Slashdot Mirror
Internet Explorer Vulnerabilities Increase 100%
An anonymous reader writes Bromium Labs analyzed public vulnerabilities and exploits from the first six months of 2014. The research determined that Internet Explorer vulnerabilities have increased more than 100 percent since 2013, surpassing Java and Flash vulnerabilities. Web browsers have always been a favorite avenue of attack, but we are now seeing that hackers are not only getting better at attacking Internet Explorer, they are doing it more frequently.
Yeah, but no other browser can claim a 100% increase in vulnerabilities!
Take THAT, Apple, Mozilla, Google and Opera!
Get free satoshi (Bitcoin) and Dogecoins
Dude, tell us what you really think.
I can't see where the 100% figure comes from. The report says that IE attacks hit a record high in exploited zero-days in the first half of 2013, but they're now much lower.
No kidding!!! What do you say at this point?
Is time to first patch really a bad thing? It really means that vulnabilities were found, and that they were fixed quickly. As opposed to vulnerabilities found and not fixed quickly. I suppose it's worse than "no vulnerabilities found" but even if none are found, it doesn't mean they don't exist. Fixing things quickly is about the best thing you can do. It also goes on to say in the report
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Does anyone think there's any chance that the next IE version will simply switch to Blink or WebKit, with a fallback to Trident if the X-UA-Compatible meta is present?
If that happens, Firefox will be the odd one out as far as rendering is concerned.
Get free satoshi (Bitcoin) and Dogecoins
That's an odd conclusion to draw from the report. What it actually says is:
1. Number of vulnerabilities in IE remains constant from 2013 to 2014, other applications see a decrease
2. Number of public exploits in IE decreases from 11 to 3 in that same period
3. Number of days to patch in IE decreases from ~80 to ~5 between IE7 and IE 11
Reporting on a 'percentage increase' in vulnerabilities really doesn't give you an idea of how large of a problem there really is. I didn't read TFA after seeing the garbage headline, but it's probably not worth my time. If there were no vulnerabilities and suddenly there was one, that's an increase of an infinite percent!!! Also, does this mean the number of vulnerabilites increase, or just the ones that people were aware of? Another worthless Microsoft bashing article, nothing to see here. Head on over to Soylent News for some more interesting stories that might actually be worth reading.
Its pretty obvious that regardless of security measures it will always be the largest target because the demographic is people who aren't tech savvy and don't install a different browser on their store-bought windows machine. These are the same people who make up the majority of that 10% that fall for phishing attempts noted from the phishing article from earlier this morning. ...running an expired Norton 2009 that hasn't been working since the 6 month trial ran out.
A ligh perpetrated by the man to keep the browser down.
I also do not understand, those people still using MSIE, they even send me articles which say that MSIE is more secure as Firefox or Chrome... Well I never have had an trojaner or virus from using Firefox/Mozilla the last +10 years. Have had a lot of problems until I stopped using that big piece of shit/crap MSIE. But of course like Einstein said two things are infinite, the cosmos and human stupidity. And he wasn't sure about the cosmos....
Samzenpus has always been a crappy, insecure editor who doesn't adhere to journalistic standards of integrity.
Color me unsurprised.
He's always been shit, and most of us keep reading as the site of last resort for nerd stuff which survived a long list of crappy, untrained editors who don't adhere to standards.
Piece of crap.
Slashdot has long since demonstrated they couldn't write a decent article if Rob Malda's life depended on it.
In fact, some day I home Anonymous Coward's life does depend on /..
See what I did there?
Go read The Fine Article before spouting your nonsense.
John
And we all thought that with complexity and bloat comes security?
This is why JavaScript, Adobe and Explorer are perfect together.
They really are "the" doorways to the Internet.
Don't worry--those who were responsible for that browser were all just sacked.
... and those who were responsible for sacking the browser writers were all sacked.
if someone gives you a percentage they are trying to make it better or worse than it actually is.
did you forget to take your meds?
http://media.giphy.com/media/t...
I also do not understand, those people still using MSIE
I gather many of them are people at work who lack privileges to install other browsers or to run executables from writable directories. This is reportedly common on government PCs that need to connect to IE-only intranet apps.
Just because you don't know about vulnerabilities, that doesn't mean that they're not there. The vulnerabilities are present in the code before they are discovered.
