Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google-Funded Study Knocks Firefox Security

Posted by Soulskill on from the time-to-argue-again dept.

Sparrowvsrevolution writes "Researchers at the security firm Accuvant released a study Friday that gauges the security features of the top three web browsers. Accuvant admits the study was funded by Google, and naturally, Chrome came out on top. More surprising is that Internet Explorer was rated nearly as secure as Chrome, while Firefox is described as lacking many modern security safeguards. Though the study seems to have been performed objectively, it won't help Google's fraying partnership with Mozilla." The full research document is available here (PDF), and it goes into much greater detail than the Forbes article. Accuvant also published the tools and data they used in the study, which should help to evaluate their objectivity.

16 of 225 comments (clear)

  1. Chrome and IE are the most secure browsers by InsightIn140Bytes · · Score: 4, Informative

    More surprising is that Internet Explorer was rated nearly as secure as Chrome, while Firefox is described as lacking many modern security safeguards.

    How is this surprising? Apart from some ignorant cases on Slashdot who believe Microsoft is the devil and should die, it's not a new fact that IE has been a really secure browser for a long time. Both IE and Chrome offer sandboxing, JIT hardening and ways to make vulnerable plug-ins less easy to exploit and gain access to system. Firefox offers none of these.

    Currently, it's not even often that you find a vulnerability directly in the browser. Most of the attacks target either plug-ins like Flash or PDF reader, and if someone does find an exploit in the browser, the extra security layer makes it much harder to exploit. Yes, you can use something like NoScript in Firefox (and other browsers), but majority of people don't. In fact even I don't because frankly, it's pain in the ass to use. This is the reason why extra security layers provide so much better overall security.

    Anyone who still says that IE is insecure browser just doesn't know what he is talking about. On top of that, this study doesn't really bring anything new to table (but it is really well done with comprehensive disassemblies and exploit testing), it just confirms what has been known for a long time now - both Chrome and IE are really secure browsers, followed by Opera. The one that is lagging behind is Firefox. I don't know what happened to them, but they seem to copy the aspects of Chrome that no one actually cares about (UI and version number scheme) while completely forgetting what Chrome and IE do underneath and what actually counts - sandboxing, JIT hardening, auto-updating browser and plug-ins and separating different tabs to different processes.

    1. Re:Chrome and IE are the most secure browsers by hey! · · Score: 4, Insightful

      Well, let's wait and see.

      Software products are products of corporate cultures. That's not just how people in a corporation tend to think, it's what they tend to value. There is no doubt that Microsoft is capable of producing a secure browser when faced with public criticism and strong competition. The question is whether they will continue to do so if public attention flags or the competition declines, or whether security will be sacrificed to some other business goal.

      Of course you can ask that of *any* browser produced by *any* organization, but the point is that it is a bad idea to accord any one browser product a privileged position. Developers should develop to standards then test against multiple products, and users should not be shy about changing browsers. The problem is that IE inherently has a privileged position, and Microsoft has a history of using interlocking, non-proprietary product stacks to drive sales across product categories. That means Microsoft has unusual temptations when it comes to security, because of IE.

      --
      Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
    2. Re:Chrome and IE are the most secure browsers by InsightIn140Bytes · · Score: 5, Interesting

      You would only gain additional security if the exploits actually targeted the browsers. They don't - most of them target plug-ins and work in every browser. Now, both Chrome and IE sandbox them and have extra security layers for plug-ins just so that even if plug-in is vulnerable, you can't actually gain access to system. Since Firefox doesn't offer any of these options, you gain access directly after compromising the plug-in.

    3. Re:Chrome and IE are the most secure browsers by InsightIn140Bytes · · Score: 5, Informative

      If you browse the same site for Chrome, you'd notice that the list is about same length for the latest version. And the total vulnerability count is huge for Firefox compared to Chrome and IE.

    4. Re:Chrome and IE are the most secure browsers by InsightIn140Bytes · · Score: 4, Informative

      The links you showed lists new vulnerabilities for:

      Chrome 15.0.874.121 (really minor version number)
      Firefox 8.0 (FF 11.0 is in the works already!)
      IE 9.0 (now we suddenly have a major version number)

      Both Chrome and Firefox use insane version number schemes which really doesn't make that comparison valid. Because of that you have to compare the vulnerabilities within some time frame, for example one year or two years. But I suspect you knew that.

    5. Re:Chrome and IE are the most secure browsers by Anonymous Coward · · Score: 4, Interesting

      You don't even need to read them, if you happen to ever have had adobe's reader installed, the shell extension remains lingering around, which means merely hovering over the file icon will open you to exploits.

    6. Re:Chrome and IE are the most secure browsers by cryptoluddite · · Score: 4, Interesting

      Both IE and Chrome offer sandboxing, JIT hardening and ways to make vulnerable plug-ins less easy to exploit and gain access to system. Firefox offers none of these.

      On the other hand only Firefox is checked with static analysis tools before released, meaning that there are very, very few actual flaws in the browser (IE might be, Chrome certainly isn't). For instance when Chrome added a very basic memory checker to their test servers they caught dozens of bugs -- and that's just from the most basic of runtime checks. When people have run their commercial static analyzers on Chrome they've found several hundreds of potential flaws.

      What does this mean in practice? The inner sandboxed code in Chrome is wide open to attack. They aren't even using serious methods to try to protect that code and are instead relying completely on the sandbox. This is the reason why you'll get random crashes in Chrome, and why they purposely try to keep you from using too many tabs (if a process is rendering more than one tab then when it crashes more of your tabs have to reload). On the flip side, this is the reason why in a years of running Firefox nightly it has never crashed once. Yes, there are errors in Firefox, but they are complex ones not the simple mistakes that crash Chrome left and right.

