IE 9 Beats Other Browsers at Blocking Malicious Content

Orome1 writes with an article in Net Security. From the article: "Microsoft's Internet Explorer 9 has proved once again to be the best choice when it comes to catching attacks aimed at making the user download Web-based malware. This claim was made by NSS Labs in the recently released results (PDF) of a test conducted globally from May 27 through June 10 of the current year, which saw five of the most popular Web browsers pitted against each other. Windows Internet Explorer 9, Google Chrome 12, Mozilla Firefox 4, Apple Safari 5, and Opera 11 were tested with 1,188 malicious URLs — links that lead to a download that delivers a malicious payload or to a website hosting malware links."

Comments

I still think...

[jd]

Lynx is safer still. Some of the browsers for Emacs are fairly secure, too.

Re:I still think...

[Nimey]

How secure can Emacs be with all that malicious Lisp code floating around?

Re:I still think...

[Samantha Wright]

As a Discordian, aren't you bound by religious law to defend the honour of the Lambda Calculus?

Re:I still think...

[obarel]

I am the psychotherapist. Please, describe your problems. Each time
you are finished talking, type RET twice.

How secure can Emacs be with all that malicious Lisp code floating around?

Are you sure malicious lisp code floating around?

Re:I still think...

[impaledsunset]

While Lynx is probably very secure right now, it has seen a security hole or two: https://secunia.com/advisories/product/5883/?task=advisories

Just because it is a text browser with very little features doesn't necessarily make it safe, although the chances for a vulnerability are lower under the *same* conditions.

Who paid?

[benjymouse]

This report was produced as part of NSS Labs’ independent testing information services.
Leading vendors were invited to participate fully at no cost, and NSS Labs received no
vendor funding to produce this report.

Firefox still does not have a sandbox in place. That right there is a severe problem. Especially as Firefox is *the* browser with most vulnerabilities. The only thing Mozilla has going for Firefox security is that they are really fast to patch once a vulnerability has become known.

Re:Who paid?

[Jeremiah Cornelius]

You have a valid point about the sandbox - but the study doesn't really do security a justice, when comparing the browsers.

Malware is seldom a browser injection issue, but is instead vectored through plug-ins (I'm looking at YOU, Adobe!) which are privileged at a higher-level than the "sandboxed" container application.

Flash has been a real horrorshow. It was never designed - rather acquiring tacked-on and retro-fitted capability for dynamic content updating, video playback and scripting with user interactivity, etc.

I could deliver extended anecdotes about the 0-day flash and pdf exploits that I've witnessed, unfolding right in front of me... Suffice it to say, fully patched systems with browser sandboxes are not immune. :-)

The combination of security and privacy extensions that are developed for Firefox are, still, unmatched. Ghostery, AdBlock+ and BetterPrivacy will together prevent the opportunity to ever render many of the malicious, content delivered exploits. They also serve to screen and scrub the most pernicious of web-threats: covert bugging and monitoring of the browser by a third party.

Re:Who paid?

[MozeeToby]

Especially as Firefox is *the* browser with most vulnerabilities.

Citation please? Actually don't bother, because the statement is impossible to support with any amount of evidence. Firefox is the only major browser that openly reports vulnerabilities so of course it is going to have the highest publicly countable number. And even if you had an accurate count of known vulnerabilities from the other vendors, known vulnerabilities hardly equates to total vulnerabilities, even less so when every vulnerability is counted as equal to every other one.

Re:Who paid?

[benjymouse]

Citation please? Actually don't bother, because the statement is impossible to support with any amount of evidence.

2008: http://www.favbrowser.com/firefox-browser-with-the-most-disclosed-vulnerabilities/

2009: http://tech.blorge.com/Structure:%20/2009/11/09/firefox-leads-in-browser-vulnerabilities/

2009: http://www.computerworld.com/s/article/9140582/Firefox_flaws_account_for_44_of_all_browser_bugs

You can also query Secunia for vulnerabilities. With the new version number scheme and ultra-fast previous versions retirement (where you are left vulnerable if you don't upgrade immediately), you'll have to grok the numbers somewhat. Basically count the *unique* CVEs affecting all FF versions since -say FF3.5. Do the same for IE8&9. You will not like the result.

Firefox is the only major browser that openly reports vulnerabilities so of course it is going to have the highest publicly countable number.

BS. All the major vendors are obligated to report vulnerabilities through Mitre. All browser vulnerabilities are assigned unique CVEs.

And even if you had an accurate count of known vulnerabilities from the other vendors, known vulnerabilities hardly equates to total vulnerabilities, even less so when every vulnerability is counted as equal to every other one.

If you consider a set of browsers which must be assumes to receive an equal amount of scrutiny (IE,FF,Chrome), if one browser year after year comes out with most vulnerabilities, surely that does say something about code quality.

Re:Who paid?

[benjymouse]

You have a valid point about the sandbox - but the study doesn't really do security a justice, when comparing the browsers.

Malware is seldom a browser injection issue, but is instead vectored through plug-ins (I'm looking at YOU, Adobe!) which are privileged at a higher-level than the "sandboxed" container application.

No. These days some 85% of infections derive from social engineering. Malware comes in through the user. Vulnerability exploits seems to be a lot less effective these days. Social engineering is precisely what the tested security (reputation) mechanisms are aimed at.

Having said that, yes, Flash is really, really bad. So is Java. And both are rather prolific, regrettably.

I could deliver extended anecdotes about the 0-day flash and pdf exploits that I've witnessed, unfolding right in front of me... Suffice it to say, fully patched systems with browser sandboxes are not immune. :-)

That piques my interest. When was this? AFAIK there has not been a *single* in-the-wild sandbox breach of neither Chrome nor IE (yes, pwn2own demonstrated a combination of 3 techniques which escaped the IE sandbox - but this has not been reported in the wild). Up until some (fast) versions ago, Chrome did not sandbox Flash. IE did that since IE7.

The combination of security and privacy extensions that are developed for Firefox are, still, unmatched. Ghostery, AdBlock+ and BetterPrivacy will together prevent the opportunity to ever render many of the malicious, content delivered exploits. They also serve to screen and scrub the most pernicious of web-threats: covert bugging and monitoring of the browser by a third party.

Whether they are unmatched is a matter of opinion. Firefox requires addons and will block more broadly (which is desirable to some). To me, the fact that FF code quality seems to lack (they have had most vulns reported for the last 5 years going) combined with their nonsensical refusal to implement a sandbox makes it a no-go for me. (I'm, using Chrome, btw).

Re:Who paid?

[BagOBones]

Where are those mod points when you need them?

Re:Who paid?

[Bert64]

Firefox may not be the most hardened browser around these days, but were it not for firefox things would be a lot worse...

Without firefox taking significant market share away, MS looked likely to never bother updating IE...

But also the fact that no single browser still controls 95%+ of the browser market is a VERY good thing. It not only means that standards and interoperability become important which has made mobile browsers viable, it has kickstarted the alternative browser market (without firefox there would likely be no chrome or safari)... The task is hardest for the first alternative browser, as it has to fight against 90% of sites never being tested with it, and 90% of web masters simply not caring about it.

Most importantly from a security perspective however, you no longer have a single browser with 95% market share making an irresistible target... Browser exploits have lost their appeal to hackers, because even with an IE 0day over 50% of your potential victims will never be vulnerable. Instead, hackers are now concentrating on things that are still ubiquitous, like adobe pdf and flash (yes other pdf and flash readers exist, but their market share is trivial)...

So long as the browser market remains competitive, with no single browser obtaining a dominant share we are all better off. Now we just need similar splits of 3-4 players in other markets too.

Re:Who paid?

[Bert64]

No. These days some 85% of infections derive from social engineering. Malware comes in through the user. Vulnerability exploits seems to be a lot less effective these days. Social engineering is precisely what the tested security (reputation) mechanisms are aimed at.

An even better defence against such attacks, is Apple's model... If you can't install/execute anything that's not come from a trusted source, social engineering simply isn't going to work...

People who aren't sufficiently technically competent to understand the dangers of social engineering and not fall for such scams, should only be using walled garden type systems such as Apple's. Current complex computer systems are just totally unsuitable for the vast majority of people.
However what i will say, is that there should be a good selection of such systems, each operated by different gatekeepers. Having a single monoculture is a very bad thing.

In an ideal world, the majority market would be split evenly between 3/4 such players e.g. iOS/android/wm7/symbian, all of which come locked down by default and with non technical people using these. Then there would be non locked down, "advanced" versions of these systems available to those who understand how to use them properly and safely... Perhaps make the process of unlocking difficult so that only technical people will be able to do it on their own, and its won't be practical to social engineer someone through the process.

Re:Who paid?

[Sylak]

So, "Troll" means "well articulated post that cites everything in their rebuttal" ?
Fuck that, somebody mod parent up. Pointing out flaws in FireFox does not a troll make.

Re:Who paid?

[Bert64]

BS. All the major vendors are obligated to report vulnerabilities through Mitre. All browser vulnerabilities are assigned unique CVEs.

Browser vendors are not obligated to do any such thing.
Firefox reports every vulnerability discovered, even those discovered in alpha and beta versions (which is a normal function of beta testing)... By contrast, commercial software is rarely available to the general public at all until a late beta stage, bugs found and fixed during the early development phases will never be disclosed to the public.