Having said that, drawing conclusions from vulnerability counts is usually an exercise in futility. There are many factors that affect how many vulnerabilities are discovered and disclosed. Including availability of vulnerability-finding tools, discovery of novel attack techniques, or simply critical mass of interest in the security field.
Web browsers have always been a favorite avenue of attack, but we are now seeing that hackers are not only getting better at attacking Internet Explorer, they are doing it more frequently.
Are the hackers getting that much better, or is MS just writing that much poorer code? Plus Microsoft has a habit of refusing to patch known exploits as an extortion technique to get people to "upgrade".
I'm betting it had more than one vulnerability...
http://xkcd.com/1102/
History shows that more than 80% of windows vulnerabilities are IE based. Only the gullible and foolish would use such an unsecure and worthless piece of crapware. IE has never been good M$ couldn't even give it away when Netscape cost money. Nobody would use it when it was free. M$ had to incorporate it into the OS before they got any real market share.
Professional Politicians are not the solution, they ARE the problem.
FTFY
I think your post constitutes a 100% increase in the number of times I've heard Opera mentioned this year.
Mynd you, møøse bites Kan be pretti nasti...
Get free satoshi (Bitcoin) and Dogecoins
Another 'news' article that contains almost nothing.
Still, at least it's not another news article by someone pretending that a reseller of hardware would have no interest in pushing old tin.
You think that is bad I know someone who is still running Aol.
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
Given the fact that XP still holds a big percentage of Windows users. I think you could draw on a conclusion that many are still using IE8. That's a attractive statistic
in itself. I have to wonder though given the rise in Chrome usage when the focus won't turn away from IE and towards Chrome. You know its going to happen and you know some attacks will be successful. Chrome has been hacked in contests just as much as IE or Firefox. A better option to stay safer online is use a less popular browser like Maxthon or Slimbrowser or even Opera as they are in the single digit user percentage and tend to be unattractive to hackers.
I think its a broken record to keep busting on IE because we all know because of its ties to Windows OS that it has more issues with security. Microsoft has made strides with thinks like Protected Mode and sand boxing. But its never going to fix the problems unless IE breaks its connection with Windows.
Do they ever load up a punter and boot someone offline like it's 1997!?
Neither can IE. It has a ~5-10% increase.
The summary is absolute garbage; it implies that the number of vulnerabilities is doubled (it isnt), that IE security is worse (but public exploits are reduced from last year, and mean time to patch is vastly reduced), and that its always been worse (last year, Chrome and Firefox had more exploits than IE).
Unsurprisingly, everyone here took the bait.
Firefox was "more vulnerable" in 2013, and actually for several years post IE9, I believe it was generally considered LESS secure than MSIE due to its lack of common protections (like reduced privlege, sandboxing, etc).
The real surprise here is that people on a tech site continue to use awful metrics for judging things ("works for me", "everyone else hates it, must be bad").
I know this might be tagged as -1 redundant / flamebait / trolling; but I honestly never expected the US to know what that the word sacked == fired
Don't worry--those who were responsible for that browser were all just sacked.
... and those who were responsible for sacking the browser writers were all sacked.
Thankfully, my 401k is heavily invested in many and various Sack businesses ... Retirement here I come!
It must have been something you assimilated. . . .
Neither can IE. It has a ~5-10% increase.
Just depends on how you look at the data and interpret the words. I say that there was a 0% increase...that is, the vulnerabilities were already there, the users just didn't know about them.
1. Write software to sandbox $APPLICATION
2. Release report exaggerating "increase in vulnerabilities" in $APPLICATION
3. Profit!
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Thats very likely not true at 0% are new...sometime the vulnerabilities are not there from a previous point in time, and get introduced via patches to other vulnerabilities.
I use I.E. for one reason these days. Every company I end up working for has some internal business application that only gets tested and supported on I.E. and this is particularly the case after I lock down Firefox for actual web browsing. These kind of internal business applications often fail with even minimal security restrictions.
I hold out little hope that apps designed to be run in controlled environments will ever work with a decently locked down browser. The issue is that the most vulnerable business users will take their corporate issued laptop with I.E. and default settings and use that as if it's sane to use that configuration on the internet.
Come on! La traviata still kicks ass.
