Slashdot Mirror
Internet Explorer Vulnerabilities Increase 100%
An anonymous reader writes Bromium Labs analyzed public vulnerabilities and exploits from the first six months of 2014. The research determined that Internet Explorer vulnerabilities have increased more than 100 percent since 2013, surpassing Java and Flash vulnerabilities. Web browsers have always been a favorite avenue of attack, but we are now seeing that hackers are not only getting better at attacking Internet Explorer, they are doing it more frequently.
IE has always been a crappy, insecure browser which doesn't adhere to standards.
Color me unsurprised.
It's always been shit, and most of us keep it as the browser of last resort for work stuff which required a crappy, insecure browser which doesn't adhere to standards.
Piece of crap.
Microsoft have long since demonstrated they couldn't write a decent browser if Ballmer's life depended on it.
In fact, some day I home Ballmer's life does depend on IE.
I can't see where the 100% figure comes from. The report says that IE attacks hit a record high in exploited zero-days in the first half of 2013, but they're now much lower.
No kidding!!! What do you say at this point?
Is time to first patch really a bad thing? It really means that vulnabilities were found, and that they were fixed quickly. As opposed to vulnerabilities found and not fixed quickly. I suppose it's worse than "no vulnerabilities found" but even if none are found, it doesn't mean they don't exist. Fixing things quickly is about the best thing you can do. It also goes on to say in the report
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Does anyone think there's any chance that the next IE version will simply switch to Blink or WebKit, with a fallback to Trident if the X-UA-Compatible meta is present?
If that happens, Firefox will be the odd one out as far as rendering is concerned.
Get free satoshi (Bitcoin) and Dogecoins
That's an odd conclusion to draw from the report. What it actually says is:
1. Number of vulnerabilities in IE remains constant from 2013 to 2014, other applications see a decrease
2. Number of public exploits in IE decreases from 11 to 3 in that same period
3. Number of days to patch in IE decreases from ~80 to ~5 between IE7 and IE 11
Reporting on a 'percentage increase' in vulnerabilities really doesn't give you an idea of how large of a problem there really is. I didn't read TFA after seeing the garbage headline, but it's probably not worth my time. If there were no vulnerabilities and suddenly there was one, that's an increase of an infinite percent!!! Also, does this mean the number of vulnerabilites increase, or just the ones that people were aware of? Another worthless Microsoft bashing article, nothing to see here. Head on over to Soylent News for some more interesting stories that might actually be worth reading.
Its pretty obvious that regardless of security measures it will always be the largest target because the demographic is people who aren't tech savvy and don't install a different browser on their store-bought windows machine. These are the same people who make up the majority of that 10% that fall for phishing attempts noted from the phishing article from earlier this morning. ...running an expired Norton 2009 that hasn't been working since the 6 month trial ran out.
A ligh perpetrated by the man to keep the browser down.
And we all thought that with complexity and bloat comes security?
This is why JavaScript, Adobe and Explorer are perfect together.
They really are "the" doorways to the Internet.
if someone gives you a percentage they are trying to make it better or worse than it actually is.
did you forget to take your meds?
http://media.giphy.com/media/t...
I also do not understand, those people still using MSIE
I gather many of them are people at work who lack privileges to install other browsers or to run executables from writable directories. This is reportedly common on government PCs that need to connect to IE-only intranet apps.
Just because you don't know about vulnerabilities, that doesn't mean that they're not there. The vulnerabilities are present in the code before they are discovered.
Having said that, drawing conclusions from vulnerability counts is usually an exercise in futility. There are many factors that affect how many vulnerabilities are discovered and disclosed. Including availability of vulnerability-finding tools, discovery of novel attack techniques, or simply critical mass of interest in the security field.
Web browsers have always been a favorite avenue of attack, but we are now seeing that hackers are not only getting better at attacking Internet Explorer, they are doing it more frequently.
Are the hackers getting that much better, or is MS just writing that much poorer code? Plus Microsoft has a habit of refusing to patch known exploits as an extortion technique to get people to "upgrade".
I'm betting it had more than one vulnerability...
http://xkcd.com/1102/
History shows that more than 80% of windows vulnerabilities are IE based. Only the gullible and foolish would use such an unsecure and worthless piece of crapware. IE has never been good M$ couldn't even give it away when Netscape cost money. Nobody would use it when it was free. M$ had to incorporate it into the OS before they got any real market share.
Professional Politicians are not the solution, they ARE the problem.
I'd also like to add to it (having done ASP.NET & ASP coding in industrial/business environs): A strength of IE is here - nothing else truly really "integrates" as well (in my professional development experience thusfar) into Intranet internal to corporate environs quite as well including group policies/volume network-wide management & with as much easily done database connectivity (via many methods to many disparate db engines) & this is by "way of comparison" to other webbrowsers - correct me if/where I am 'wrong/off', but that's been MY experience on all those grounds noted (2).
So, that all "said & aside" - now, do I *espouse* the use of IE online on the PUBLIC internet? Sadly, no. Why?? The premise behind this very article - security.
Yes - It's got potential & MS is truly *trying* to standardize it as well as secure it (every patch Tuesday almost has IE patches for most all versions over time as an example thereof for instance)... but, it has a lot of security "holes" even now still.
APK
P.S.=> Good point tepples, I agree, & merely wanted to "2nd your motion" & add on to it as a developer who's been exposed to some IE strengths in the business world since 1995 or so, onwards - what I noted IS one of them! apk
FTFY
Another 'news' article that contains almost nothing.