Commercial companies, not just browser makers, generally only admit to vulnerabilities which have (or are threatened to be) independently published, because admitting to vulnerabilities is bad for business and not something any for-profit company would do if they have the chance not to. Vulnerabilities discovered internally, or those discovered by third parties who will not disclose them (e.g. NDA) are very unlikely to be made public...
Fixes may not be made available, or may be hidden in amongst other updates. There have been many cases of security patches for a disclosed vulnerability also fixing an unpublished vulnerability, as well as newer versions of programs which include fixes for vulnerabilities present in older versions (with no equivalent patch being made available for the older version).

It's also worth noting that some firefox vulnerabilities are platform specific, where a browser such as ie only runs on a single platform there will be comparatively less vulnerabilities as a result of that too.

Re:Who paid?

[exomondo]

Why is this modded 'Troll'? Seems to be a pretty sound rebuttal.

Re:Who paid?

[bunratty]

Secunia specifically states "The statistics provided should NOT be used to compare the overall security of products against one another. It is IMPORTANT to understand what the below comments mean when using the statistics, especially when using the statistics to compare the vulnerability aspects of different products."

Some companies, especially those with closed-source browsers, may not disclose all vulnerabilities they fix. The number of vulnerabilities fixed also doesn't take into account how severe the vulnerabilities are, or how long it took the vendor to patch them. Which would you rather use, a browser that has ten small vulnerabilities, all patched within days of being discovered, or a browser that has one severe vulnerability that has not been patched in months?

Re:Who paid?

[Luckyo]

The easy solution is to sandbox the entire browser and all of it's plugins. Try sandboxie (http://www.sandboxie.com/) if you're running windows and are paranoid enough to do that.

Re:Who paid?

[hairyfeet]

Riiight. Explain Mac Guardian then. Or the fact that OSX bites it in pwn to own first every. single. time. Protip: the first one to drop a machine get 10,000 USD so they are gonna go for the easiest target so they can get paid and since Windows Vista that AIN'T Windows. you might want to read this before you start touting Apple security.

As for TFA, is anyone surprised? MSFT has caught so much flak for holes in IE they really don't have much of a choice anymore they pretty much HAVE TO lock it down. It still won't get me to use it or recommend it to my users though. I hate the UI and after getting burnt by IE 6 and seeing how they are trying to tie IE to which OS you have instead of actually supporting those still not EOL'ed I think I'll pass.

I do have to give MSFT credit for one thing though...low rights mode. that was really smart and one of the reasons why I use a Chromium based browser (Comodo Dragon) and give it to my clients, as having the browser at the lowest possible permissions simply makes good sense. Why FF hasn't implemented this after FOUR YEARS is beyond me.

But since switching my users over to Windows 7 and The Dragon along with ABP I have watched the infection rates drop off the charts. So far I've only seen a single infection with that combo and that was from a moran who not only refused to listen to his AV but actually DISABLED IT when it wouldn't let him instal 'teh new Limewire". Which of course is nothing but a bunch of trojan downloaders with a badly skinned Gnucleus.

IE may win awards at blocking certain types but by abandoning IE after 6 for so long and leaving the web a mess they have years of bad will they are gonna have to overcome.Maybe once XP and Vista are EOL so that there is only one OS and only one IE to support things will be better, but for those that have to admin multiple flavors of Windows IE is just a PITA.

Re:Who paid?

[UnknowingFool]

Or the fact that OSX bites it in pwn to own first every. single. time. Protip: the first one to drop a machine get 10,000 USD so they are gonna go for the easiest target so they can get paid and since Windows Vista that AIN'T Windows. you might want to read this [wordpress.com] before you start touting Apple security

Maybe the fact the winner won the machine they pwned had something to do with the selection. Or that the contest wasn't a race but a turn based contest. But let's conveniently ignore those facts.

Re:Who paid?

[UnknowingFool]

Most disclosed != most insecure. Most bugs found and fixed != most insecure. Most bugs != most severe security lapses. Since Mozilla is open source it is transparent to many people what bugs they have and what the severity of the bug might be. Since MS uses a more closed model of security, you don't know how many bugs they have been sitting on and not fixing much less acknowledging. They could have drive-by vulnerabilities that allow remote takeover. They can fudge their metrics by only acknowledging a bug when they have a fix then releasing a fix immediately thereafter.

Re:Who paid?

[Anonymous Coward]

Maybe the fact the winner won the machine they pwned had something to do with the selection. Or that the contest wasn't a race but a turn based contest. But let's conveniently ignore those facts.

You win the machine, but you also win a cash prize worth many times the value of the machine, obviously the cash prize is the focus and Apple devices are quickly pwned at the competition every year.

Re:Who paid?

[benjymouse]

An even better defence against such attacks, is Apple's model...

A whitelist approach certainly has its advantages - securitywise - to a blacklist (reputation) approach. However, in the case of Apple you get the distinct feeling that in also coincides with their strangehold on the revenue stream. With a white-list approach you give up freedom and convenience. In the case of iOS you subject yourself to the whim of Apple. Some don't see a problem with that. Personally, I think it interferes with the computer as a general-purpose device. However, as computers (and phones in particular) are becoming commodities I can certainly see the allure of the white-list.

However what i will say, is that there should be a good selection of such systems, each operated by different gatekeepers. Having a single monoculture is a very bad thing.

Very good point. I have pondered that myself. A system a little like SSL certificates or domain authorities. It is not without problems, though. For one thing, it would kill "free" software on those devices. I don't suspect that an approval (code signature) will be given away for free. After all, the reputation provider takes a risk every time they issue a signature. If they let themselves be fooled their own reputation may be on the line. And then there's the risk of rogue reputation providers just like payment processors. Russia, looking at you.

Re:Who paid?

[dwater]

Surely this ends the argument?

Re:Who paid?

[benjymouse]

An even better defence against such attacks, is Apple's model... If you can't install/execute anything that's not come from a trusted source, social engineering simply isn't going to work...

To be fair a white-list has been possible on Windows since (at least) Vista. This has been beefed up at little with Windows 7 / 2008R2. Security policy settings allow an administrator to enforce a number of rules, such as path rules, network zone rules, hash rules and certificate rules.

The certificate rule is rather advanced and based on authenticode. Basically an admin can set up rules for specific vendors or all vendors where the code has been signed using a certificate from a trusted set, i.e. through trust of a root cert. For instance you can set up a rule which requires all executables to be signed using a certificate issued by a trusted root (Verisign) and then white-list vendors such as Microsoft, Adobe (if you dare), Apple (if you dare) etc.

The network zone rule is also interesting because it can restrict software based on where you've got it. The zone from where you downloaded the software is stamped into an alternate datastream on downloaded files. The policy can then deny execution of anything coming from the Internet or even the local intranet.

Re:Who paid?

[benjymouse]

Firefox reports every vulnerability discovered, even those discovered in alpha and beta versions (which is a normal function of beta testing)...

They report them in the open, but they are *not* considered vulnerabilities of released software and they are not reported as such to NVE or Mitre and they are not assigned CVEs. You cannot find any CVE referring to a beta or alpha version of FF.

By contrast, commercial software is rarely available to the general public at all until a late beta stage, bugs found and fixed during the early development phases will never be disclosed to the public

Yes, well, when it is not available any security bugs found during the testing/security push don't matter, do they? I mean, I expect the vendor to make a security push, reviews and fuzzing during both development and testing. The final product which is released is what should be judged.

Commercial companies, not just browser makers, generally only admit to vulnerabilities which have (or are threatened to be) independently published, because admitting to vulnerabilities is bad for business and not something any for-profit company would do if they have the chance not to.

And you have proof of this. Or is it just speculation. Many vendors have a customer base who rely on the vulnerability disclosures being accurate. That is why the disclosures have to be accurate. A customer looks at the patch and based on which product/part it patches (is the part deployed, is it critical, is it exposed) and the description of the vulnerabilities being addressed (would they pose a risk to the customer) they decide whether to patch their systems or skip it and prioritize stability.

While vendors may have a small interest it keeping the CVE count low, at least some of them have a bigger interest in serving their existing customers with reliable information with which they can make informed decisions. The latter is *much* more important to at least MS than the former.

In other words, it is *not* in MS own interest to sneak in vulnerability fixes without disclosing them. Doing so would put their customers at risk of making uninformed and potentially dangerous decisions. Imagine the outcry if MS sneaked in a fix which were not applied by customers because they decided that the *disclosed* vulnerabilities did not pose a risk.

CVEs - taken over a period of time - actually *is* a good measure of the quality control process of the vendor. Microsofts security focus following the disasters at the beginning of the century is starting to pay off. Mozilla is the new insecure bloat. Well, and Adobe. And Java.

Re:Who paid?

[Bert64]

And you have proof of this. Or is it just speculation.

One example would be http://www.phreedom.org/solar/exploits/msasn1-bitstring/
There was a disclosed vulnerability in the microsoft asn.1 library, but the patch for it brought along a fix for another vulnerability in the same library that was not disclosed. This vulnerability was subsequently found by third parties, who produced and released a working exploit forcing microsoft to admit to the vulnerability several months later.

There are other examples, you just have to google for them.

Yes, well, when it is not available any security bugs found during the testing/security push don't matter, do they? I mean, I expect the vendor to make a security push, reviews and fuzzing during both development and testing. The final product which is released is what should be judged.