Good points. The first thing that I thought when I read the summary was that the only way there could be a 100% increase is if the number of previous vulnerabilities was very small. Finding two vulnerabilities in the same period of time in which one was previously found is a 100% increase. Just like finding 60 when the previous amount was 30 is also a 100% increase.
US-CERT used to post a report some time ago advising to switch to other browser, after a few hours they changed the statement.
http://martin.iturbide.com/2014/04/do-you-trust-us-cert.html
There are portable version of FF & Chrome
Brilliant comeback!
Wouldn't it be nice if there was an xkcd to explain your math!
Depends on how those bugs were discovered. If reported by the outside community, chances are hackers might have exploited them before they were patched. Also, the hacker community culture is important. Avoidance is prudent. If a red honda civic is a target for crime, then drive a blue toyota corolla.
Take a closer look at the article. They've comparing the total exploits in 2013 with the exploits in the first half of 2014. Seeing slightly more in half the time does come out to more than 100 percent.
(!) This article appears to be written like an advertisement. Please help improve it by rewriting promotional content from a neutral point of view and removing any inappropriate external links.
Bromium
Microsoft patches to IE include patches to vulns in Flash - which is embedded in IE. The increase in vulnerabilities is the result of the horrible Flash code.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Even after looking at the full report, I see no actual numbers for how many vulnerabilities there were.
How this was modded insightful I'll never know.
Someone must be exploiting a vulnerability in your pdf viewer/browser that is causing it to not work properly (IE maybe), because mine clearly shown in the appendix at the bottom.
Internet explorer:
2013 130 vulnerabilities
H1-2014 133 vulnerabilities
Looking at the raw figures in the report, the count is up from 130 to... 133. That's an increase of 2.3%. Even extrapolated to a full year, it's a 5.6% rise.
No colour or religion ever stopped the bullet from a gun
i am sure there's plenty of people here that rely on windows, and microsoft products in general, being the swiss cheese of software in order to make a living.
I'd also like to add to it (having done ASP.NET & ASP coding in industrial/business environs): A strength of IE is here - nothing else truly really "integrates" as well (in my professional development experience thusfar) into Intranet internal to corporate environs quite as well including group policies/volume network-wide management & with as much easily done database connectivity (via many methods to many disparate db engines) & this is by "way of comparison" to other webbrowsers - correct me if/where I am 'wrong/off', but that's been MY experience on all those grounds noted (2).
So, that all "said & aside" - now, do I *espouse* the use of IE online on the PUBLIC internet? Sadly, no. Why?? The premise behind this very article - security.
Yes - It's got potential & MS is truly *trying* to standardize it as well as secure it (every patch Tuesday almost has IE patches for most all versions over time as an example thereof for instance) - however, it has a lot of security "holes" even now still!
(Sorry for 3rd repost - some demented little prick keeps downmodding my post, so just to show him "what's-what", in that I have NO posting limits like most ac's? To spite him, "here tis'" again...)
APK
P.S.=> Good point tepples, I agree, & merely wanted to "2nd your motion" & add on to it as a developer who's been exposed to some IE strengths in the business world since 1995 or so, onwards - what I noted IS one of them! apk
A strength of IE is here - nothing else truly really "integrates" as well (in my professional development experience thusfar) into Intranet internal to corporate environs quite as well
Why was this moderated down, other than knee-jerk ad hominem?
It's a troll that has a grudge against me for *trying* me in technical debate & failing badly or my "spanking him" totally for his spouting falsehoods. He now "gets his revenge" by downmodding my posts (rampantly) via his registered user account &/or sockpuppets they use also, wherever they are (mostly on my posts on hosts files though) + then trolling me by ac posts afterwards (usually, or if they are dry of modpoints). They downmodded it here also -> http://it.slashdot.org/comment... when I reposted it, but apparently 'ran dry' of their effete modpoints when I posted it yet again here (not downmodded, yet @ least) -> http://it.slashdot.org/comment...
APK
P.S.=> The person doing it is *truly*, imo @ least, pitiful... apk
It's obviously the "posting ac just because" here http://it.slashdot.org/comment... who doesn't want his minus moderation of apk removed by posting using his registered user account.
Close, but no cigar. last year was 65 per six months, this year its 133 per six months.
Does this mean that IE has acquired a second user? And do they use it simultaneously?
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"