IE 9 Beats Other Browsers at Blocking Malicious Content

Orome1 writes with an article in Net Security. From the article: "Microsoft's Internet Explorer 9 has proved once again to be the best choice when it comes to catching attacks aimed at making the user download Web-based malware. This claim was made by NSS Labs in the recently released results (PDF) of a test conducted globally from May 27 through June 10 of the current year, which saw five of the most popular Web browsers pitted against each other. Windows Internet Explorer 9, Google Chrome 12, Mozilla Firefox 4, Apple Safari 5, and Opera 11 were tested with 1,188 malicious URLs — links that lead to a download that delivers a malicious payload or to a website hosting malware links."

Comments

Re:I still think...

[Nimey]

How secure can Emacs be with all that malicious Lisp code floating around?

Who paid?

[benjymouse]

This report was produced as part of NSS Labs’ independent testing information services.
Leading vendors were invited to participate fully at no cost, and NSS Labs received no
vendor funding to produce this report.

Firefox still does not have a sandbox in place. That right there is a severe problem. Especially as Firefox is *the* browser with most vulnerabilities. The only thing Mozilla has going for Firefox security is that they are really fast to patch once a vulnerability has become known.

Re:Who paid?

[Jeremiah Cornelius]

You have a valid point about the sandbox - but the study doesn't really do security a justice, when comparing the browsers.

Malware is seldom a browser injection issue, but is instead vectored through plug-ins (I'm looking at YOU, Adobe!) which are privileged at a higher-level than the "sandboxed" container application.

Flash has been a real horrorshow. It was never designed - rather acquiring tacked-on and retro-fitted capability for dynamic content updating, video playback and scripting with user interactivity, etc.

I could deliver extended anecdotes about the 0-day flash and pdf exploits that I've witnessed, unfolding right in front of me... Suffice it to say, fully patched systems with browser sandboxes are not immune. :-)

The combination of security and privacy extensions that are developed for Firefox are, still, unmatched. Ghostery, AdBlock+ and BetterPrivacy will together prevent the opportunity to ever render many of the malicious, content delivered exploits. They also serve to screen and scrub the most pernicious of web-threats: covert bugging and monitoring of the browser by a third party.

Re:Who paid?

[benjymouse]

Citation please? Actually don't bother, because the statement is impossible to support with any amount of evidence.

2008: http://www.favbrowser.com/firefox-browser-with-the-most-disclosed-vulnerabilities/

2009: http://tech.blorge.com/Structure:%20/2009/11/09/firefox-leads-in-browser-vulnerabilities/

2009: http://www.computerworld.com/s/article/9140582/Firefox_flaws_account_for_44_of_all_browser_bugs

You can also query Secunia for vulnerabilities. With the new version number scheme and ultra-fast previous versions retirement (where you are left vulnerable if you don't upgrade immediately), you'll have to grok the numbers somewhat. Basically count the *unique* CVEs affecting all FF versions since -say FF3.5. Do the same for IE8&9. You will not like the result.

Firefox is the only major browser that openly reports vulnerabilities so of course it is going to have the highest publicly countable number.

BS. All the major vendors are obligated to report vulnerabilities through Mitre. All browser vulnerabilities are assigned unique CVEs.

And even if you had an accurate count of known vulnerabilities from the other vendors, known vulnerabilities hardly equates to total vulnerabilities, even less so when every vulnerability is counted as equal to every other one.

If you consider a set of browsers which must be assumes to receive an equal amount of scrutiny (IE,FF,Chrome), if one browser year after year comes out with most vulnerabilities, surely that does say something about code quality.

Re:Who paid?

[benjymouse]

You have a valid point about the sandbox - but the study doesn't really do security a justice, when comparing the browsers.

Malware is seldom a browser injection issue, but is instead vectored through plug-ins (I'm looking at YOU, Adobe!) which are privileged at a higher-level than the "sandboxed" container application.

No. These days some 85% of infections derive from social engineering. Malware comes in through the user. Vulnerability exploits seems to be a lot less effective these days. Social engineering is precisely what the tested security (reputation) mechanisms are aimed at.

Having said that, yes, Flash is really, really bad. So is Java. And both are rather prolific, regrettably.