      Personally I've never had a malware in dozens of years, so browser stability matters a whole lot more to me than security. A sandbox would be nice, but one that is relied on and causes random page crashes is worse than not having one but having far fewer crashes.

    7. Re:Chrome and IE are the most secure browsers by bonch · · Score: 4, Insightful

      He didn't blindly dismiss your evidence. He directly refuted it by pointing out there are in fact vulnerabilities for Chrome, contrary to your claim that there are zero, and that you have to compare vulnerabilities within the same timeframe, which is entirely logical or else you could cite vulnerabilities from years ago in comparison to browsers today.

    8. Re:Chrome and IE are the most secure browsers by shutdown+-p+now · · Score: 4, Insightful

      As the other guy who replied to you have noted, you're comparing apples and oranges (or rather cherries and watermelons) here - you're picking a specific release of Chrome (a browser that updates version number several times month), a specific version of Firefox (a browser that updates version number several times per year), and a specific version of IE (a browser that updates version number once in two years). To make a meaningful comparison, you need to compare similar time periods, no matter how many versions were released in that period for the browser.

      So, IE9 was released in March 2011 - let's look at the time period from that point until today. Looking at release history in Wikipedia, this means Chrome from 10.0.648 to 17.0.963, and at Firefox from 4.0 to 8.0 (note that IE9 also had numerous updates in that time frame, it just doesn't count them as releases).

      Now I won't even bother counting, because even just looking at the earliest versions of both Chrome and Firefox as listed above both produce two pages worth of vulnerabilities, versus one pages for IE. It's obviously a very rough metric because this doesn't account for severity of those vulnerabilities, but it already goes to show that your original numbers (zero and two) are bullshit. I hope someone who's more patient than me will go through those lists and make a nice summary.

      Also, specifically with respect to Chrome, a good half of vulnerabilities are ones from Flash. This is technically correct, because Chrome ships bundled with Flash. However, in practice, vast majority of browser users on the desktop have Flash installed in any browser that they're using; so, to get a meaningful security comparison for a typical desktop, you need to either subtract those Flash vulnerability numbers from Chrome, or add them to other browsers. This would make Chrome the most secure by far, and Firefox the least - exactly as TFA says.

      It's also basic common sense. You're comparing two browsers who have sandboxed-process-per-tab with a browser that does everything in a single process with no security boundary. Of course the latter is going to be more vulnerable!

  2. Here it comes by masternerdguy · · Score: 4, Insightful

    Nobody is going to RTA. This is going to be a good flamewar though.

    --
    To offset political mods, replace Flamebait with Insightful.
  3. Opera by jaak · · Score: 5, Interesting

    The researchers dd not evaluate Opera in their study. I wonder how that would have compared...

    1. Re:Opera by kangsterizer · · Score: 5, Interesting

      They don't care about opera. It's not a technical study. It's a marketing study.
      Opera has no market share. Chrome's easiest target is Firefox.
      IE's easiest target is Firefox too, and they made a similar advertising study, where IE is on top of security, way ahead of Chrome - but not too much.
      Both put Firefox down.

      All of them fail to mention other security features of Firefox. All of them fail to mention noscript and the like.
      (and before you ask a list, take a look at Firefox's separated memory management per tab, or frame poisoning protection, etc.)
      Also, no mention of CVE count of course, aka the actual discovered vulnerabilities.

      That's just making a checklist where you put names of technologies that the opponent doesn't have, but don't put names of the ones you do not have.
      Then put a mark in front of them to make you appear better.

      In the past they've been (as in all corporations) doing that for ages, Microsoft certainly did a lot of it. The difference here is that they now buy out companies to do it for them.

    2. Re:Opera by InsightIn140Bytes · · Score: 4, Informative

      Opera is the most used browser in many CIS countries, having almost 50% market share in some and beating all IE, Chrome and Firefox. Maybe you wanted to say that Opera has no market share in the US.

  4. Re:NoScript! by calibre-not-output · · Score: 4, Insightful

    They tested the vanilla browsers, as they should. Most people don't install NoScript, and many who do get annoyed with it and switch it off.

    --
    Nothing lasts forever but the certainty of change.
  5. Firefox still a single-process browser by Animats · · Score: 5, Informative

    Many of the security issues mentioned in the paper for Firefox come from the fact that Firefox is, for historical reasons, a single-process browser. It's the last of the single -process browsers.

    This is both a performance problem and a security problem. Even add-ons aren't yet running in separate processes. The Mozilla project to make Firefox multiprocess is behind schedule and in trouble.

    "Fennec", the Mozilla browser for mobile devices, is already multiprocess. But getting that machinery into the main line of Firefox has run into problems, and, after two years of effort, multiprocess Firefox is now on hold. "Converting an established product, like Firefox, from a single- to multi-process architecture requires the involvement and coordination of many teams. ... Electrolysis requires a large investment of resources and time and has a long timeline for completion. How long? At this point we do not have a definitive answer...."

  6. Re:NoScript! by calibre-not-output · · Score: 4, Insightful

    Yes, that's exactly what I didn't mean. The test was a test of Firefox (and IE and Chrome), not a test of "Firefox with some add-ons installed". Chrome has optional third-party security plugins too, and they also weren't enabled for the test. NoScript isn't a part of Firefox, doesn't come bundled with the browser, and isn't developed by Mozilla. Why should it be included in the test?

    --
    Nothing lasts forever but the certainty of change.