Slashdot Mirror
Microsoft Says IE9 Blocks More Malware Than Chrome
CSHARP123 writes "In a move that's sure to raise some eyebrows, Microsoft today debuted a new web site designed to raise awareness of security issues in web browsers. When you visit the site, called Your Browser Matters, it allows you to see a score for the browser you're using. Only IE, Chrome, or Firefox are included — other browsers are excluded. Not surprisingly, Microsoft's latest release, Internet Explorer 9, gets a perfect 4 out of 4. Chrome or Firefox do not even come close to the score of 4. Even though the web site makes it easy for users to upgrade to the latest version of their choice of browser, Roger Capriotti hopes people will choose IE9, as it blocks more malware compared to Chrome or Firefox."
Of note in the Windows Team post is that the latest Microsoft Security Intelligence Report discovered that 0-day exploits account for a mere tenth of a percent of all intrusions. Holes in outdated software and social engineering account for the majority of successful attacks.
NoScript blocks more malware than either.
Give me Classic Slashdot or give me death!
I've seen the same data from Mcafee, and it was really something. For every computer exploited using a Windows flaw, 100 are exploited using Flash. Acrobat Reader and Java are the other major culprits.
In a lot of ways, browser security itself has never been better. There's several highly capable ones out there in this area. The weak link is some truly terrible plugins.
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Then I would feel really safe while conducting my online activities.
It might have been informative. Seriously, when you accuse Chrome of not meeting the requirement,
"Does the browser help protect you from websites that are known to distribute socially engineered malware?"
when google's anti-malware service is the basis for at least two browsers, and predates IE's effort by at least a year (probably more like 2), it sort of hampers your credibility.
Actually, their site doesn't even work with Chrome 15.x on Linux. So I think my browser is securing me pretty darn well.
This just in, all our competition sucks, news at 11.
Gonzo Granzeau
"Nothing the god of biomechanics wouldn't let you into heaven for.." -Roy Batty
Goddamn that site hurts my eyes. Looks very similar to the Metro UI.
"The true measure of a person is how they act when they know they won't get caught." - DSRilk
for reasons not to choose IE. IE9 may be better than earlier versions, it also breaks on more stuff than ever before...
So what about Microsoft's claims. Is Internet Exploder 9 standards compliant? I tested a design in IE8 and ONLY IE managed to screw up CSS drop down menu, needing Javascript to get around the stupid IE bug. Meanwhile Firefox, Chrome, Chromium, Opera and Safari in Win, Linux and iPad all render properly.
Nobody cares about Microsoft's claims if they can't even be bothered to fix BASIC rendering bugs, it's 2011 not 1990. That's why Microsoft are losing to the competition.
Take Nobody's Word For It.
We do not have any data for your browser, so we can’t give your browser a score. SEE HOW OTHER BROWSERS SCORED >
Is there something that just runs something like the Unix "strings" command on the page, and then greps out the tags? That should leave just the text. OK, you'd have to gzip chunked HTML and deal with a few other low level details to get the text. Maybe this is already built into Lynx; but having a Lynx-like mode as the default, with an option to enable some tags... that'd be inherently very secure, as opposed to running around and putting out fires.
If a billion IE users browse the web and 100 million Chrome users do the same, sure ... it is not unlikely that IE blocks more malware.
Admitted, that was a lame joke ...
However, if MS had not slept and ignored security the last 25 years, we had not that much malware, or had we?
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
They thought Firefox 4 with noscript on Ubuntu was Firefox 7!
I'd be more inclined to read a story entitled "CompanyX says their new product is crappier than the competition and far worse than the previous release".
What these guys are touting is IE9's "SmartScreen" protection which claims to "block 99% of phishing" so I am pondering what that even means. I wonder how many of those "phishing" exploits actually work if a user activates them on Firefox, Chrome, etc. It also doesn't appear to take into account platforms where activating the page on something like a non-Windows platform Android device with Chrome breaks because it can't handle or support what the attack wants.
I am for a more intelligent IE9 so I'm happy for SmartScreen but I also wouldn't oversell it. There is value in blocking a questionable web page. There is value in simply not allowing what the questionable web page wants to activate as well.
The site gave me results awfully quick, I didn't hear the computer grinding or anything. Which is when someone pointed out this doesn't check browsers at all. Use Opera and it gives no score. Use Opera with a spoofed header though, and it'll give the results of different browsers (Opera disguised as IE gives you 4/4), leading me to think it's just sniffing the browser and spitting out results. So we just have to take their word that their own research is correct, which is far-fetched.
I looked at some other site that tests browser security, which actually does stuff. The quick scan warned me about outdated plugins. Haven't tried comprehensive yet, but I'm betting it's more reliable than Microsoft's trash browser-report is: https://browsercheck.qualys.com/
when you don't allow users to run your test on some of your competition's offerings, such as Safari.