I could deliver extended anecdotes about the 0-day flash and pdf exploits that I've witnessed, unfolding right in front of me... Suffice it to say, fully patched systems with browser sandboxes are not immune. :-)

That piques my interest. When was this? AFAIK there has not been a *single* in-the-wild sandbox breach of neither Chrome nor IE (yes, pwn2own demonstrated a combination of 3 techniques which escaped the IE sandbox - but this has not been reported in the wild). Up until some (fast) versions ago, Chrome did not sandbox Flash. IE did that since IE7.

The combination of security and privacy extensions that are developed for Firefox are, still, unmatched. Ghostery, AdBlock+ and BetterPrivacy will together prevent the opportunity to ever render many of the malicious, content delivered exploits. They also serve to screen and scrub the most pernicious of web-threats: covert bugging and monitoring of the browser by a third party.

Whether they are unmatched is a matter of opinion. Firefox requires addons and will block more broadly (which is desirable to some). To me, the fact that FF code quality seems to lack (they have had most vulns reported for the last 5 years going) combined with their nonsensical refusal to implement a sandbox makes it a no-go for me. (I'm, using Chrome, btw).

Re:Who paid?

[Bert64]

No. These days some 85% of infections derive from social engineering. Malware comes in through the user. Vulnerability exploits seems to be a lot less effective these days. Social engineering is precisely what the tested security (reputation) mechanisms are aimed at.

An even better defence against such attacks, is Apple's model... If you can't install/execute anything that's not come from a trusted source, social engineering simply isn't going to work...

People who aren't sufficiently technically competent to understand the dangers of social engineering and not fall for such scams, should only be using walled garden type systems such as Apple's. Current complex computer systems are just totally unsuitable for the vast majority of people.
However what i will say, is that there should be a good selection of such systems, each operated by different gatekeepers. Having a single monoculture is a very bad thing.

In an ideal world, the majority market would be split evenly between 3/4 such players e.g. iOS/android/wm7/symbian, all of which come locked down by default and with non technical people using these. Then there would be non locked down, "advanced" versions of these systems available to those who understand how to use them properly and safely... Perhaps make the process of unlocking difficult so that only technical people will be able to do it on their own, and its won't be practical to social engineer someone through the process.

Re:Who paid?

[Bert64]

BS. All the major vendors are obligated to report vulnerabilities through Mitre. All browser vulnerabilities are assigned unique CVEs.

Browser vendors are not obligated to do any such thing.
Firefox reports every vulnerability discovered, even those discovered in alpha and beta versions (which is a normal function of beta testing)... By contrast, commercial software is rarely available to the general public at all until a late beta stage, bugs found and fixed during the early development phases will never be disclosed to the public.

Commercial companies, not just browser makers, generally only admit to vulnerabilities which have (or are threatened to be) independently published, because admitting to vulnerabilities is bad for business and not something any for-profit company would do if they have the chance not to. Vulnerabilities discovered internally, or those discovered by third parties who will not disclose them (e.g. NDA) are very unlikely to be made public...
Fixes may not be made available, or may be hidden in amongst other updates. There have been many cases of security patches for a disclosed vulnerability also fixing an unpublished vulnerability, as well as newer versions of programs which include fixes for vulnerabilities present in older versions (with no equivalent patch being made available for the older version).

It's also worth noting that some firefox vulnerabilities are platform specific, where a browser such as ie only runs on a single platform there will be comparatively less vulnerabilities as a result of that too.

Re:Who paid?

[bunratty]

Secunia specifically states "The statistics provided should NOT be used to compare the overall security of products against one another. It is IMPORTANT to understand what the below comments mean when using the statistics, especially when using the statistics to compare the vulnerability aspects of different products."

Some companies, especially those with closed-source browsers, may not disclose all vulnerabilities they fix. The number of vulnerabilities fixed also doesn't take into account how severe the vulnerabilities are, or how long it took the vendor to patch them. Which would you rather use, a browser that has ten small vulnerabilities, all patched within days of being discovered, or a browser that has one severe vulnerability that has not been patched in months?

Re:Who paid?