The point is that something developed in the open is often unfairly punished here, as although the betas/nightlies are quite clearly marked "use at your own risk", and only intended to be used by appropriately clued up people, vulnerabilities in them are still disclosed even tho they are generally of no consequence.

Re:Who paid?

[Neil Boekend]

Riiight. Explain Mac Guardian then. Or the fact that OSX bites it in pwn to own first every. single. time. Protip: the first one to drop a machine get 10,000 USD so they are gonna go for the easiest target so they can get paid and since Windows Vista that AIN'T Windows. you might want to read this before you start touting Apple security.

The apple lock in he is talking about helps against social engineering. Pwn2own isn't about social engineering, it's about software vulnerabilities.
Disclaimer: I would not like a lock-in. I do not use Apple. I am not an apple fanboy. I use Win7 and Suse (although I have used FreeBSD and Ubuntu).

Re:Who paid?

[Neil Boekend]

I got modpoints, but can't mod. Some change killed modding without scripts.

Re:Who paid?

[benjymouse]

The point is that something developed in the open is often unfairly punished here, as although the betas/nightlies are quite clearly marked "use at your own risk", and only intended to be used by appropriately clued up people, vulnerabilities in them are still disclosed even tho they are generally of no consequence.

Not unfair at all, as bugs found during beta are not assigned CVEs. They never become "official" vulnerabilities. CVEs only track vulnerabilities in released software.

One example would be http://www.phreedom.org/solar/exploits/msasn1-bitstring/ [phreedom.org]
There was a disclosed vulnerability in the microsoft asn.1 library, but the patch for it brought along a fix for another vulnerability in the same library that was not disclosed. This vulnerability was subsequently found by third parties, who produced and released a working exploit forcing microsoft to admit to the vulnerability several months later.

What you have is evidence that a code change Microsoft did also removed another vulnerability. That could very well be a side-effect of simply fixing the first bug by cleaning up the algorithm. It does not demonstrate that Microsoft knew about the bug in the first place.

The exact same thing could happen with any other software. When Mozilla fixes a bug in in a rendering algorithm by re-implementing it, I could also claim that they silently fixed *other bugs* within that algorithm, even if they were not recognized at the point. We wouldn't assume malice on part of Mozilla for that.

Or consider how Microsoft re-implemented TCP/IP for Vista. Does that mean that they silently fixed all bugs which from that point were found in the old stack? Silly.

Re:Who paid?

[AmiMoJo]

It seems like having your own anti-virus product would be very helpful for setting up blocks in the browser. Microsoft have Security Essentials. Maybe Google should buy an AV vendor.

Re:Who paid?

[_0xd0ad]

Or the fact that OSX bites it in pwn to own first every. single. time.

Yes, and the first bobsled team always finishes before the other bobsled teams, because they finish before the next bobsled team starts. That doesn't mean they won.

Re:Who paid?

[UnknowingFool]

You missed the point. There is only 1 Mac to win every year. The retail value is around $2000. Teams do not all start at the same time. They have to take turns and have a limited amount of time. So if your team wants to win the Mac and happens to be first one to hack the Mac, you win it. As long as you do it in the allotted time, it's yours. The time to hack is not compared because once a machine is compromised, it is not available. So being hacked first isn't as meaningful than time to be hacked because it could have taken 10x as long for the Mac as the PC. The Mac is what all the teams wanted to own so they tried it first.

Re:Who paid?

[UnknowingFool]

So you're saying the severity of a bug has nothing to do with how secure a system might be. So you're saying that Mozilla which fixes bugs very quickly after public discovery is less secure than MS who may sit on bugs for unknown periods of time is more secure. That's great logic you use there.

Re:Who paid?

[_Sprocket_]

I am fully confident that it will. Until the next joker either misunderstands the Secunia data or uses it to troll others who don't understand it.

Re:Who paid?

[Oligonicella]

Conversely, if your team wants the $10K and the Mac is the easiest to own, you go for that first. We probably need to hear from the team as to why they chose the machine.

"The Mac is what all the teams wanted to own so they tried it first."

Odds are simply against that.

Re:Who paid?

[UnknowingFool]

And why are the odds against it? Are you saying that hackers don't want a machine capable of running Windows, OS X, Linux, and BSD. Sure they probably could build a hackintosh but they'll pass the opportunity for a free Mac. Sure that makes sense.

Re:Who paid?

[hairyfeet]

Because if last year is normal the Windows machine is more expensive gamer gear than the standard Mac laptop? And again if you are the first with the fastest time you get $10,000 in cash which means you could keep the windows laptop and just buy the fricking mac and have a big pile o' cash left over.

Go back to my first post, read the link. You'll see why the macs fall first. it is the lack of ASLR, DEP, and low rights mode as well as file and registry (or in the case of Macs settings) virtualization that causes macs to fall. If you'll read TFL you'll see a detailed analysis of what the Macs are lacking and how when macs do implement one of the security technologies it is often done poorly.

Apple has been coasting on security through obscurity for so long their coders simply aren't up to speed on the latest hacking tricks. MSFT not only got all that experience from their brain dead 'hey lets run everyone as admin!" XP debacle but thanks to MS MSRT they get monthly reports through Windows Update of what attack vectors are being hit the most month by month. Compare that to the recent "Whatever you do don't say malware!" Applecare debacle and you can see why MSFT beats Apple in Pwn2Own.

Re:Who paid?

[man_of_mr_e]

Without firefox taking significant market share away, MS looked likely to never bother updating IE...

I'm not sure about that. Microsoft has traditionally released browsers in conjunction with major OS releases. There was no major OS release between 2001 and 2006.

IE 6 was released with XP, IE7 with vista, IE8 with Windows 7. IE 9 has broken that cycle, but only because of the HTML5 push for Windows phone and Windows 8 development. Developers need a platform to develop those apps before those OS's are released.

Re:Who paid?

[UnknowingFool]

Because if last year is normal the Windows machine is more expensive gamer gear than the standard Mac laptop? And again if you are the first with the fastest time you get $10,000 in cash which means you could keep the windows laptop and just buy the fricking mac and have a big pile o' cash left over.

So between $10,000 and a machine they want or $10,000 and the machine they don't want, you're saying that the hackers are going to try for a machine they don't want. Hackers, especially, are the type of people to play it safe. That's ludicrous.

Go back to my first post, read the link. You'll see why the macs fall first. it is the lack of ASLR, DEP, and low rights mode as well as file and registry (or in the case of Macs settings) virtualization that causes macs to fall. If you'll read TFL you'll see a detailed analysis of what the Macs are lacking and how when macs do implement one of the security technologies it is often done poorly.

You missed the point. Saying that the Mac was first to fall is pointless as the contest is turn based. If the contest was a race with all teams starting at the same time, you might have some points. Or taking into account time to successfully attack. Windows was just as vulnerable as OS X but vulnerable in a different way. As for lack of ASLR and DEP I suspect you know jack about OS X as they exist in OS X. The hackers bypassed them.

you can see why MSFT beats Apple in Pwn2Own.

That's a failing of logic as you don't understand Pwn2Own. MSFT did not beat Apple nor Apple beat MSFT. They both lost. Your only metric that OS X fell first is meaningless as I explained above.

Re:And who paid for this study?

[bonch]

Prediction:

The results are favorable to Microsoft, so there will be a ton of skepticism, investigation, and outright dismissal. However, when studies favorable to this particular community's ideologies are announced, none of that occurs, even though the same kinds of skepticism can and should be applied.

Nice try

[Lysander7]

I almost believed this story, then, with my superior intelligence (as shown by my browser, Opera) I realized that this story is probably pulled out someone's ass.

Re:Nice try

[Errtu76]

Nice reference :)

Re:Nice try

[mckinnsb]

If by "pulled out of someone's ass" you mean "they engineered the test to perform best with Internet Explorer 9", then completely.

The main center-point of this test was evaluating a "cloud based trust ranking algorithm". But the study provides no evidence that these algorithmns exist in any of the browsers; its a simple assumption which is likely false (especially when you look at the graphs). What the graphs are really showing is the performance of each browser's black list versus a set of URLs they selected, and not randomly.

If you look at the graphs themselves, they actually don't show the action of any algorithm (which would likely linearly increase or show volatility); in fact, IE9 (With App Rep) is simply a straight line. It's pretty clear that the URLs they used were already in the black list before hand, and that straight line is a continual rejection of them.

Testing a browsers ability to 'blacklist' websites is fine, I guess, but my first problem with this study is that's not the only way to measure 'security'. My second problem is that there's no evidence that the browsers themselves actually perform this activity, making the tests in the study feel like "studying the maximum (flying) climb speed of humans, rats, horses, and bats". My third - and the most troubling - problem is that they don't provide any information as to how these lists were obtained. They only say they tried to "mix URLs so as to make sure that certain domains were not overemphasized", and "NSS Labs operates its own network of spam traps and honeypots.", in addition to "In addition, NSS Labs maintains relationships with other independent security researchers, networks, and security companies,".You can assume without being overly bold that this list could have been a list of URLs that they knew IE would block. Conversely, you could probably easily design a similar test that would have Chrome at 100% block rate, and IE 9 at 10% - it's merely a measure of "what sites were in our test pool that are also in the browser's black list"

Pffft.