All they're trying to do is say "We're the best (in this carefully chosen group)" Of course they're going to win that argument. Even a catbox smells nice if you're only allowed to compare it with a hog shed.
Now I'm not out to smear the other offerings they did include, but even leaving out one significant competitor from your test is more than enough to raise reasonable doubt as to how your product really stacks up against all your competition.
I work for the Department of Redundancy Department.
Am I the only person who chuckled out loud upon reading this headline? I somehow doubt it.
If carrots got you drunk, rabbits would be fucked up. - Comedian Mitch Hedberg R.I.P. 03/30/68-2/24/05
The easiest way to score 4/4 is to change your user-agent string to internet explorer on windows 7. Try it for yourself :)
Please allow me to rephrase it in a slightly less retarded manner: "I run Windows XP, whose latest available version of IE (that is, IE 8) has problems X, Y, and Z. I am considering IE 9, but if I were to try it for myself, I would first have to buy a copy of Windows 7. Is IE 9 worth the price of Windows 7?"
isnt that the role of the firewall & os .... all browsers need to do is NOT open holes
"Does your browser provide a distinct warning when you download an application that is of higher risk but not yet confirmed as malware?" - X
Chrome does in fact ask me when I try to download potentially unsafe file formats (in my case, DMG files =) ), prompting me whether to keep or discard. Smoke and mirrors, and the same old FUD..
When was the last time that Microsoft released any benchmarks that weren't shown to have been artificially cooked to favor IE over all other browsers?
Yeah, I thought so.
Chrome does in fact ask me when I try to download potentially unsafe file formats (in my case, DMG files =) ), prompting me whether to keep or discard.
Chrome decides based on the file format. IE's filter is more fine-grained, deciding based on the reputation of a particular downloaded executable file (identified by its hash value?) or, in the case of a digitally signed executable, the reputation of its publisher. Microsoft's advice for building an application's reputation (source 1; source 2) involves buying into the Authenticode CA racket, which can prove expensive for an individual student or hobbyist developer.
My browser is prohibited from accessing the 'net.
100% of malware is blocked.
...Roger Capriotti hopes people will choose IE9...
Cool, so there's an IE9 for Ubuntu Linux now? Where do I find the .deb?
...malware is written to standards, so IE won't run it properly.
First you set up VirtualBox, despite that it's tainted crap according to a Linux developer. Then you buy a copy of Windows 7 and install it into VirtualBox. Voila: IE 9 for Ubuntu.
Says my Firefox 7 only rates a 2, and says I should try ie9, and helpfully gives me a link.
But the link is to the Windows version. I'm on a Mac!
Clearly it doesn't actually have the resolution to know, much less tell me, how Firefox 7 for OS X ranks.
Get off my launchpad!
The site is fake and does nothing other than tell you to use IE9. It determines your user agent and responds based on the result. It does not run any security tests against your browser. When I go the the site with IE9 I get a score of 4 of 4. When I go to it with Firefox 8 I get a 2 of 4 score. When I switch my user agent in Firefox 8 with the user agent switcher add-on to report I am using IE9 and go to the site using Firefox 8, I get a score of 4 of 4.
So they're using social engineering to do a cross corporate hijacking of your browser choice. Nice one
There's some humor on the page for browser features, if you're using a browser without Flash installed/enabled. The #1 "bad" item is Dangerous Downloads, just to the left of the prompt to download/install Flash. I lol-ed.
Get Adobe Flash player
This page requires Flash Player version 10.2.0 or higher.
My browser only scored a 2 out of 4, yet was able to keep me from seeing most of the malicious content on the linked page.
NoScript and AdBlockPlus, thank you.
My browser: 1
Microsoft FUD: 0
Moving along, now... so much more internet to see, so little time.
This work is licensed under a Creative Commons Attribution 3.0 Unported License.
National Cyber Alert System
Technical Cyber Security Alert TA11-284A
Microsoft Updates for Multiple Vulnerabilities
Original release date: October 11, 2011
Last revised: --
Source: US-CERT
Systems Affected
* Microsoft Windows .NET Framework
* Microsoft
* Microsoft Silverlight
* Internet Explorer
* Microsoft Forefront Unified Access Gateway
* Microsoft Host Integration Server
Overview
There are multiple vulnerabilities in Microsoft Windows, .NET
Framework, Silverlight, Internet Explorer, Forefront Unified Access
Gateway, and Host Integration Server. Microsoft has released
updates to address these vulnerabilities.
Microsoft says a lot of things.
When I went there with my Opera browser, it said it couldn't rate it. So I used Opera's site preferences to lie to the site and tell it I was using IE (version unspecified). I then got a rating of 4/4. So even a fake IE is better than none.
"Does the browser extend the sandbox such that it cannot read data from parts of the system that it doesn’t have access to?"