[hairyfeet]

Riiight. Explain Mac Guardian then. Or the fact that OSX bites it in pwn to own first every. single. time. Protip: the first one to drop a machine get 10,000 USD so they are gonna go for the easiest target so they can get paid and since Windows Vista that AIN'T Windows. you might want to read this before you start touting Apple security.

As for TFA, is anyone surprised? MSFT has caught so much flak for holes in IE they really don't have much of a choice anymore they pretty much HAVE TO lock it down. It still won't get me to use it or recommend it to my users though. I hate the UI and after getting burnt by IE 6 and seeing how they are trying to tie IE to which OS you have instead of actually supporting those still not EOL'ed I think I'll pass.

I do have to give MSFT credit for one thing though...low rights mode. that was really smart and one of the reasons why I use a Chromium based browser (Comodo Dragon) and give it to my clients, as having the browser at the lowest possible permissions simply makes good sense. Why FF hasn't implemented this after FOUR YEARS is beyond me.

But since switching my users over to Windows 7 and The Dragon along with ABP I have watched the infection rates drop off the charts. So far I've only seen a single infection with that combo and that was from a moran who not only refused to listen to his AV but actually DISABLED IT when it wouldn't let him instal 'teh new Limewire". Which of course is nothing but a bunch of trojan downloaders with a badly skinned Gnucleus.

IE may win awards at blocking certain types but by abandoning IE after 6 for so long and leaving the web a mess they have years of bad will they are gonna have to overcome.Maybe once XP and Vista are EOL so that there is only one OS and only one IE to support things will be better, but for those that have to admin multiple flavors of Windows IE is just a PITA.

Re:And who paid for this study?

[bonch]

Prediction:

The results are favorable to Microsoft, so there will be a ton of skepticism, investigation, and outright dismissal. However, when studies favorable to this particular community's ideologies are announced, none of that occurs, even though the same kinds of skepticism can and should be applied.

Nice try

[Lysander7]

I almost believed this story, then, with my superior intelligence (as shown by my browser, Opera) I realized that this story is probably pulled out someone's ass.

Re:Nice try

[Errtu76]

Nice reference :)

Re:Nice try

[mckinnsb]

If by "pulled out of someone's ass" you mean "they engineered the test to perform best with Internet Explorer 9", then completely.

The main center-point of this test was evaluating a "cloud based trust ranking algorithm". But the study provides no evidence that these algorithmns exist in any of the browsers; its a simple assumption which is likely false (especially when you look at the graphs). What the graphs are really showing is the performance of each browser's black list versus a set of URLs they selected, and not randomly.

If you look at the graphs themselves, they actually don't show the action of any algorithm (which would likely linearly increase or show volatility); in fact, IE9 (With App Rep) is simply a straight line. It's pretty clear that the URLs they used were already in the black list before hand, and that straight line is a continual rejection of them.

Testing a browsers ability to 'blacklist' websites is fine, I guess, but my first problem with this study is that's not the only way to measure 'security'. My second problem is that there's no evidence that the browsers themselves actually perform this activity, making the tests in the study feel like "studying the maximum (flying) climb speed of humans, rats, horses, and bats". My third - and the most troubling - problem is that they don't provide any information as to how these lists were obtained. They only say they tried to "mix URLs so as to make sure that certain domains were not overemphasized", and "NSS Labs operates its own network of spam traps and honeypots.", in addition to "In addition, NSS Labs maintains relationships with other independent security researchers, networks, and security companies,".You can assume without being overly bold that this list could have been a list of URLs that they knew IE would block. Conversely, you could probably easily design a similar test that would have Chrome at 100% block rate, and IE 9 at 10% - it's merely a measure of "what sites were in our test pool that are also in the browser's black list"

Pffft.

If you block everything, your score is 100%

[Anonymous Coward]

MSIE got the highest "malware detection rate" because they used it in a mode where nearly every page is marked as "dangerous". It had the highest detection rate but also the highest false positive rate.

If I sit at the airport saying "that plane is going to crash" for every plane that takes off, and eventually get it right, that doesn't mean I'm able to predict which planes are going to crash (even though I got "100% of the crashes" right)...

Kind of correct.

[khasim]

The results are favorable to Microsoft, so there will be a ton of skepticism, investigation, and outright dismissal.

