Slashdot Mirror
80% of Browsers Found To Be At Risk of Attack
CWmike writes "About eight out of every 10 Web browsers run by consumers are vulnerable to attack by exploits of already-patched bugs, a security expert said Thursday. The poor state of browser patching stunned Wolfgang Kandek, CTO of Qualys, which presented data from the company's free BrowserCheck service Wednesday at RSA. 'I really thought it would be lower,' Kandek said. BrowserCheck scans Windows, Mac and Linux machines for vulnerable browsers, as well as up to 18 browser plug-ins, from Adobe's Flash to Windows Media Player. When browsers and plug-ins are tabulated together, between 90% and 65% of all consumer systems scanned with BrowserCheck since June 2010 reported at least one out-of-date component. In January 2011, about 80% of the machines were vulnerable. The most likely plug-in to require a patch: same as last year, Oracle's Java."
Not getting enough hits? Slashvertisement can work for your company too. Call today!
So, you got to install a plug-in to check if your other plug-ins are secure. Maybe the browsercheck plug-in isn't secure. People need to update their software for security. That's not news.
Since new exploits are identified each day.
Sometimes the light at the end of the tunnel is the headlight of an oncoming train.
The exact percentage of IE marketshare?
Orwell was an optimist.
So first I needed to enable javascript for the site. Now it wants me to allow some random website to install a plugin so that it can tell me if my security is up to date... yeah if it can't detect a security vulnerability without me going through a bunch of hoops and ALLOWING it to install on my system, I'm going with the whole thing is BS.
So eight out of 10 browsers running the test failed it? That's not terribly surprising, since I have to install a plugin to run the test.
I don't know Qualys from Quantas, so I'm highly unlikely to install their plugin just to find out whether my browser has vulnerabilities. In fact, I'm not terribly likely to install any plugins at all (though I'm enjoying Ghostery immensely).
Now, let's assume for a moment that I'm the type to install any plugin that asks nicely and looks shiny. Gee, is it any surprise that Qualys' plugin isn't the first one I've accepted? And is it any surprise that I've got other issues?
This test suffers from a terrible self-selection bias. Those most likely to take the "test" are the ones most likely to fail it.
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
Perhaps people would be more keen to update their Java version if the installer didn't keep trying to spring a surprise 'Install Yahoo! Toolbar' move on them on EVERY patch.
One issue with Java seems to be that it keeps old versions (or at least it used to). I used a laptop at work that had been in the cupboard for half a year. It had (roughly, can't remember exactly): Java 1.5 update 12 - Java 1.6 - Java 1.6 update 2 - Java 1.6 update 3 - Java 1.6 update 6 - Java 1.6 update 7. Why this is the case, I have no idea. Doesn't seem right though!
The most likely plug-in to require a patch: same as last year, Oracle's Java."
Of course, this has nothing to do with the fact that new versions of Java tend to break existing java based applications and utilities. You can use the new version of Java, or you can use the older one that works with your mission critical enterprise tools.
http://www.mozilla.com/plugincheck/
I wonder what the percentages are for corporate users compared with home users. I bet home users are better: My current employer requires out machines to have a *particular* version of Java installed. The internal corporate web site doesn't work on anything newer, or older. Unfortunately this seems to be the norm, not the exception.
I'm constantly amazed at how these internal apps are some of the poorest maintained software. Training applications, time sheets, desktop sharing, CRMs ... consistently the poorest quality tools I encounter.
I've been saying this for some time: Windows (and to a lesser extent OS X) needs an API so updates are centralised, configured and installed from a single interface.
OS X has the app store. Linux distributions have repositories. Both of these solve this problem very neatly, and it's a lot easier to keep everything up to date. But I don't think centralised distribution is necessary - just an API call so you can say to the operating system "this is the name of the application, this is an RSS feed where updates are published, this is the key with which updates will be signed, this is how frequently you should check for updates" would probably solve most of the problems.
The mess we have right now is the reason why there is always something on a PC that needs updating.
Java was supposed to run in its own sandbox and therefore wouldn't be a security issue according to the original SUN PR bullshit.
This is actually true. However, when user just mindlessly click through the security dialog on unsigned applets that warn that resources outside the sandbox may be accessed it defeats the whole sandbox protection mechanism.
I guess it gets back to the old adage "Make it foolproof and only a fool will use it.".
Sometimes the light at the end of the tunnel is the headlight of an oncoming train.
I went to the Browser Check link and was told that I have to enable Java and refresh the page. So to check my browsers security I first have to lower my current security settings? Now I see how they got their numbers.
to stay away from web sites that steal their data.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
The problem with these sandboxed browsers is that their plugins are not sandboxed, generally.
I think Chrome is doing well because it ships with its own PDF viewer, thus eliminating the big vector of Adobe's insecure PDF viewer.
I think IE8 is doing well on these tests because if you're using IE you might be a corporate user who's computer is regularly updated by the system admin.
Both these browsers running an insecure version of Java means instant exploit. The best advice is run any browser you want, but get rid of Java and use an alternate PDF reader.
Browsers themselves are now pretty secure, its the damn plugins causing all the issues. At least Google understands this and has a sandboxed secure pdf reader in Chrome. If only they would disable the java plugin by default or make it throw a UAC prompt everytime it needs to run. Java sitting there on the browser ready to run any applet is absolute madness.
If you have Flash installed via nspluginwrapper, it shows two Flash entries, one saying "10.2.152 Up to Date", but the other saying "10.2 Potential Threat", with an explanation that it couldn't figure out the version precisely enough to be sure what it was. It counts this as a security threat. So that's a false positive right there.
Try completely removing your existing installation of Java. Try the standard Add/Remove Programs (sorry, "Programs and Features") uninstaller. When that probably fails, do the rest yourself: delete everything in C:\Program Files\Java, then remove the HKLM\Software\JavaSoft key from the registry. Now, download the full offline installer (or whatever you want, I guess--I normally use this one because I hate downloading installers that really only download something else) and try again. You may need to reboot beforehand if you've attempted a previous installation recently.
Or, at least, this is what I've done manually on some 100+ computers where the SCCM installation of Java has epically failed and deleted most of the bin folder. Maybe it will work for you, too.
R.Mo