Umm IE9 fails miserably in this regard.
Oh, and where's the "Does the browser help protect you from websites that are *NOT* known to distribute socially engineered malware?"
At least let me run a test to prove how secure my browser really is, instead of just checking the browser agent.
"We know what happens to people who stay in the middle of the road. They get run over." - Aneurin Bevan
Switch the user agent to IE9 and get a 4 score!
Does MSIE still chmod +x whatever files it saves? Abstaining from doing that, should take care of whatever malware still gets through the cracks.
Microsoft today debuted a new web site designed to raise awareness of security issues in web browsers.
i'm sure that was exactly it and had nothing to do with trying to push IE9 even if it meant fudging the numbers.
Anons need not reply. Questions end with a question mark.
They are offering ".5" scores... if you count the total pass/fails in the detailed description of the scores, IE should only have 3.5/4
insight through the mind
All show and no go. It doesn't actually test your browser or system, it just attempts to identify the browser and then matches it up with a "score." My firefox 6 got a score of 2 out of 4 based on a list of features that it allegedly had or did not have and, among other things, gave me a check box under 'yes' for "Does the browser benefit from Windows Operating System features that protect against arbitrary data execution?" even though I was running a non-Windows OS. Then I hit it with Netscape 2, Netscape 4, HotJava 3, and Opera 3 and it was unable to identify any of those and just said it couldn't give a score. The best part, though, was where it said 'The flash plugin was needed to display the page' advising me on security.
Why does everyone fall back on attacking Microsoft for press releases like this? Statistically, IE HAS been safer than other browsers in certain respects nowadays. It's silly to dismiss their complete turnaround in taking security seriously just because it's fun to hate on the company.
Of course there's going to be some marketing thrown into it as well. But what company doesn't? Why isn't everyone attacking Apple when they claim Safari is the fastest and safest browser? Or Mozilla, which has made the same claims for years too? It's not true for either of those, and they certainly can't both be right at the same time. Everyone lets that slide, because it's not cool to hate on them, despite their own terrible histories with security/vulnerability problems.
I haven't used IE for years (stopped for security reasons, in fact), but that doesn't change the fact that I can still offer them kudos for helping keep the web a safer place, especially when they still provide the dominant browser. The less infected machines on the internet is beneficial to ALL of us.
Qualys provides a free BrowserCheck tool to look for insecure browser& plugin versions or configuration. While there is a windows plug-in available for deep scanning, basic scanning can be preformed with just javascript. Try it out at: https://browsercheck.qualys.com/
In other news; hell freezes over
You all make good points but you forget that only one browser has native HTML5 support
Yeah... stopped listening at that point. Wake me when some independent and credible source says that IE blocks more malware than Chrome.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
The fact is in the numbers, we've all had tons if crap happen to our pc's because of internet explorer and at the same time, i've yet to be affected by any malware when running chrome only.
Go to www.html5test.com? Chrome currently has the highest features supported, but IE 9 scores ok with HTML 5 canvas, font, and sound support. IE 10 scores 301 and will be competitive to both Firefox and Chrome in a few months.
http://saveie6.com/
I had read Microsoft Says IE9 More Malware Than Chrome""
Well apparently older version just such too. Selex
Out of all the browsers I've tested so far virus wise. (ie9, Firefox, Chrome) IE9 is the most secure out of the box when it comes to drive by and rogueware trojans that are not exploiting secrity holes from third party plugins, and it's simply because IE9 uses a file's hash to determine if a downloaded file is commonly downloaded or not.
Since most rogueware sites pad their payload executable on demand to avoid AV signature detection, the downloaded file is never a common download and will fail the hash check.
Once you add security plugins in the mix, Chrome and Firefox get much more secure in that they tend to avoid the drop sites that eventually send you the malicious payload. IE9 using Tracking Protection Lists gives you some similar protection but it's not nearly as good as Adblock Plus or Noscipt at blocking malicious content. Even if you use similar Adblock Plus lists. Adblock plus alone will block 75-90% of drive by downloading simply by blocking ad's, which is the popular method used by scammers to redirect you to a dropper site. Noscript can boost that percentage close to 95-99%, but both of these plugins won't stop anything if a site was whitelisted and then got hacked. In these cases when the other protections fail is where IE9 Application reputation shines.
Now I've heard chrome is adding a similar hash reputation feature in a future chrome build. Hell it might be in it now since the last one I used was 13. When that happens I don't see why chrome couldn't block malicious drive by downloads just as if not more effective as IE9.
In Soviet Russia, Trojan exploits YOU!
Even though the site is the usual mix of MS inaccuracies, one thing it does do a good job pointing out is that Firefox is the odd man out right now when it comes to sandboxing. IE has it, Chrome has it, Safari on the Mac has it. Yet Firefox as the #2/#3 browser in the world lacks it. And while it's of limited use in protecting against attacks on plugins (which are the most common vector), it means it's easier to exploit the browser itself.