Yep. Mostly because Microsoft has a history of purchasing favourable "findings" from "independent" "research" firms.

However, when studies favorable to this particular community's ideologies are announced, none of that occurs, even though the same kinds of skepticism can and should be applied.

Kind of. The process and parameters should always be checked. But the other browsers do not have a history of their parent companies purchasing favourable "findings".

It's called "learning from experience".
There is no reason to forget every past instance when evaluating a new instance. Quite the opposite, in fact.

NSS Labs: The best studies money can buy

[thoromyr]

Of course, when your methodology is that only the bare browser configuration is allowed (e.g., no AdBlockPlus, no NoScript) and you carefully select the malware URLs (obtained from "honey pot" email addresses and then filtered, and then "prune out non-conforming URLs" -- without fully specifying what made them non-conforming) *and* require the malware URLs to be live for at least 6 consecutive hours it gets a lot easier to massage the results. To further exaggerate results not only does a "hit" increase the score but a "miss" decreases it to magnify the difference.

This is the same song as they sang about IE8 with the same, predictable, results. Microsoft didn't pay them a wad of money for this study for nothing.

Re:NSS Labs: The best studies money can buy

[The MAZZTer]

To be fair I can imagine a lot of Firefox users not even knowing add-ons exist.

Re:NSS Labs: The best studies money can buy

[cobrausn]

What is wrong with testing the bare browser configuration? Aren't we trying to protect those who are most likely to download malware by accident, i.e., those who are also unlikely to install AdBlockPlus and NoScript?

Re:And who paid for this study?

[bioster]

Frankly, the page itself screams bias with the line "has proved once again". I don't recall this being proved in the past, but hey, I try to be open minded. So I threw NSS labs into google, and immediately turned up:
http://www.thetechherald.com/article.php/200912/3268/Can-you-trust-the-NSS-Labs-report-touting-the-benefits-of-IE8

So apparently they tested IE8 and thought it was awesomesauce. Uhm, ok... I thought IE8 wasn't completely terrible but I wouldn't say it was good. That link seems to think NSS might be a microsoft shill. But ok, I like to be open minded. Let's keep looking. Going down the first page of my google search:
Firewall Vendors Challenge Findings of NSS Labs Report | PCWorld
Haavard - Malware report from NSS Labs manipulates statistics?
Google Responds to NSS Labs Browser Security Report | News
A recent test by NSS Labs gave a near-perfect score to Internet Explorer 9 beta and very poor marks to Chrome and other browsers.


So uhm... yeah... at first glance, I'd say treating them with some skepticism seems more than warranted here.

FF4 - How unfair!

[pseudorand]

Yet again another M$ sponsored study makes IE look better by using an ancient version of Firefox. FF4 is like way out of date. How dare they make such claims.

Re:FF4 - How unfair!

[TxRv]

There are a lot of problems with the study such as a small sample size, cherry-picking malware that IE does well against, lack of peer review, complete denial of the existence of layered security in the form of extensions or sandboxing, the complete lack of credibility of NSS labs, and the fact that Microsoft paid for the study. The versions used are not one of those problems. FF4 and Chrome 12 were the current releases at the time they tested the browsers. FF4 actually came out a few days after IE9. It's just that IE's "once every few years" release schedule can't compete with the versatility afforded by Firefox and Chrome's monthly major releases.

Re:NSS Labs is MS Shill

[Baloroth]

They also made a few technical errors in the report, at least surrounding Opera. At one point, they list "Opera 10" as having 6.1% block rate, yet earlier in the report they list that as the rate for Opera 11 and Opera 10's rate as 0.00%. That, combined with the absolutely gushing praise for IE9 and its App block (or w/e they call it) filter lead me to suspect quite strongly that this is just another MS paid add by an "independent" (i.e. not directly MS-owned) company.

No technical examination of any other browser's malware blocking was mentioned. Nor did they seem to do any testing of add-ons or extensions. I imagine Add-block alone probably blocks many malicious sites. Oh, and no list of URL's tested was given. Even if this wasn't horribly biased (which I doubt), it was terribly conducted technically speaking.

Re:How come?

