Slashdot Mirror
80% of Browsers Found To Be At Risk of Attack
CWmike writes "About eight out of every 10 Web browsers run by consumers are vulnerable to attack by exploits of already-patched bugs, a security expert said Thursday. The poor state of browser patching stunned Wolfgang Kandek, CTO of Qualys, which presented data from the company's free BrowserCheck service Wednesday at RSA. 'I really thought it would be lower,' Kandek said. BrowserCheck scans Windows, Mac and Linux machines for vulnerable browsers, as well as up to 18 browser plug-ins, from Adobe's Flash to Windows Media Player. When browsers and plug-ins are tabulated together, between 90% and 65% of all consumer systems scanned with BrowserCheck since June 2010 reported at least one out-of-date component. In January 2011, about 80% of the machines were vulnerable. The most likely plug-in to require a patch: same as last year, Oracle's Java."
Not getting enough hits? Slashvertisement can work for your company too. Call today!
So, you got to install a plug-in to check if your other plug-ins are secure. Maybe the browsercheck plug-in isn't secure. People need to update their software for security. That's not news.
Since new exploits are identified each day.
Sometimes the light at the end of the tunnel is the headlight of an oncoming train.
The exact percentage of IE marketshare?
Orwell was an optimist.
So first I needed to enable javascript for the site. Now it wants me to allow some random website to install a plugin so that it can tell me if my security is up to date... yeah if it can't detect a security vulnerability without me going through a bunch of hoops and ALLOWING it to install on my system, I'm going with the whole thing is BS.
Java was supposed to run in its own sandbox and therefore wouldn't be a security issue according to the original SUN PR bullshit.
Kiddies, remember, in the future someone will say "we have a write once run everywhere language that is secure!" and you can look back on Java and say, "Nuh ahh! It existed before!" and then when you post on the future version of Slashdot pointing this fact out, you will be modded down - just like the people who pointed out that BASIC was supposed to be write once - run everywhere and that didn't pan out.
History repeats itself - especially in IT.
Remember that when you think you're smarter than others .....
Didn't proof read b/c Slashdot's scripts are too goddam slow!
So eight out of 10 browsers running the test failed it? That's not terribly surprising, since I have to install a plugin to run the test.
I don't know Qualys from Quantas, so I'm highly unlikely to install their plugin just to find out whether my browser has vulnerabilities. In fact, I'm not terribly likely to install any plugins at all (though I'm enjoying Ghostery immensely).
Now, let's assume for a moment that I'm the type to install any plugin that asks nicely and looks shiny. Gee, is it any surprise that Qualys' plugin isn't the first one I've accepted? And is it any surprise that I've got other issues?
This test suffers from a terrible self-selection bias. Those most likely to take the "test" are the ones most likely to fail it.
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
Whew, doesn't look like there are any Lynx vulnerabilities so I'm safe!
Monstar L
I guess this means that my browser passed:
Perhaps people would be more keen to update their Java version if the installer didn't keep trying to spring a surprise 'Install Yahoo! Toolbar' move on them on EVERY patch.
One issue with Java seems to be that it keeps old versions (or at least it used to). I used a laptop at work that had been in the cupboard for half a year. It had (roughly, can't remember exactly): Java 1.5 update 12 - Java 1.6 - Java 1.6 update 2 - Java 1.6 update 3 - Java 1.6 update 6 - Java 1.6 update 7. Why this is the case, I have no idea. Doesn't seem right though!
In my experience, your average user has a machine that is quite a few years old (end of life performance wise).
If pressure to upgrade was successful once, it long since passed the point where they needed to upgrade the OS and computer before they could update their browser.
Amidst the stability problems of a home computer that hasn't been formatted periodically (or ever), only select browsers (and only specific versions of them) can run successfully.
I've come across this a lot since the latest bout of cool features for web came along. It is difficult to fix the problems caused by lingering dated hardware.
My proposal: the One Macbook Per Child program.
The most likely plug-in to require a patch: same as last year, Oracle's Java."
Of course, this has nothing to do with the fact that new versions of Java tend to break existing java based applications and utilities. You can use the new version of Java, or you can use the older one that works with your mission critical enterprise tools.
You have to appreciate the irony that the test requires a plug-in. For all I know, the test is the virus. I assumed it would be a series of javascripts that tested vulnerabilities.
I wonder how much of this is due to vendors deliberately not bumping the version numbers when they put in a security patch?
Check out my sci-fi/humor trilogy at PatriotsBooks.
I resisted the "Install Plugin" ruse. Consequently no vulnerability was found.
http://www.mozilla.com/plugincheck/
Why?
Because they make use of Windows Integrity Controls, a type of MAC which means if a low level process is exploited it has no access to the rest of the user account.
