Slashdot Mirror

← Back to Stories (view on slashdot.org)

Internet Explorer Vulnerabilities Increase 100%

Posted by samzenpus on from the protect-ya-neck dept.

An anonymous reader writes Bromium Labs analyzed public vulnerabilities and exploits from the first six months of 2014. The research determined that Internet Explorer vulnerabilities have increased more than 100 percent since 2013, surpassing Java and Flash vulnerabilities. Web browsers have always been a favorite avenue of attack, but we are now seeing that hackers are not only getting better at attacking Internet Explorer, they are doing it more frequently.

3 of 137 comments (clear)

  1. No actual numbers by CastrTroy · · Score: 4, Insightful
    Even after looking at the full report, I see no actual numbers for how many vulnerabilities there were. Going from 1 vulnerability to 2 vulnerabilities would have been a 100% increase, without a huge reason for concern. They also state:

    a trend underscored by a progressively shorter time to first patch for its past two releases

    Is time to first patch really a bad thing? It really means that vulnabilities were found, and that they were fixed quickly. As opposed to vulnerabilities found and not fixed quickly. I suppose it's worse than "no vulnerabilities found" but even if none are found, it doesn't mean they don't exist. Fixing things quickly is about the best thing you can do. It also goes on to say in the report

    Both IE exploits released in 2014 (CVE -2014-1776, CVE-2014-0322) used Flash to build the ROP chain and launch shellcode

    Which really leads me to believe that the numbers really did go from 1 to 2, and that the exploits were more due to flash than they were to specific functionality in IE. MS was able to work around the bug by stopping it at the first step, but looks like the exploit isn't possible without Flash.

    --

    Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
  2. Odd Conclusion by bveldkamp · · Score: 5, Insightful

    That's an odd conclusion to draw from the report. What it actually says is:

    1. Number of vulnerabilities in IE remains constant from 2013 to 2014, other applications see a decrease
    2. Number of public exploits in IE decreases from 11 to 3 in that same period
    3. Number of days to patch in IE decreases from ~80 to ~5 between IE7 and IE 11

  3. Re:Eh? by SQLGuru · · Score: 4, Insightful

    Yeah, even reading the PDF (http://www.bromium.com/sites/default/files/bromium-h1-2014-threat_report.pdf/) didn't show any sort of "AAAAAHHHHH!!!! The world is ending!" type of numbers. They show IE decreasing the patch time since 2007. There are charts showing that Zero days are decreasing. The Appendix shows 3 more entries in the National Vulnerability Database. Reporting statistics in percentages without referring to what the percentage is based on is just clickbait.

    All software has holes. Larger use base makes for a bigger target. Blah blah blah. These stories aren't going to chance what people use because the common person isn't reading them.