[karnal]

I don't know, but I use my PIN number at the ATM machine all the time now!

Why the other browsers won't get IE's score

[Skuto]

1) The false positive rate of IE is very high. It should be obvious that if you give a lot of false warnings, users will disable or ignore the feature, making it worthless. IE already warns if you download something uncommon, for crying out loud.

2) This "cloud based protection", tracking, among other things, popular downloads, means that info about visited URLs gets sent to Microsoft. There are privacy issues with such a system.

Re:And who paid for this study?

[Matheus]

...and I respectfully ask: Who cares?

The study is comparing the latest released versions of the major browsers to show who can handle current threats. IMHO if you are still using an outdated browser then you have no right to feel all warm and fuzzy with your security.

Step 1: Upgrade to latest version of browser of your choice.
Step 2: THEN decide if this study gives you reason to want to switch to IE (of said latest version)

I predict you didn't RTFA and are doing exactly what Parent said only trying to sound smarter about it.

Browser versions???

[aglider]

The choice is quite interesting ... Opera 11 dates back to 16.12.2010 and Safari 5 to 17.6.2010.

Mozilla Firefox v4 entered the "end of life" on May 25, 2011.
Chrome 12 dates back to 07.06.2011, but that's v12.0.742.

Without proper version numbers all those tests are at least dubious.

Re:Browser versions???

[Yvan256]

They tried to use recent version numbers but Firefox wasn't willing to tell them which version it was and Chrome had the time to go up three major versions by the time their download was done.

Re:And who paid for this study?

[amicusNYCL]

I'm fairly sure both Firefox and Chrome are the safest browsers out there

Well shit, man, what the hell are you doing? Have you contacted the authors of the study to inform them that you are "fairly sure"? I'm sure this is information that will be useful to them. All they have now are one thousand, one hundred and eighty-eight data points for each of five browsers, I doubt they even allowed themselves to dream that you would be "fairly sure" about what they were trying to study. I'm fairly sure that they only reason they didn't contact you first to get your input was because they never dreamed it possible.

especially if you use Adblock and NoScript

Don't look now, Sport, but AdBlock and NoScript aren't part of Firefox. I know this because my installation of Firefox doesn't include either of them. If Mozilla wants to enjoy the benefits of those extensions for studies like this one then they should merge them into the trunk. Any respectable study should test the vanilla browser as it ships from the vendor, without changing any defaults.

It should be zero surprise to anyone that Microsoft puts a heavy focus on security for IE9+. Microsoft has been hammered for a long time about IE's poor security, if there's any single browser vendor that would put a disproportionate amount of development work into security features, it's Microsoft. Hell, that's probably why they still lack support in other areas.

Re:And who paid for this study?

[Jorl17]

I am sorry, I don't live in America so I can't follow your lack of culture or your references. Never did I say, by the way, that Microsoft was to be blamed. I merely pointed an obvious fallacy in Bonch's arguments. Unlike you, though, I'm not an Anonymous Coward. I also loved the way you showed how you hate Christians and Jews. Fine with me, I'm an atheist, but I'm sure you have valid reasons for being a tiny dick lover.

OMG its fake!

[xyourfacekillerx]

Apparently on Slahsdot, the scientific method has no merit when the result favors Microsoft somehow.

Forget that these tests are repeatable, and can be independently conducted and verified most of the "OMG M$ SPONSORED MICROSOFT FAKE STUDY = ADVERT" crowd ignores this fact.

How do you know how much M$ paid these people, anyways? Prove it. Like, with pictures. Better yet, maybe some shredded invoice numbers and accounting figures from M$ headquarters trash dumpsters? Seriously some of these claims are so paranoid and out of line with reality one wonders if some of the postsers are not just some psycho homeless people happening upon an open laptop at starbucks.

Re:OMG its fake!

[hkmwbz]

Apparently on Slahsdot, the scientific method has no merit when the result favors Microsoft somehow.

What scientific method? There's no science in this "report." It's pure pseudoscience. The results are not repeatable, the data is not available for independent analysys, there are huge methodology flaws, etc.

Forget that these tests are repeatable, and can be independently conducted and verified

Except they can't. Do you work for NSS Labs? They have a history of astroturfing and lies in public.