The FF devs should be working on getting Firefox appropriately sandboxed, even if it's Windows-only at the start. It would go a long way towards bringing it up to par with Chrome, which is Firefox's real competition.
Initial disclaimer - I have XP at work and have no choice in upgrading. That said, IE9 blocks no malware whatsoever on XP, as it is not supported. Chrome runs nicely on XP though. So in that situation it is really Chrome vs. IE8 that is of importance.
Microsoft Says IE9 Blocks More Malware Than Chrome
Well, I should certainly hope so! By now you'd think Microsoft would know how to build a browser to *NOT* compromise their own operating system...YEESH!
If you're silly enough to use windows, maybe it does matter what browser you use..
the program which runs Windows Update and is used to download another browser when you install a new computer right?
Great! My Firefox on Linux is actually benefiting from the Windows OS:
Does the browser benefit from Windows Operating System features that protect against arbitrary data execution? yes
This is one big marketing website, with actual, provable lies.
-- The Internet is a too slow way of doing things, you'd never do without it.
One of the tests:
Does the browser have the ability to restrict an extension or a plugin on a per site basis?
I recently switched from chromium to FF7, and this is the one feature I miss from chromium. Oh, and the ability to only run plugins when you right click them on the page and select "Run plugin". I shouldn't have to run Flashblock to do something so simple.
"The most dangerous enemy of a better solution is an existing codebase that is just good enough." -- Eric S. Raymond
The results would probably be quite different against a properly random sampling of malware.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
the machine im currently on scores 1 out of 4 with it's browser. its running win xp sp3, and ie8. the site suggests i upgrade to ie9, which then takes me to a download page for ie8, since windows xp doesn't support ie9.
tbh i think most flash animations are encoded as movies so they can go on youtube nowadays as well, it's just too easy not to do.
That and per my tests, an H.264 video is ten times the size of the SWF vector animation from which it was transcoded. That's not so nice for the slow, expensive data connections typical among mobile devices and rural (i.e. satellite) markets.
You just have to give Adobe a swift kick in the tail so they do something to fix the problem -- like open source Flash Player or publish RFCs sufficient for someone else to make one.
The SWF spec was published years ago as part of the "Open Screen Project".
Where's the WC-eend tag when you need it?
(For the non-Dutch: WC-eend ("toilet duck")is a brand of toilet cleaning detergent, that used to have commercials with guys in labcoats doing tests and then claiming "We of WC-eend recommend.... WC-eend!" in an obvious parody of impartiality.)
(see here for one of their commercials.)
If all of the different websites are for the same corporation
...then all the sites are probably hosted on one VPS, and your solution of using subjectAltName certificates will work. But in the case I've described, you still need one IP per hosting customer. My hobby site alone shares an IP address with over a thousand other unrelated domains. Perhaps in 2014, once Microsoft has ended extended support for Windows XP and virtually all Android 2.x customers have upgraded to 4.x (Ice Cream Sandwich), hosting providers can start offering SNI hosting.
Ok, sure, more exploits in Chrome. I suppose that could be the case.
But a very important thing is how big? 15 exploits that let you crash the browser, compared to 1 that lets you root the target... I'd rather take the first option on the user end.
Your Browser Matters (p1 of 12)
Link: canonical
* Follow us
* Like us
* Windows Live
* Email
* Twitter
* Facebook
* Share
Your browser matters.
* score
* home
* malware
* browser features
* prevention
How well is your browser protecting you?
We do not have any data for your browser, so we can't give your browser a
score.
See how other browsers scored >
Sig is on vacation
Nonononono...we all know that Linux is just a cheap rip-off of Windows (like every other Unix) and every single piece of FLOSS is using patented technology innovated by Microsoft.
On the other hand...what did you expect?
If that was sufficient to make a fully-functional independent implementation then where is the implementation and why doesn't anybody use it?
A spec isn't enough. One also has to donate enough time and money to the developer of such an implementation.
Do people really listen to what microsoft has to say about microsoft? how anybody saying "I'm awesome" is news?
I guess that's good news, because if you were using a machine capable of running IE9, you'd have a lot of malware to begin with.
not quite, if html was a shitty, bug ridden 3rd party addon
So what non-"shitty, bug ridden" delivery mechanism for efficiently delivering vector animation to PCs do you recommend? HTML5 video is bandwidth inefficient, and SVG is even more CPU-intensive than Flash. It's not that Flash is shitty as much as that the alternatives are more shitty.
that didn't work 90% of the time on your phone
HTML5 video doesn't work either for the rest of the month after the user has exceeded his cap.
or non windows pc
Flash works fine on my PC running Ubuntu 11.04.