons are historical legacy and backward compatibility.

Brave New Privacy Feature
Access Local Resource. Image Credits brave

Generally, browsers did not strictly enforce the distinctions between first-party resources (those hosted by the website you’re visiting), third-party resources (those hosted on other public websites), and local-host resources due to a decreased concern for user privacy.

Due to this vulnerability, a significant amount of software has been created to be freely accessible via websites that are invisible to users.

And many of these uses are acceptable. Examples include specific cryptocurrency wallets, security software offered by banks or security firms, and gear whose configuration uses specific Web interfaces.

Unfortunately, a large variety of harmful, user-harming software on the Internet makes use of access to local-host resources for illicit purposes. 

To re-identify you, for instance, fingerprinting scripts look for specific patterns in the other software you have operating on your device. 

Other scripts look for weak or susceptible software on the system and attempt to attack.

About Brave:

Unlike other browsers, Brave puts you in control of your data. The secure browser automatically blocks trackers and unwanted ads while also providing anti-phishing and anti-malware protection.

Brave is the only popular browser to ship multiple protections against sites maliciously accessing localhost resources. Brave currently uses filter list rules to:

  • Block scripts are known to maliciously scan localhost resources
  • Block requests from public sites to localhost resources

Brave has developed a new approach for protecting users against sites abusing local network resources. This new system will have the following parts:

  • Requests to localhost resources from a localhost context are allowed automatically; Brave does not block a locally hosted page from accessing other locally hosted resources.
  • Brave will continue to use filter list rules to block scripts and sites known to abuse localhost resources.
  • Brave will include a new permission called the “localhost” permission. Only sites with this permission will be able to make sub-resource requests to local-host resources. By default, no sites have this permission, and, importantly, most sites have no way to prompt users for this permission. However, advanced users can use the existing site settings interface to grant sites this permission. 
  • Brave will also include a list of trusted sites, or sites known to access localhost resources for user-benefiting reasons. The first time a site on this list initiates a sub-request to a localhost resource, it will trigger a permission prompt of the previously mentioned localhost permission. This list is publicly available and will be maintained by Brave.

Furthermore, Brave enhances its protections deeper in the network stack, so that Brave can protect users against additional, less common methods of sites making localhost requests (including DNS records that refer to localhost).

“AI-based email security measures Protect your business From Email Threats!” – .

Latest articles

Threat Actor ProKYC Selling Tools To Bypass Two-Factor Authentication

Threat actors are leveraging a newly discovered deepfake tool, ProKYC, to bypass two-factor authentication...

Mozilla Warns Of Firefox Zero-Day Actively Exploited In Cyber Attacks

A critical use-after-free vulnerability affecting Firefox and Firefox Extended Support Release (ESR) is being...

SpyCloud Embeds Identity Analytics in Cybercrime Investigations Solution to Accelerate Insider and Supply Chain Risk Analysis & Threat Actor Attribution

IDLink, SpyCloud’s new automated digital identity correlation capability, is now core to its industry-leading...

Abusix and Red Sift Form New Partnership, Leveraging Automation to Mitigate Cyber Attacks

The agreement has marked over 600,000 fraudulent domains for takedown in just two months...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Threat Actor ProKYC Selling Tools To Bypass Two-Factor Authentication

Threat actors are leveraging a newly discovered deepfake tool, ProKYC, to bypass two-factor authentication...

Hackers Exploiting Zero-day Flaw in Qualcomm Chips to Attack Android Users

Hackers exploit a zero-day vulnerability found in Qualcomm chipsets, potentially affecting millions worldwide.The flaw,...

Foxit PDF Reader Vulnerability Let Attackers Execute Arbitary Code

Researchers recently disclosed six new security vulnerabilities across various software, as one critical vulnerability...