Re:Nice try

[93 Escort Wagon]

I almost believed this story, then, with my superior intelligence (as shown by my browser, Opera) I realized that this story is probably pulled out someone's ass.

Someone with superior intelligence probably would've remembered the correlation between browser usage and IQ was shown to be an elaborate hoax.

(Yes I know you weren't being serious, but feel free to "whoosh" anyway)

Re:Nice try

[93 Escort Wagon]

If by "pulled out of someone's ass" you mean "they engineered the test to perform best with Internet Explorer 9", then completely.

Studies have shown that random detritus pulled out of someone's ass performs best on IE9!

Re:Nice try

[Lysander7]

If I knew how to embed links in posts, I would have done so in mine. :l

Re:Nice try

[QuietLagoon]

but my first problem with this study is that's not the only way to measure 'security'.

Exactly correct. Indeed, if you read the first footnote of the report, you will see,

Note: This study does not evaluate browser security related to vulnerabilities in plug-ins or the browsers themselves.

The study does not evaluate the security of the browsers themselves.

Re:Nice try

[jawtheshark]

Simple HTML: <a href="http:/example.com">Example</a> yields: Example.

Re:Nice try

[LoztInSpace]

But isn't "random detritus pulled out of someone's ass" pretty much the definition of the internet?

Re:Nice try

[dokc]

Yes but first 5 hits in Google search engine for "nss labs ie9" are:

Internet Explorer 9 safest Web browser
Microsoft's IE9 Blocks Almost All Social Malware, Study Finds
NSS Labs: IE9 Blocks Most Malware Compared to Competition ...
NSS Labs: IE9 Tops in Browser Security
NSS Labs: IE9 Caught 96% of the Live Threats with SmartScreen URL

I don't see small print in this headlines.

Re:Nice try

[fatphil]

"""
        Microsoft selected NSS Labs, as a supplement to our own internal research, for its integrity and expertise in providing accurate third-party benchmarks. This service has been instrumental in providing us with reliable metrics.

John Scarrow
General Manager Online Safety Technologies
Microsoft Corporation
"""

where 'selected' = 'paid'

Re:And who paid for this study?

[elrous0]

Firefox and Chrome are the safest browsers out there, especially if you use Adblock and NoScript

Chrome doesn't have NoScript. The closest they have it NotScripts, which sucks by comparison. Nothing, IMHO, can touch Firefox with AdBlock and NoScript. Comparing any other browser to that configuration should almost have to come with an asterisk indicating that, though X browser may be more secure in the STOCK version, nothing compares to the POTENTIAL security of Firefox with the right add-ons.

If you block everything, your score is 100%

[Anonymous Coward]

MSIE got the highest "malware detection rate" because they used it in a mode where nearly every page is marked as "dangerous". It had the highest detection rate but also the highest false positive rate.

If I sit at the airport saying "that plane is going to crash" for every plane that takes off, and eventually get it right, that doesn't mean I'm able to predict which planes are going to crash (even though I got "100% of the crashes" right)...

Re:If you block everything, your score is 100%

[RKThoadan]

Finally! A legitimate complaint about the study. I was beginning to doubt we could do anything other than beat our chests and say "MS BAD!" Kudos to you!

Re:If you block everything, your score is 100%

[Anonymous Coward]

You might want to actually read the study because it doesn't say that anywhere.

Re:If you block everything, your score is 100%

[93 Escort Wagon]

If I sit at the airport saying "that plane is going to crash" for every plane that takes off, and eventually get it right, that doesn't mean I'm able to predict which planes are going to crash (even though I got "100% of the crashes" right)...

I don't think you'll be allowed to sit there long enough to make your scenario statistically likely.

As a matter of fact, I doubt you'll get the chance to observe more than one plane taking off.

Re:If you block everything, your score is 100%

[F.Ultra]

He doesn't have to speak out loud.

Re:If you block everything, your score is 100%

[Skuto]

it appears there is no testing against non-malware links done

Somewhere near the end they mention that they tried some popular sites (Amazon, Microsoft, Yahoo, Google ...) to see if they weren't accidentally blocked.

"Surprisingly", no browser failed :)

Re:If you block everything, your score is 100%

[chemosh6969]

But if the other browsers can't compete in the same way, by using a similar mode, then they've still lost.

Re:If you block everything, your score is 100%

[seanvaandering]

...and to think it wasn't even a car analogy either!

Re:And who paid for this study?

[jd]

It could be a study by a PC vendor involving 1,188 sites with Apple malware. (They have to include IE after all, and nobody likes looking like a fool.) Or it could be a genuine study by a really bad security guy (all the browsers support Selenium, so they could have automated tests against as many URLs as they liked - a mere thousand in an automated test is really not that many, given that they'll have been testing against similar attack vectors in many cases).

Not that it matters much. It's not like the most vulnerable users read studies and it's not like those who read studies will pay much attention to anything that advocates one browser over another since many geeks tend to be rather more passionate about what they're seen with than with instantaneous snapshots that won't be valid the next day anyway.

Kind of correct.

[khasim]

The results are favorable to Microsoft, so there will be a ton of skepticism, investigation, and outright dismissal.

Yep. Mostly because Microsoft has a history of purchasing favourable "findings" from "independent" "research" firms.

However, when studies favorable to this particular community's ideologies are announced, none of that occurs, even though the same kinds of skepticism can and should be applied.

Kind of. The process and parameters should always be checked. But the other browsers do not have a history of their parent companies purchasing favourable "findings".

It's called "learning from experience".
There is no reason to forget every past instance when evaluating a new instance. Quite the opposite, in fact.

Re:Kind of correct.

[InspectorGadget1964]

The results are favorable to Microsoft, so there will be a ton of skepticism, investigation, and outright dismissal.

Yep. Mostly because Microsoft has a history of purchasing favourable "findings" from "independent" "research" firms.

However, when studies favorable to this particular community's ideologies are announced, none of that occurs, even though the same kinds of skepticism can and should be applied.

Kind of. The process and parameters should always be checked. But the other browsers do not have a history of their parent companies purchasing favourable "findings".

It's called "learning from experience". There is no reason to forget every past instance when evaluating a new instance. Quite the opposite, in fact.

Well, you also need to consider that if we are talking about internet explorer we must be talking about an operating system that is poorly designed so it need serious protection. Basically microsoft has build a boat full of holes (I believe they callis something like MS-Windows) and they pnly produce software for that environment. Now, if you are going to run a browser like Firefox, konqueror, opera or chrome under a proper operating system, that wouldn't be necesary.... Just a thought....

Re:Kind of correct.

[exomondo]

Basically microsoft has build a boat full of holes (I believe they callis something like MS-Windows) and they pnly produce software for that environment.

What are you on about? They produce software for plenty of platforms other than Windows, their own ones like their phone/Zune OS and the XBox as well as Mac OS X.

NSS Labs: The best studies money can buy

[thoromyr]

Of course, when your methodology is that only the bare browser configuration is allowed (e.g., no AdBlockPlus, no NoScript) and you carefully select the malware URLs (obtained from "honey pot" email addresses and then filtered, and then "prune out non-conforming URLs" -- without fully specifying what made them non-conforming) *and* require the malware URLs to be live for at least 6 consecutive hours it gets a lot easier to massage the results. To further exaggerate results not only does a "hit" increase the score but a "miss" decreases it to magnify the difference.

This is the same song as they sang about IE8 with the same, predictable, results. Microsoft didn't pay them a wad of money for this study for nothing.

Re:NSS Labs: The best studies money can buy

[The MAZZTer]

To be fair I can imagine a lot of Firefox users not even knowing add-ons exist.

Re:NSS Labs: The best studies money can buy

[cobrausn]

What is wrong with testing the bare browser configuration? Aren't we trying to protect those who are most likely to download malware by accident, i.e., those who are also unlikely to install AdBlockPlus and NoScript?

Re:NSS Labs: The best studies money can buy

[_0xd0ad]

I don't care about them; I care about how secure my browser is, and my friends' and parents' browsers, which I've configured similarly to mine. As far as I'm concerned, even if the virus gets as far as downloading its executable, just as long as MSE stops it when they try to launch it I consider that a successfully thwarted attack.

Re:NSS Labs: The best studies money can buy

[thoromyr]

Ah, so you ignore the rest of their methodology because it was clearly indefensible?

If the study was really aimed at identifying browser security then a NoScript enabled browser *should* be part of the test. It would illustrate the difference between not using NoScript and using NoScript. It would illustrate the difference between IE9 and FF with NoScript. There are two problems with that:

1. Due to their mechanism for grossly exaggerating minute variations, it would sink IE9 as being the run away favorite. Except for number two.

2. Due to how the study was carefully constructed it wouldn't make any difference (FF with NoScript wouldn't tell the user they'd just been protected -- it would just silently happen -- so FF would *still* be down graded).

Since people don't tend to read the article (much less the NSS Lab's purchased findings that were mislabelled as a study)

> Success: NSS Labs defines success based upon a web browser successfully preventing
> malware from being downloaded *and* correctly issuing a warning.

Re:NSS Labs: The best studies money can buy

[Nimey]

Your average luser isn't going to know about ABP or NS.

Try again.

Re:NSS Labs: The best studies money can buy

[uigrad_2000]

I don't care about them; I care about how secure my browser is...

Actually, I do care about them, but they aren't really relevant. Someone who doesn't know about extensions is not going to be reading studies about browser safety.