Still, at least it's not another news article by someone pretending that a reseller of hardware would have no interest in pushing old tin.
Given the fact that XP still holds a big percentage of Windows users. I think you could draw on a conclusion that many are still using IE8. That's a attractive statistic
in itself. I have to wonder though given the rise in Chrome usage when the focus won't turn away from IE and towards Chrome. You know its going to happen and you know some attacks will be successful. Chrome has been hacked in contests just as much as IE or Firefox. A better option to stay safer online is use a less popular browser like Maxthon or Slimbrowser or even Opera as they are in the single digit user percentage and tend to be unattractive to hackers.
I think its a broken record to keep busting on IE because we all know because of its ties to Windows OS that it has more issues with security. Microsoft has made strides with thinks like Protected Mode and sand boxing. But its never going to fix the problems unless IE breaks its connection with Windows.
1. Write software to sandbox $APPLICATION
2. Release report exaggerating "increase in vulnerabilities" in $APPLICATION
3. Profit!
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
I use I.E. for one reason these days. Every company I end up working for has some internal business application that only gets tested and supported on I.E. and this is particularly the case after I lock down Firefox for actual web browsing. These kind of internal business applications often fail with even minimal security restrictions.
I hold out little hope that apps designed to be run in controlled environments will ever work with a decently locked down browser. The issue is that the most vulnerable business users will take their corporate issued laptop with I.E. and default settings and use that as if it's sane to use that configuration on the internet.
US-CERT used to post a report some time ago advising to switch to other browser, after a few hours they changed the statement.
http://martin.iturbide.com/2014/04/do-you-trust-us-cert.html
There are portable version of FF & Chrome
I'd also like to add to it (having done ASP.NET & ASP coding in industrial/business environs): A strength of IE is here - nothing else truly really "integrates" as well (in my professional development experience thusfar) into Intranet internal to corporate environs quite as well including group policies/volume network-wide management & with as much easily done database connectivity (via many methods to many disparate db engines) & this is by "way of comparison" to other webbrowsers - correct me if/where I am 'wrong/off', but that's been MY experience on all those grounds noted (2).
So, that all "said & aside" - now, do I *espouse* the use of IE online on the PUBLIC internet? Sadly, no. Why?? The premise behind this very article - security.
Yes - It's got potential & MS is truly *trying* to standardize it as well as secure it (every patch Tuesday almost has IE patches for most all versions over time as an example thereof for instance) - however, it has a lot of security "holes" even now still.
APK
P.S.=> Good point tepples, I agree, & merely wanted to "2nd your motion" & add on to it as a developer who's been exposed to some IE strengths in the business world since 1995 or so, onwards - what I noted IS one of them! apk
(!) This article appears to be written like an advertisement. Please help improve it by rewriting promotional content from a neutral point of view and removing any inappropriate external links.
Bromium
Microsoft patches to IE include patches to vulns in Flash - which is embedded in IE. The increase in vulnerabilities is the result of the horrible Flash code.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Even after looking at the full report, I see no actual numbers for how many vulnerabilities there were.
How this was modded insightful I'll never know.
Someone must be exploiting a vulnerability in your pdf viewer/browser that is causing it to not work properly (IE maybe), because mine clearly shown in the appendix at the bottom.
Internet explorer:
2013 130 vulnerabilities
H1-2014 133 vulnerabilities
i am sure there's plenty of people here that rely on windows, and microsoft products in general, being the swiss cheese of software in order to make a living.
I'd also like to add to it (having done ASP.NET & ASP coding in industrial/business environs): A strength of IE is here - nothing else truly really "integrates" as well (in my professional development experience thusfar) into Intranet internal to corporate environs quite as well including group policies/volume network-wide management & with as much easily done database connectivity (via many methods to many disparate db engines) & this is by "way of comparison" to other webbrowsers - correct me if/where I am 'wrong/off', but that's been MY experience on all those grounds noted (2).
So, that all "said & aside" - now, do I *espouse* the use of IE online on the PUBLIC internet? Sadly, no. Why?? The premise behind this very article - security.
Yes - It's got potential & MS is truly *trying* to standardize it as well as secure it (every patch Tuesday almost has IE patches for most all versions over time as an example thereof for instance) - however, it has a lot of security "holes" even now still!
(Sorry for 3rd repost - some demented little prick keeps downmodding my post, so just to show him "what's-what", in that I have NO posting limits like most ac's? To spite him, "here tis'" again...)
APK
P.S.=> Good point tepples, I agree, & merely wanted to "2nd your motion" & add on to it as a developer who's been exposed to some IE strengths in the business world since 1995 or so, onwards - what I noted IS one of them! apk
It's a troll that has a grudge against me for *trying* me in technical debate & failing badly or my "spanking him" totally for his spouting falsehoods. He now "gets his revenge" by downmodding my posts (rampantly) via his registered user account &/or sockpuppets they use also, wherever they are (mostly on my posts on hosts files though) + then trolling me by ac posts afterwards (usually, or if they are dry of modpoints). They downmodded it here also -> http://it.slashdot.org/comment... when I reposted it, but apparently 'ran dry' of their effete modpoints when I posted it yet again here (not downmodded, yet @ least) -> http://it.slashdot.org/comment...
APK
P.S.=> The person doing it is *truly*, imo @ least, pitiful... apk
Close, but no cigar. last year was 65 per six months, this year its 133 per six months.
Does this mean that IE has acquired a second user? And do they use it simultaneously?
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"