As much as people laud Opera they are really behind the fucking curve on this one, and I don't know what Mozilla's excuse is. With the excess beta's they really don't have one.
It should be noted out before hairyfeet gets in that while Firefox and Opera do not make use of WIC, this is not the same as running a browser as root and leaving the whole system vulnerable as he has tried to state before. If you run as a basic user and keep your browser up to date then you are reasonable secure, just not as secure as Chrome or IE in the event of an attack.
On linux it is a different story, as with SELINUX, RSBAC, Grsecurity or any of the other frameworks you can restrict the helper processes as you see fit, and restrict excatly what directories or objects they have write read or execute permission to. It would be nice if the browser makers hopped on board and added some native support though.
If you ignore ACs because they are anonymous - you're an idiot.
With a heading like this, too much is left to the imagination, I thought 80% of browsers out there in use are vulnerable, and if that is all, I would say redundancy is useless. Stating the obvious, such as any application made by man, will be error prone....so any browser running out there, is obviously flawed, no news here, move along...
I wonder what the percentages are for corporate users compared with home users. I bet home users are better: My current employer requires out machines to have a *particular* version of Java installed. The internal corporate web site doesn't work on anything newer, or older. Unfortunately this seems to be the norm, not the exception.
I'm constantly amazed at how these internal apps are some of the poorest maintained software. Training applications, time sheets, desktop sharing, CRMs ... consistently the poorest quality tools I encounter.
Qualys BrowserCheck is not supported with your current browser, operating system or both. See supported versions below.
And now? Am I safe?
Simple patch updates have serious regression issues, such that extensions no longer work. I've been stuck on a particular version for months now, because one of my extensions won't work with the new version, and this has NEVER been addressed, either by Mozilla or the extension developer.
For fuck sake, if you want me to update, don't fuck my shit up..
That's what the header of their web page says. Oh sure. I'll do that right away.
I've been saying this for some time: Windows (and to a lesser extent OS X) needs an API so updates are centralised, configured and installed from a single interface.
OS X has the app store. Linux distributions have repositories. Both of these solve this problem very neatly, and it's a lot easier to keep everything up to date. But I don't think centralised distribution is necessary - just an API call so you can say to the operating system "this is the name of the application, this is an RSS feed where updates are published, this is the key with which updates will be signed, this is how frequently you should check for updates" would probably solve most of the problems.
The mess we have right now is the reason why there is always something on a PC that needs updating.
Java is a horrible piece of crap when updating. I've been running it on Vista and now Windows 7 for ages and the auto update NEVER WORKS. I have to manually update every time. It's really squarely Java's fault. Also if anyone happens to know how to fix it I always get "Failed to download required installation files.". I've had no luck in trying to find the cause of it.
Java and Adobe's problem is the same - it asks permission to update instead of doing it silently. Heck, the last Reader update required a system reboot. Compare that to AdBlock or NoScript, which updates without you having to do anything and lets you know after the fact. I can force out Windows updates on the systems I manage, but I can't force users to update their Java, and the icon will sometimes sit there for weeks or months before they even bother to mention it.
Occasionally living proof of the Ballmer peak.
Well, that was a surprise: I've been checking Adobe almost weekly for updates to Acrobat Reader 9.4 for Linux. Adobe's web site always tells me it's the latest. But this tool directs me to Adobe's FTP (not HTTP) where I find--low and behold--there is a 9.4.1 and it's been out since September. So what's wrong with Adobe's download? Lazy site maintenance? As for Java, I also check this weekly. Last Monday, the 14th, the latest was 1.6.0_22. Today I see that 1.6.0_23 was released on the 14th. I'm pleased. Besides, this patching beats working. :)
I went to the Browser Check link and was told that I have to enable Java and refresh the page. So to check my browsers security I first have to lower my current security settings? Now I see how they got their numbers.
to stay away from web sites that steal their data.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
Use Secunia PSI to auto-update your software, including many commonly used plugins:
http://secunia.com/vulnerability_scanning/personal/
Anyone who imagines we've found all the exploits already is a moron.
If you have Flash installed via nspluginwrapper, it shows two Flash entries, one saying "10.2.152 Up to Date", but the other saying "10.2 Potential Threat", with an explanation that it couldn't figure out the version precisely enough to be sure what it was. It counts this as a security threat. So that's a false positive right there.
100% of machines used by idiots are at risk of attack when they try to claim their prize for being the 1000th visitor.
What do I know, I'm just an idiot, right?
"About eight out of every 10 Web browsers run by consumers are vulnerable to attack [CC] by exploits of already-patched bugs, a security expert said Thursday.
The venue is worth a mention: RSA Conference 2011 - San Francisco
This not a second-tier event.
Speakers include former President Bill Clinton, General Keith B. Alexander, Commander, U.S. Cyber Command, William Lynn III, Deputy Secretary of Defense...
In Open Source from Qualys:
BlindElephant Web Application Fingerprinter
If it gives you an error when you try to run it, does that mean that you are secure or vulnerable?
So in order to test my system, I need to re-enable javascript, cookies and plugins and download an unknown untrusted plugin?
I'm afraid I must decline...
I tried the Qualys BrowserCheck. It misidentified the Mozilla browser version and the Java Runtime version and claimed they were old versions with vulnerabilities. In fact the browser is the latest version and JRE is a newer version without known vulnerabilities. It correctly identified the Flash version but failed to notify me that simply running Flash makes my entire www experience one huge vulnerability in itself ha ha ha.
It's worth remembering that an OS with system-wide package management almost negates these kinds of issues anyway (though browser plug-ins may remain a problem depending on how you obtained them).
Lame product unless you're that rare person who runs Windows and cares about security but also keeps forgetting to do anything about it.
what exactly do they "consume" using a web browser? ...
I doubt I can actually download food
Mozilla has a free plugin check that you can use to see not only if you're up to date on the most common plugins but also if any of yours that are out of date suffer from an known exploit you should fix immediately. It's free, and there's no extra plugin (yeah, BrowserCheck...what the) to install: http://www.mozilla.com/en-US/plugincheck/.
R.Mo
I didn't have to install a plug-in to run the check as some have said below.. Over and out on three Mac browsers in two or three minutes.
Only naive browser users would install a plug-in from a random web site to test the security of their plug-ins. It's a self-selecting statistical sampling and we know the value of those. I'm surprised their results aren't 95%, but it says nothing about the vulnerability of the population of browser users.
And I'm a Java dev, both at work and for fun.
Java doesn't have its place in a browser. Applets are the lamest joke ever, only seconded by the abysmal failure that JWS is.
And I do like Java a lot, I really do. Simply I *never* use a Java enabled browser and I'm not missing much.
I realized browser would always have security holes something like, say, five years ago (I know, I'm lame, I should have understood that with Netscape back in the 20th century).
So what do I do? I surf using throwaway accounts. It's trivial to set up on Linux, where you can install a browser in one user account, without needing to be root. So I've got my main user account and several "browsing" account. The slashdot/theregister/news/whatever account is called "/home/tmp/" and I erase it at each reboot.
Then I've got my "personal data" browser which I use for GMail + Google Docs + managing my domains etc.
Then I've got my Java developer account : on Linux you can install Java without needing to be root (on Windows you *must* be admin to install Java). So user "a" can have Java (JRE/JDK) and user "tmp" only has a browser and does *not* "see" the Java from user "a".
And because Linux / X11 allows to display applications from another user, I simply display window of user "/home/tmp/" on one of my virtual desktop.
For shitty Windows-only-bug-ridden-bullshit that I need to try once in a while, I've got a KVM with Windows XP that I "kill -9" and reimage once I'm done with it.
The only safe browser is one that you can throwaway.
Try it: there are amazingly few websites where you need your real identity (AC on /., fake identity on StackOverflow, etc.). For all the stuff that where don't need my real identity, I surf from the "tmp-throwaway-reimageable" account.
godel_56 beat me to it: Use JavaRa to get rid of old installations of Java. However, Sun/Oracle wised up a bit and current versions of Java have this issue fixed --If memory serves me right. No more crap left over when updating _fresh installs of current JRE_.
2019 is going to be the year of Linux on the desktop.
And luckily I can do without it in most cases. I only know one website that uses it, and unfortunately a few of our intranet applications :-(
I just don't understand why one of the biggest software companies is not able to program an update mechanism that works. Microsoft can do it, Google can do it, Mozilla can do it, Debian/Ubuntu etc have mastered it. But neither Sun nor Oracle get anywhere with their solution.
the biggest problem with this scan is that it assumes updates are always to patch over security vulnerabilities, and thus an old plugin is vulnerable to exploitation.
"Browser Check Complete Congratulations! You passed Qualys BrowserCheck. We recommend you scan your browser regularly to stay up to date with the latest versions and plugins." Well, that certainly was uneventful
In fact, your works in software are so superior to this very useful tool, that nobody even knows what it is you've done (which is pretty much zero), right? Until you've done something yourself, your jealous little bullshit is best kept to yourself, because it's what you appear to be: A jealous done-nothing with himself in this life blowhard.
My browser is "Unsupported". So I guess according to this tool, the exploits must be unsupported in my browser too!