The study should consider the audience. Anyone digging for information about browser security is going to know about noscript.

Even if noscript wasn't one of the most commonly installed browser addon, an article about browser security should certainly discuss it. The .pdf with the results is 21 pages long, and doesn't even mention noscript, yet claims to be a study on browser security. That proves (to me) that there must have been an ulterior motive behind this study.

Re:NSS Labs: The best studies money can buy

[Sebastopol]

How do you know MS paid for this?

Re:NSS Labs: The best studies money can buy

[cobrausn]

I ignored the rest of the methodology because I didn't agree with it. I chose to defend the one point that I saw of value - testing unmodified browsers against each other. You know, the kind that non-geeks use. That's it. Anything else you are reading from my original post is imagined.

Re:NSS Labs: The best studies money can buy

[benjymouse]

Since people don't tend to read the article (much less the NSS Lab's purchased findings that were mislabelled as a study)

So did you read the study? Did you come across the following section?

This report was produced as part of NSS Labs’ independent testing information services.
Leading vendors were invited to participate fully at no cost, and NSS Labs received no
vendor funding to produce this report.

Actually, this is a running study, so it also reflects the speed by which the browser vendors update their respective reputation databases. Some 85 new urls were entered on average each day (after being confirmed as malware-serving urls) throughout the quarter. NSS releases these results each quarter.

Re:NSS Labs: The best studies money can buy

[amicusNYCL]

when your methodology is that only the bare browser configuration is allowed (e.g., no AdBlockPlus, no NoScript)...

... then you're doing it right. If Mozilla wants the benefit of extensions for studies, then merge them into the trunk. Because right now, neither ABP nor NoScript are part of Firefox. There's no reason that something testing Firefox should test those.

Re:NSS Labs: The best studies money can buy

[Skuto]

Fair enough, but can we then stop bitching about upgrades breaking add-ons?

Either add-ons are a critical feature of Firefox and deserve consideration in such a report, or they're not, and in that case their non-presence can't be a criticism. /. can't have it both ways!

Re:NSS Labs: The best studies money can buy

[amicusNYCL]

It's fine with me, the only extension I use is Firebug, which incidentally is also terrible for benchmarks.

This being said, in the past we've seen speed benchmarks showing Firefox out front, with everyone here complaining about memory leaks. At that point I was advocating running the benchmarks with the top 5 or so extensions installed since virtually no-one on Slashdot runs vanilla Firefox. Those results would probably be more illustrative about how "power users" run Firefox (and would decrease or eliminate its lead). But now I'm advocating against extensions in benchmarks, because it suits my point ;)

In reality though, it would be nice to see vanilla Firefox up against extended Firefox to really get a good idea about the impact of extensions, both from the security and performance perspectives.

But like I said, I don't really care. I prefer Opera anyway.

Re:NSS Labs: The best studies money can buy

[chemosh6969]

Why should the browsers have any extra extensions installed? We're testing the browsers and not the extensions. Also, IE 9 can filter out things using the same lists AdBlock Plus does and it does so without having to install a third party extension.

Re:NSS Labs: The best studies money can buy

[RobertLTux]

wanna bet that MS has funded OTHER studies and is currently planning new studies??

that the accounting can say that MS didn't fund this study does nothing to say that funding for other studies might suddenly vanish after a study comes out that doesn't show MSIE (or MSAnything) as being "best"

Re:NSS Labs: The best studies money can buy

[Sebastopol]

That is what I am having trouble with. You see, I read the article AND the PDF, and no where does it state it was paid for by MS.

So again, how do you know MS paid for this?

Re:NSS Labs: The best studies money can buy

[hkmwbz]

The problem is that their methodology still sucks. They could have as few as 10 unique sites for the whole damn test, for example.

Re:NSS Labs: The best studies money can buy

[hkmwbz]

The first ones were funded by Microsoft. I'm sure they have found some way for Microsoft to provide indirect funding in this case, because that's what Microsoft always does. Lies, lies, lies.

Re:And who paid for this study?

[bioster]

Frankly, the page itself screams bias with the line "has proved once again". I don't recall this being proved in the past, but hey, I try to be open minded. So I threw NSS labs into google, and immediately turned up:
http://www.thetechherald.com/article.php/200912/3268/Can-you-trust-the-NSS-Labs-report-touting-the-benefits-of-IE8

So apparently they tested IE8 and thought it was awesomesauce. Uhm, ok... I thought IE8 wasn't completely terrible but I wouldn't say it was good. That link seems to think NSS might be a microsoft shill. But ok, I like to be open minded. Let's keep looking. Going down the first page of my google search:
Firewall Vendors Challenge Findings of NSS Labs Report | PCWorld
Haavard - Malware report from NSS Labs manipulates statistics?
Google Responds to NSS Labs Browser Security Report | News
A recent test by NSS Labs gave a near-perfect score to Internet Explorer 9 beta and very poor marks to Chrome and other browsers.


So uhm... yeah... at first glance, I'd say treating them with some skepticism seems more than warranted here.

Re:And who paid for this study?

[The MAZZTer]

Chrome actually has built-in support for basic NoScript-like behavior. Block all JS and Plugins and you can whitelist sites from the omnibox. Only downside is, unlike NoScript, you only whitelist the domain in the address bar to allow ANY origin script/plugin embedded in it, including ads and tracking scripts and the like. This is also a problem when you have sites like ytmnd or deviantart with tons of domains, but you can always go into options and add a blanket whitelist for the whole domain.

Yeah.... no.

[_0xd0ad]

IE's idiot mode where it tells you "I'm sorry, Dave, I'm afraid I can't do that" might be better at keeping users off bad websites than other browsers, okay.

Give me a study that shows the actual infection rate once you've visited the site; I'm betting that the scores would look different then.

Re:IE9 Downloads

[game kid]

It does now (Ctrl+J after you start downloading, then check the Location column for each file). It didn't in pre-release versions (I forget which, but I used them).

IE 9 does not work with XP

[Newer Guy]

IE 9 does not work with XP-the most used OS in the world.

Re:IE 9 does not work with XP

[unixisc]

NO, IE9 doesn't work w/ any XP service pack. Minimum you need for it is Vista. Maximum you can use w/ XP is IE8

Re:And who paid for this study?

[u-235-sentinel]

So ideology is incapable of causing corruption, but money is always an indication of corruption, right?

Whenever I perform an investigation I first look at who benefited or where the money came from in a case. Generally it's helped in establishing who's guilty as I follow the evidence.

Money is a great place to start if you want a clearer understanding of who's guilty. Depends on the case of course :-)

It has to be

[tehniobium]

Well IE9 HAS to be the best at "catching attacks aimed at making the user download Web-based malware".

That's because only the most stupid web user (read: the most stupid 50%) click banners which go "OMG YOU MUST MAKE YOU COMPUTER FAST AND NOT HAVE VIRUZES NAO!". And yes...they are using Internet Explorer, because quite frankly, they aren't smart enough to spot that Chrome/Firefox are better than IE.

Re:It has to be

[Anonymous Coward]

aren't smart enough to spot that Chrome/Firefox

Chrome/Firefox/Opera/Gnuzilla/Ice Weasel/Lynx/Camino/Skyfire/Konqueror/Safari/RockMelt/EMacs/w3m...............

are better than IE.

FF4 - How unfair!

[pseudorand]

Yet again another M$ sponsored study makes IE look better by using an ancient version of Firefox. FF4 is like way out of date. How dare they make such claims.

Re:FF4 - How unfair!

[vlueboy]

LOL. Another one in a slippery rope of drawbacks to version inflation death: Even the studies that are supposed to praise you cannot honestly keep.

FF6 was officially released *today*, making the results look ancient because we still expect a major number to last a full year or two for FF. Sadly, I couldn't find much web feedback of this "brand new" version in my native language (a nice way to avoid all the shills and paid reviewers so deeply ingrained in the English-US blogosphere). Zero feedback means I'd look at FF5, but I've never installed it, so it's iffy. The catch 22 is that 4 didn't make stellar grades in this study, so 6 can't be all that much better, with just 6 months of cooking time, can it?

And that, my friends, is the whole thought process that finally drove Mozilla to the madness that was "we're now planning to go all version agnostic YEA!"

Re:FF4 - How unfair!

[Skuto]

Malware/phishing protection in Firefox has been essentially unchanged since Firefox 2 received code to do this from Google using their SafeBrowsing service, and Firefox 3.5, 4, 5, 6, 7 and 8 will behave identical, the performance being determined by the Google service.

I don't know of any active efforts inside Mozilla or by the community at large to improve it.

Re:FF4 - How unfair!

[kangsterizer]

then again its testing chrome 12 too (hint: its very old) and IE10 is around the corner. you were saying?

Re:FF4 - How unfair!

[TxRv]

There are a lot of problems with the study such as a small sample size, cherry-picking malware that IE does well against, lack of peer review, complete denial of the existence of layered security in the form of extensions or sandboxing, the complete lack of credibility of NSS labs, and the fact that Microsoft paid for the study. The versions used are not one of those problems. FF4 and Chrome 12 were the current releases at the time they tested the browsers. FF4 actually came out a few days after IE9. It's just that IE's "once every few years" release schedule can't compete with the versatility afforded by Firefox and Chrome's monthly major releases.

Re:FF4 - How unfair!

[dokc]

No money changed hands in the making of this study.

