Friday, June 14, 2024

Brave New Privacy Feature to Limit Website Access to Local Resources

Brave version of 1.54 for desktop and Android will include more powerful features for controlling which sites can access local network resources and for how long.

Malicious requests from websites to access local host resources act as a fingerprinting technique which concerns users’ privacy and security at risk.

The conventional desktop version of web browsers like Chrome, safari, firefox, Mozilla, etc., allows secure and nonsecure public sites to access your local host resources.

Local host resources are nothing but images and web pages that are hosted by other software on your local machine.

Reason to Access Local Host Resources:

Browsers allow websites to access localhost resources for various reasons, but the main two reasons are historical legacy and backward compatibility.

Brave New Privacy Feature
Access Local Resource. Image Credits brave

Generally, browsers did not strictly enforce the distinctions between first-party resources (those hosted by the website you’re visiting), third-party resources (those hosted on other public websites), and local-host resources due to a decreased concern for user privacy.

Due to this vulnerability, a significant amount of software has been created to be freely accessible via websites that are invisible to users.

And many of these uses are acceptable. Examples include specific cryptocurrency wallets, security software offered by banks or security firms, and gear whose configuration uses specific Web interfaces.

Unfortunately, a large variety of harmful, user-harming software on the Internet makes use of access to local-host resources for illicit purposes. 

To re-identify you, for instance, fingerprinting scripts look for specific patterns in the other software you have operating on your device. 

Other scripts look for weak or susceptible software on the system and attempt to attack.

About Brave:

Unlike other browsers, Brave puts you in control of your data. The secure browser automatically blocks trackers and unwanted ads while also providing anti-phishing and anti-malware protection.

Brave is the only popular browser to ship multiple protections against sites maliciously accessing localhost resources. Brave currently uses filter list rules to:

  • Block scripts are known to maliciously scan localhost resources
  • Block requests from public sites to localhost resources

Brave has developed a new approach for protecting users against sites abusing local network resources. This new system will have the following parts:

  • Requests to localhost resources from a localhost context are allowed automatically; Brave does not block a locally hosted page from accessing other locally hosted resources.
  • Brave will continue to use filter list rules to block scripts and sites known to abuse localhost resources.
  • Brave will include a new permission called the “localhost” permission. Only sites with this permission will be able to make sub-resource requests to local-host resources. By default, no sites have this permission, and, importantly, most sites have no way to prompt users for this permission. However, advanced users can use the existing site settings interface to grant sites this permission. 
  • Brave will also include a list of trusted sites, or sites known to access localhost resources for user-benefiting reasons. The first time a site on this list initiates a sub-request to a localhost resource, it will trigger a permission prompt of the previously mentioned localhost permission. This list is publicly available and will be maintained by Brave.

Furthermore, Brave enhances its protections deeper in the network stack, so that Brave can protect users against additional, less common methods of sites making localhost requests (including DNS records that refer to localhost).

“AI-based email security measures Protect your business From Email Threats!” – .

Website

Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles