Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/24/2013
05:26 PM
50%
50%

WhiteHat Security Releases Web Browser To Fight Off Ads, Tracking

WhiteHat's Aviator browser promises better privacy online

WhiteHat Security has been involved in trying to secure the Web for more than a decade. But earlier this week, the company made a move to come at security from a different angle -- through the Web browser itself. The company pulled the covers off of a beta version of its own Web browser, nicknamed Aviator. Available as a free download, the browser's focus can be summed up in two words: privacy and security.

"Browser security has been a topic that both [WhiteHat security director of product management] Robert Hansen and I have been discussing publicly for years now," said WhiteHat CTO Jeremiah Grossman, in an email. "Many people ask us what browser we use, and our answer has always been 'my own.' That browser is Aviator. It is a browser that we feel confident in using not only for our own security and privacy, but one that we can now confidently recommend to family and friends when they ask. So, in that sense, it has been an internal, personal project for years."

In announcing Aviator, Hansen argued that the major browser vendors choose not to make changes that could run the risk of hurting their market shares or ability to make money, particularly when it comes to online ads.

"Pop-up blockers used to work wonders, but advertisers have switched to sourcing in JavaScript and actually putting content on the page," Hansen said. "They no longer have to physically create a new window because they can take over the entire page. Using Aviator, the user's browser doesn't even make the connection to Google's advertising servers, so obnoxious or potentially dangerous ads simply don't load. Aviator uses an extension called Disconnect, which doesn't block every ad in the world, but it does block enough that it's a significant improvement in both speed and safety."

The browser has been designed by default to run in a "private mode" that purges any cookies being stored when the browser is restarted. The browser has also made plug-ins such as Adobe Flash Player and Java click-to-play to limit their use in the name of tracking and malware attacks.

"A large percentage of malware is distributed through Java or Flash exploits via drive-by attacks," Hansen explained. "Often sites are compromised and malicious content is sourced in or is sometimes distributed through ad networks. By allowing the content to be load-only when the user wants, as opposed to at the whim of whoever has developed the Web page, it reduces the likelihood of exploitation by a huge amount through those commonly used plug-ins."

The browser is built off of Chromium. Right now, Aviator works only on Macs, but support for Windows and other operating systems may come in the future.

"Because WhiteHat is primarily a Mac shop, this initial version is Mac OS X," Grossman explains. "The feedback so far has been very positive, and requests for a Windows, Linux, and even open-source versions are pouring in, so we are definitely determining where to focus our resources on what should come next. But there is no definite time frame yet of when other versions will be available."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3700
PUBLISHED: 2020-01-24
yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger defa...
CVE-2019-3699
PUBLISHED: 2020-01-24
UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version 3...
CVE-2019-3697
PUBLISHED: 2020-01-24
UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate from user gnump3d to root. This issue affects: openSUSE Leap 15.1 gnump3d version 3.0-lp151.2.1 and prior versions.
CVE-2019-3694
PUBLISHED: 2020-01-24
A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalate from user munin to root. This issue affects: openSUSE Factory munin version 2.0.49-4.2 and prior versions. openSUSE Leap 15.1 munin version 2.0.40-lp151.1.1 a...
CVE-2019-3693
PUBLISHED: 2020-01-24
A symlink following vulnerability in the packaging of mailman in SUSE SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. Th...