And how do YOU know that?

Re:FF4 - How unfair!

[pseudorand]

Them's the jokes folks. This was supposed to be a FF version idiocy dig, not a true indignant bashing of Microsoft. I had hoped to get a bit more insightful audience here on slashdot. Can someone please add a 'hide my comment from anyone with a UID greater than 6 digits' checkbox to this site.

Re:NSS Labs is MS Shill

[Baloroth]

They also made a few technical errors in the report, at least surrounding Opera. At one point, they list "Opera 10" as having 6.1% block rate, yet earlier in the report they list that as the rate for Opera 11 and Opera 10's rate as 0.00%. That, combined with the absolutely gushing praise for IE9 and its App block (or w/e they call it) filter lead me to suspect quite strongly that this is just another MS paid add by an "independent" (i.e. not directly MS-owned) company.

No technical examination of any other browser's malware blocking was mentioned. Nor did they seem to do any testing of add-ons or extensions. I imagine Add-block alone probably blocks many malicious sites. Oh, and no list of URL's tested was given. Even if this wasn't horribly biased (which I doubt), it was terribly conducted technically speaking.

Re:wrong question

[Anonymous Coward]

Please cite your source that Windows 7 is less safe compared to other modern OSs? I say Windows 7 because IE9 won't work on Windows XP.

I grant you that users can be stupid, but that's not the fault of the OS.

Re:incorrect summary

[losfromla]

I didn't RTFA but, superficially thinking about it, it seems that other browsers would not be vulnerable to attacks aimed at IE9 and so would not detect anything malicious; hell, the attack might not even launch if it doesn't detect an IE9 browser.

Re:And who paid for this study?

[Ryantology]

Of course, in the wider scheme of things, a browser's stock security is probably more important because add-ons and extensions are effective only if a person is aware of them and takes the time to install them. I'm sure a lot of people don't know to do this, or know and don't bother.

Re:How come?

[karnal]

I don't know, but I use my PIN number at the ATM machine all the time now!

Re:And who paid for this study?

[LifesABeach]

Aye, but Google has yet to kiss the Blarney Stone.

Re:Firefox and Chrome have different results

[Skuto]

The protocol for doing so has been extended to include malware downloads at some point, and Chrome implements this, but this part of the protocol is not documented, so Firefox (and Safari) don't.

Re:incorrect summary

[gdshaw]

They found IE9 to be the best choice to defend against attacks aimed at IE9. Other browsers where found to be severely lacking in in defending against attacks aimed at IE9.

Not only that, but they ran all of the tests on Windows. That is hardly the platform that you would choose if you were trying to block malware, so given a free choice of platform IE would be at a severe disadvantage because it is tied to Windows[1]. The test nullifies that disadvantage by making all of the browsers play on Microsoft's home ground. I don't see how they could possibly claim that this was an unbiased test.

[1] unless you count IE5 on Mac OS, which is unlikely to win any prizes in this contest.

Why the other browsers won't get IE's score

[Skuto]

1) The false positive rate of IE is very high. It should be obvious that if you give a lot of false warnings, users will disable or ignore the feature, making it worthless. IE already warns if you download something uncommon, for crying out loud.

2) This "cloud based protection", tracking, among other things, popular downloads, means that info about visited URLs gets sent to Microsoft. There are privacy issues with such a system.

Re:missed the 'many' times before...

[Riceballsan]

Well it is true that this is at least the second time Microsoft has proven that IE blocks more dangerous URLs, but the bigger question is, which browser actually catches infections from the URLs. Via this study it would consider me browsing to a site infected with a script that can't even have a chance of infecting my computer as a failure (say whatever vulnerability the site attempts to take advantage of was already patched 3 years prior, or never even effected the browser being tested). While simultaneously ignoring the risk of infections from legitimate sites that chose to display the wrong advertisement, or were hacked.

Re:And who paid for this study?

[Matheus]

...and I respectfully ask: Who cares?

The study is comparing the latest released versions of the major browsers to show who can handle current threats. IMHO if you are still using an outdated browser then you have no right to feel all warm and fuzzy with your security.

Step 1: Upgrade to latest version of browser of your choice.
Step 2: THEN decide if this study gives you reason to want to switch to IE (of said latest version)

I predict you didn't RTFA and are doing exactly what Parent said only trying to sound smarter about it.

Well duh

[davidbrit2]

You try delivering malware through all those Javascript and CSS compatibility issues.

Who uses IE 9?

[westlake]

Wrong question with "firefox is better", etc etc. The real question is, who the hell uses IE9 in the first place?

About 7 in 10 Windows 7 users in the states.

As we've mentioned before, Microsoft skipped XP support for Internet Explorer 9 in order to compete more effectively on Windows 7. In July on Windows 7, Internet Explorer 9 hit 18.5% share worldwide and 24.8% in the United States. There are indications that this strategy is working. Although Internet Explorer lost usage share on XP, on Windows 7, Microsoft increased global usage share, going from 54.6% in June to 54.8% in July. And in the U.S., Internet Explorer share on Windows 7 grew 0.6% to 68.1%.

Browser Wars [August 1, 2011]

I dont' care how good it is at "blocking malicious content" if the underlying OS is still completely unsafe, which is due to what consumers put on their PC's.

Unpatched 0%
Vendor Patch 100%

Microsoft Windows 7 Solution Status (Based on 28 advisories from 2011)

Re:Who uses IE 9?

[westlake]

Secunia also posts stats on IE 9:

In 2011:

Three advisories, all patched by Microsoft. Two "Highly Critical," one not critical at all. Vulnerability Report: Microsoft Internet Explorer 9.x

This story caught my eye as well:

For the very first time in its history, the top 10 rating of vulnerabilities includes products from just two companies: Adobe and Oracle (Java), with seven of those 10 vulnerabilities being found in Adobe Flash Player alone. Microsoft products have disappeared from this ranking due to improvements in the automatic Windows update mechanism and the growing proportion of users who have Windows 7 installed on their PCs.

Kaspersky Lab: Turbulent quarter as hacktivism increases

Re:Who uses IE 9?

[Bert64]

IE has disappeared from this ranking because it is no longer ubiquitous enough to be worth targeting, having something like a 40% market share, while flash player, adobe acrobat reader and java are installed on well over 90% of systems (including non windows systems).

Hackers will always target software with the largest market share, because the more potentially vulnerable systems that exist the more an exploit is worth. It's only good business.

Microsoft have not really disappeared, because the vast majority of software being exploited still runs on their platforms. And part of the problem with adobe/java is that microsoft don't provide a centralised update mechanism that they could hook into.

Browser versions???

[aglider]

The choice is quite interesting ... Opera 11 dates back to 16.12.2010 and Safari 5 to 17.6.2010.

Mozilla Firefox v4 entered the "end of life" on May 25, 2011.
Chrome 12 dates back to 07.06.2011, but that's v12.0.742.

Without proper version numbers all those tests are at least dubious.

Re:Browser versions???

[Yvan256]

They tried to use recent version numbers but Firefox wasn't willing to tell them which version it was and Chrome had the time to go up three major versions by the time their download was done.

Re:Browser versions???

[hkmwbz]

Your comment isn't even making any sense. Tell them what? You're saying that NSS Labs is unable to read "About Firefox"? Geez, these NSS Labs people sure are incompetent.

Re:Browser versions???

[aglider]

If they were able, why didn't they put proper version numbering?

If they were not, why are they still alive?

Would you run on a Chevy Avalanche "21st century"? Or would you like to know whether it's 2001 or 2006?

Re:Browser versions???

[hkmwbz]

The simple fact is that NSS Labs is a bunch of cheating liars who are actively lying and shilling for Microsoft. That is why all these problems appear with their tests. The tests aren't real. They are fake, and are made as marketing material for IE.

Is it safer than FF + NoScript + GNU/Linux?

[impaledsunset]

Is IE9 safer than Firefox + NoScript running on a non-Windows operating system that's less targeted by malware authors?

Re:And who paid for this study?

[amicusNYCL]

I'm fairly sure both Firefox and Chrome are the safest browsers out there

Well shit, man, what the hell are you doing? Have you contacted the authors of the study to inform them that you are "fairly sure"? I'm sure this is information that will be useful to them. All they have now are one thousand, one hundred and eighty-eight data points for each of five browsers, I doubt they even allowed themselves to dream that you would be "fairly sure" about what they were trying to study. I'm fairly sure that they only reason they didn't contact you first to get your input was because they never dreamed it possible.

especially if you use Adblock and NoScript

Don't look now, Sport, but AdBlock and NoScript aren't part of Firefox. I know this because my installation of Firefox doesn't include either of them. If Mozilla wants to enjoy the benefits of those extensions for studies like this one then they should merge them into the trunk. Any respectable study should test the vanilla browser as it ships from the vendor, without changing any defaults.

It should be zero surprise to anyone that Microsoft puts a heavy focus on security for IE9+. Microsoft has been hammered for a long time about IE's poor security, if there's any single browser vendor that would put a disproportionate amount of development work into security features, it's Microsoft. Hell, that's probably why they still lack support in other areas.

Firefox add-ons anybody?

[Synerg1y]

Essentials:
NoScript
Greasemonkey
Tor

Useful:
bugmenot
betterprivacy

I don't think IE9 is capable of reproducing anything except the Tor button listed above, and in terms of security these add-ons make a world of difference.

Here's the downside, mom & pop have no idea what I'm talking about here, and most require technical knowledge. So in customization vs. practically, the latter tends to win, so I guess I can only agree with the article 50%, and blame the other 50 on ignorance.

That's wonderful but...

[Nethemas the Great]

Did anyone bother fixing the obnoxious memory leak that doubles the browser's footprint every 30 minutes?

Re:And who paid for this study?

[Jorl17]

I am sorry, I don't live in America so I can't follow your lack of culture or your references. Never did I say, by the way, that Microsoft was to be blamed. I merely pointed an obvious fallacy in Bonch's arguments. Unlike you, though, I'm not an Anonymous Coward. I also loved the way you showed how you hate Christians and Jews. Fine with me, I'm an atheist, but I'm sure you have valid reasons for being a tiny dick lover.

Re:And who paid for this study?

[Jorl17]

And I know I can count on you Anonymous Coward, my love. How's the paycheck from Microsoft? Is it that time of the month again?

Re:For all of you who DON'T use IE9

[Skuto]

My experience with IE, which I do use, is that you get a "xxx.exe is not commonly downloaded and could harm your computer" as soon as you download anything that isn't popular software. Given that this provides zero useful information, I would expect most users to completely disregard it after a while.

And I bet, correction, I'm sure the study result won't look so good in that case.

Without more information about the false positives encountered, I'd consider it worthless for an objective evaluation.

Re:wrong question

[hedwards]

I disagree, Windows has been dumbed down to the point that it's a valid criticism to make. MS has had an incentive to make sure that users aren't smart enough to be able to switch to another OS. And it seems to be working quite well.

Re:How come?

[Aelyew]

I thought about trying to replicate the experiment but ran into a couple of snafu's.

1. The comparison was between IE9 and Firefox 4 (other browsers as well, but Firefox is the one I typically use).
2. The current version of Firefox is 6.0 -- 6.0 might not have been available at the original time of the study but 5 was. I'd prefer to test the latest and greatest, so it should be a comparison between IE9 and Firefox 6.
3. Microsoft won't let me install IE9. Apparently I would have to upgrade to Windows 7 in order to run their latest version of their web browser.

Guess I can't conduct the test.

Why is this so hard to believe?

[brainzach]

If Google Chrome was found to be the best at blocking malicious content, no one would doubt this study.

There is no reason why Microsoft can't have the safest browser on the market. If the Microsoft was smart, they would invest heavily in security to undo the years of damage IE6 caused to its reputation.

This still could be a flawed study, but people shouldn't be so quick to judge just because Microsoft is the winner.

Re:Why is this so hard to believe?

[_0xd0ad]

It has nothing to do with blocking or thwarting malicious CONTENT. It is about Microsoft's feature where it phones home to see if every ADDRESS you're visiting is "evil". Evil content on a "good" address doesn't get detected until Microsoft figures out that it's bad, and if a good address gets falsely reported as "evil", it gets blocked too.

I'd be much more interested in a study that didn't rely on the browser telling me "I'm sorry, I can't let you do that" and indicated a truer statistic of how many infections actually result from visiting "evil" websites. For all I know, every webpage that got past IE's URL blacklist might have pwned the machine, while Chrome, Opera, and Firefox let you visit all of the sites without ever actually getting infected. So until I know how many infections occurred, this study is nothing but propaganda for IE's phoning-home feature.

Re:Why is this so hard to believe?

[brainzach]

You are assuming that because it is from Microsoft, it must be very bad at preventing infections while giving other browsers the benefit of the doubt. It is a completely biased accusation made off baseless assumptions.

The type of content that were blocked were social engineering attacks where you are equally vulnerable on all browsers. Chrome or Firefox is not going to prevent a user from downloading FreeRingtones.exe and infect their computer with malware.

Re:Why is this so hard to believe?

[_0xd0ad]

You are assuming that because it is from Microsoft, it must be very bad at preventing infections while giving other browsers the benefit of the doubt.

I'm not assuming anything, merely stating that in the worst-case it could be exactly the opposite of what this study would seem to indicate. Or anywhere in-between. This study didn't study the correct criteria.

Re:Why is this so hard to believe?

[brainzach]

The study analyzed the correct criteria for social engineering attacks because they exploit the weaknesses in the users instead of the weaknesses of the browser. You can assume that users are equally as vulnerable if the malicious website is rendered the same on all browsers. If there is a download free wallpapers button, a web browser is not going to prevent a user from clicking on it.

Assuming that IE9 just blocks every website is absurd. If that was the case, it would be mentioned in the article. It would be interesting to get these statistics, but you can't really make judgments when you have no information.

Re:Why is this so hard to believe?

[_0xd0ad]

The study analyzed the correct criteria for users who will click every link, download every file, and will install every codec or wallpaper so that they can see the dancing kitties. Oh, and they don't have any antivirus.

The study analyzed the correct criteria under the assumption that the only barrier between a user and the big bad internet is the URL blacklisting in their browser.

In other words, it's useless. And it's especially useless for me and anyone I've tried to influence toward halfway-sane safe online practices.

Re:Why is this so hard to believe?

[brainzach]

It made no assumption that it was the only barrier or that IE9 was the best in every security measure. It says that it is the most common form of malware out there.

Have you seen the average Internet user? They have a hard time determining if a download is from a reputable source or not.

If you are smart enough to be able to determine if a download is safe, then other browsers could be more secure for your needs. However, for the average user, having a whitelist/blacklist is very valuable informing how to safely browse the Internet.

Re:Why is this so hard to believe?

[_0xd0ad]

It made no assumption that it was the only barrier or that IE9 was the best in every security measure. It says that it is the most common form of malware out there.

I assume that by the 2nd "it" you mean malware that spreads via social engineering.

Social engineering has to do with getting someone to click a link. However: clicking a link should never infect your computer. At the worst, it might download a file to your computer which, if your antivirus doesn't catch it and you run it, could infect your computer.

Keeping someone from visiting a website because it's "bad" and they're too dumb to safely visit it is a stupid defense mechanism required only for the very stupidest of users. Or it is an admission that your browser is so exploitable that it can't load parts of the internet safely. And that's why I think this study is pretty useless.

OMG its fake!

[xyourfacekillerx]

Apparently on Slahsdot, the scientific method has no merit when the result favors Microsoft somehow.

Forget that these tests are repeatable, and can be independently conducted and verified most of the "OMG M$ SPONSORED MICROSOFT FAKE STUDY = ADVERT" crowd ignores this fact.

How do you know how much M$ paid these people, anyways? Prove it. Like, with pictures. Better yet, maybe some shredded invoice numbers and accounting figures from M$ headquarters trash dumpsters? Seriously some of these claims are so paranoid and out of line with reality one wonders if some of the postsers are not just some psycho homeless people happening upon an open laptop at starbucks.

Re:OMG its fake!

[hkmwbz]

Apparently on Slahsdot, the scientific method has no merit when the result favors Microsoft somehow.

What scientific method? There's no science in this "report." It's pure pseudoscience. The results are not repeatable, the data is not available for independent analysys, there are huge methodology flaws, etc.

Forget that these tests are repeatable, and can be independently conducted and verified

Except they can't. Do you work for NSS Labs? They have a history of astroturfing and lies in public.

Re:And who paid for this study?

[PortHaven]

I must admit, Microsoft is showing a lot of positive progress.

1. Windows 7 was a big improvement in stability & usability. (I can't attest to security as I pretty much never have been infected since 98 days).

2. IE 9 is actually showing itself somewhat impressive on HTML5 rendering, and more...

--

Rather than demonize Microsoft, I think we should laud them in finally starting to turn the ship around (technically) if not (ideologically).

Once upon a time

[Evets]

There was a time when a headline like this never would have made the front page of slashdot. It's because of this kind of thing that I only come back to slashdot on the rare occasion that I have run out of other things to read on the internet. And what's this? Addthis.com showing up in noscript? Please, bring back the quality!

Just Social Engineering Malware

[sigmabody]

The study was just concerned with links which prompt you to DL/install something malicious. Of course IE wins: it's the only browser with a built-in link check which validates the links you're going to with MS's servers.

Or, alternatively, you could just not install malware, that would work too. The study is kinda valid, though; if you're too dumb to not install/run random junk from suspicious sites online, you should probably be using something which blocks them for you, IE SmartScreen, anti-"virus" app, or otherwise.

Re:And who paid for this study?

[WrongSizeGlass]

...and I respectfully ask: Who cares?

Since XP can't run IE 9, and a significant percentage of PC's are still running XP or a derivative thereof, IE 9 shouldn't be the only version of IE tested. With the number of add-ons that broke with the upgrade to Firefox 4, and the upgrade to Firefox 5, there is a significant percentage of Firefox users who are not using Firefox 4 or Firefox 5 or even Firefox 6 (which was released this week).

Testing the latest browsers is good for somethings, but the browsers they tested make up a minority of the browsers running on PC's. Even testing IE 7 & IE 8, and earlier versions of Firefox, in order to use those figures as a catalyst to upgrade to IE 9 (for those who can) or Firefox 4 or 5 or 6 would have been helpful.

Step 1: Upgrade to latest version of browser of your choice.
Step 2: THEN decide if this study gives you reason to want to switch to IE (of said latest version)

Not possible for a significant portion of Windows users, and those Firefox users who require one or more add-ons that hasn't been upgraded yet are stuck as well (and with the current rush by Mozilla to catch Chrome's major release number some add-ons could be left far behind or break on a regular basis).

I predict you didn't RTFA and are doing exactly what Parent said only trying to sound smarter about it.

I RTFA and even read the PDF before posting. I'm not bashing, dismissing or casting skepticism on MS or IE. I called for testing Firefox 3 as well, and didn't bother about earlier versions of the other browsers because they either don't have enough of a market share (Opera or Safari) or they are automatically updating to the latest version on their own (Chrome).

IMHO testing the latest browsers for HTML5 or ACID3 compatibility makes sense, but not testing the majority of browsers installed on PC's for security doesn't. It's not like older versions are hard to get, and they can be installed in a VM easily so they aren't hard to run either.

Re:And who paid for this study?

[Sigma 7]

The latest version of Chrome now allows you to run individual plugins if necessary. This is useful for running just one embed and not things on the side.

However, it took a few versions to get that right - almost as if the developers never heard of the flash banners that took 200% CPU.

Re:And who paid for this study?

[jedidiah]

This isn't about ideology. This is about experience.

You would like to pretend that our biases are not borne out of some rational basis but they are.

Trust is earned over a long period and Microsoft just isn't there yet.

Malicious URL

[andrew3]

Can NSS define a "malicious URL"? It appears to be based on website reputation. However, do these so called "malicious URLs" achieve installing malware on other browsers?

It seems that Microsoft is trying to win by tracking the entire web for malware, and basing its protection on that. That doesn't exactly signify a "secure product".

I suppose it might prevent users from installing every ActiveX and .exe file they come across on the web... but the only real solution there is education.

Unfortunate choice of words...

[Genda]

"Microsoft's Internet Explorer 9 has proved once again to be the best choice when it comes to catching attacks..."

Is that "Catching" like "Aha! I caught that wascawy wabbit" or is it "Catch" like "If I connect this PC to the internet for a couple minutes without loads of anti-virus protection and a beefy firewall, IE will catch something really nasty..." or even "Catch" like "A filter on a drain, a low place where nasty things tend to accumulate...". Because inquiring minds want to know!.

This isn't to say that IE9 isn't a lovely product, but if you're going to tout it, you might want to say it in a way that makes people clear about what you're saying at first glance. Just a suggestion :-)

Re:And who paid for this study?

[cavreader]

And why should MS give a shit about whether you trust them or not? I would say the MS dominance on desktop systems for the past 25+ years demonstrates that honesty doesn't really effect the bottom line. And you are right about experience being important and if MS has anything it is a wealth of experience to fall back on when necessary. Their latest product offerings have actually been pretty decent. Since IE9 got a positive review the naysayers are convinced that the study conducted was faulty. If IE9 had come up last everyone would be praising the study and it's methodologies.

FF with AdBlock NoScript installed or without?

[Kaz Kylheku]

Important question.

FireFox is a platform where we have these things called addons.

NoScript prompts you before running any piece of Javascript, classified by the site it came from.

vulnerability in the browser?

[microphage]

"Microsoft's Internet Explorer 9 has proved once again to be the best choice when it comes to catching attacks aimed at making the user download Web-based malware .. Windows Internet Explorer 9 (IE9) caught an exceptional 99.2% of live threats: .. Google Chrome 12 caught 13.2%5" link

Once these attacks got past protections what damage did the 0.80% of malware that got past IE9, do to the underlying Operating System and what were the effects of the 86.8% of malware that got past Chrome running on Ubuntu? And why is slashdot giving this self serving BS space on its website?

Re:vulnerability in the browser?

[dokc]

And why is slashdot giving this self serving BS space on its website?

It would be embarrassing if this story is trumpeted around even on TV and not mentioned on Slashdot.

Re:And who paid for this study?

[cspankne]

using a competing browser's search engine may not be the best place to get unbiased evidence while searching for proof or disproof of a potentially biased study. Who woulda thunk it, but if you type "NSS Labs" into Bing, you get evidence that confirms the NSS labs reports.

I'm not sayin', I'm just sayin'.

Re:And who paid for this study?

[oztiks]

I think someone should point out clear the difference between the term "Blocking" and the term "Unable to render".

What, 4 days out of date?

[Sycraft-fu]

Ok I jest but seriously, FF 4 was current until about a month and a half ago. That a study was using it is unsurprising, it probably was current when they set up the study.

Re:And who paid for this study?

[smash]

Thing is, neither firefox nor chrome do sufficient badware filtering. Neither is as configurable via group policy to allow scripts to run on sites that you need to run scripts, yet put other sites in less trusted zones.

Out of the box your assertion may hold water, but in the real world where you're trying to enable crappy internal third party web applications to work, I suggest that IE is easy to secure.

Telling users to totally turn off scripting, etc isn't really feasible if they need that functionality to work.

User base doesn't matter

[unixisc]

One methodology could be to test the last 3 versions of a browser - IE6-9, FF3-5, Opera 10 & above and so on. But one assumption here is that the latest version of any browser would have the maxumum #fixes, since it would have all the cumulative fixes of predecessors, plus the new ones. So naturally IE9, FF5 and other latest versions would have the latest & greatest security fixes. Since they were measuring which browser did the best job in blocking the maximum # malicious URLs - 1188 of them - it's irrelevant how many of those copies are out in public. There could be a browser that has only 1 user, but if it blocked all 1188 of them, it would be better than IE9 or Chrome. So the fact that IE9 doesn't run on XP, or that IE7 would be the most popular on XP, is tangential to whether IE9 is more secure or not.

Because ...

[ancienthart]

almost no-one uses it?

Re:For all of you who DON'T use IE9

[Neil Boekend]

xxx.exe sounds like a porn executable. I wouldn't trust that!

Re:Turn off Javascript already!

[Neil Boekend]

With the Classic Discussion on (and Noscript) I can read everything, although I can't mod nor vote in the Firehose.

That's Rigged!!!

[tyler.russell]

Microsoft paid some mother suckers to conduct this study! Take this down Slashdot! That's like Apple saying OS X is the most secure, advanced OS in the world - It is....compared to Windows 3.11.....LOL!

Re:And who paid for this study?

[dokc]

So we should use Microsoft search engine?!
Independent of the used search engine, in the first 100 results you will mostly find parrot "news agencies" and "computer expert bloggers" repeating over and over again the same story.
Is the Internet noise the evidence confirming the NSS labs report? Or you say: "If you repeat a lie long enough, it becomes truth."

Re:And who paid for this study?

[dokc]

Their latest product offerings have actually been pretty decent.

Do you think the last shitty Office versions are decent?

Re:And who paid for this study?

[bioster]

Well, there are some suspicious things about the report itself, too.

They start with 5000 URLs, but only 1188 URLs "passed our post-validation process and are included in the results". This is certainly an opportunity to add bias. IMO, an honest report should be as transparent as possible when showing their inputs, because selecting your inputs to a test has a huge effect on the test itself. I'm not sure why they had to prune the URLs at all, to be honest. (They mention that it gets pruned if it becomes unavailable which is fine I guess, but there were other reasons they pruned as well.)
Also, it would have been nice to include the actual list of URLs used. They do mention they saved the content of the pages, so hopefully if anyone were to audit them those would be available.

The next suspicious thing are the results themselves. When I go look at CPU benchmarks I expect numbers like "CPU A trails CPU B and only gets 90% of the speed" when we're talking about fairly competitive products. (Actually with CPUs I usually expect much closer numbers than that, but whatever.) To get numbers like 99.9% for IE9 (Malware URL Response Histogram) and 12.7% for the next highest product... well, that makes me wonder. The gap is just suspiciously large. It looks to me like either they're specifically testing a feature that IE9 has that other products don't, they've massaged the inputs, or they've gimped the competition in some way. At least, that's what I immediately start thinking when I read numbers like that.

Additionally, they only seem to be measuring the rate at which bad URLs get blocked (you can figure out the False Accept Rate - FAR from this), and that's an incomplete story. We also need to know how often the browsers block something that they shouldn't have (False Reject Rate - FRR). To take an extreme example of why we need to know that, imagine an algorithm that just blocks everything. You'll get 100% malicious URLs blocked and have a 0% False Accept Rate. However, that's obviously wrong... you'll also have a 100% False Reject Rate. All they say about this is "Periodically, clean URLs were run through the system to verify that the browsers were not over-blocking".

Re:And who paid for this study?

[ConceptJunkie]

I'm a Christian, but I can assure you I'm highly concentrated.

Re:And who paid for this study?

[cavreader]

I have never been a big Office user except when it involves creating interfaces between it and custom consumer applications so my opinion on the latest release from a user perspective is pretty shallow. I certainly don't use all of the functionality in Office but I can't recall having any issues with creating documents, spreadsheets, or PowerPoint presentations. On the other hand IE8/9 has been easier to target in multi-browser application development projects. Windows 7 seem pretty stable both at home and at work, including the security aspects. The latest development tools also seem to be pretty good. Things like the ASP.NET MVC framework and the MS Enterprise Library provides excellent application cross cutting functionality and saves a ton of development time.

Re:And who paid for this study?

[Jorl17]

Note: I wasn't pointing that to America but to the AC. As far as I'm concerned, I *WISH* I lived in America. Good to see you too, AC.