Slashdot Mirror
Internet Explorer Vulnerabilities Increase 100%
An anonymous reader writes Bromium Labs analyzed public vulnerabilities and exploits from the first six months of 2014. The research determined that Internet Explorer vulnerabilities have increased more than 100 percent since 2013, surpassing Java and Flash vulnerabilities. Web browsers have always been a favorite avenue of attack, but we are now seeing that hackers are not only getting better at attacking Internet Explorer, they are doing it more frequently.
Yeah, but no other browser can claim a 100% increase in vulnerabilities!
Take THAT, Apple, Mozilla, Google and Opera!
Get free satoshi (Bitcoin) and Dogecoins
Dude, tell us what you really think.
I can't see where the 100% figure comes from. The report says that IE attacks hit a record high in exploited zero-days in the first half of 2013, but they're now much lower.
No kidding!!! What do you say at this point?
Is time to first patch really a bad thing? It really means that vulnabilities were found, and that they were fixed quickly. As opposed to vulnerabilities found and not fixed quickly. I suppose it's worse than "no vulnerabilities found" but even if none are found, it doesn't mean they don't exist. Fixing things quickly is about the best thing you can do. It also goes on to say in the report
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Does anyone think there's any chance that the next IE version will simply switch to Blink or WebKit, with a fallback to Trident if the X-UA-Compatible meta is present?
If that happens, Firefox will be the odd one out as far as rendering is concerned.
Get free satoshi (Bitcoin) and Dogecoins
That's an odd conclusion to draw from the report. What it actually says is:
1. Number of vulnerabilities in IE remains constant from 2013 to 2014, other applications see a decrease
2. Number of public exploits in IE decreases from 11 to 3 in that same period
3. Number of days to patch in IE decreases from ~80 to ~5 between IE7 and IE 11
Reporting on a 'percentage increase' in vulnerabilities really doesn't give you an idea of how large of a problem there really is. I didn't read TFA after seeing the garbage headline, but it's probably not worth my time. If there were no vulnerabilities and suddenly there was one, that's an increase of an infinite percent!!! Also, does this mean the number of vulnerabilites increase, or just the ones that people were aware of? Another worthless Microsoft bashing article, nothing to see here. Head on over to Soylent News for some more interesting stories that might actually be worth reading.
I also do not understand, those people still using MSIE, they even send me articles which say that MSIE is more secure as Firefox or Chrome... Well I never have had an trojaner or virus from using Firefox/Mozilla the last +10 years. Have had a lot of problems until I stopped using that big piece of shit/crap MSIE. But of course like Einstein said two things are infinite, the cosmos and human stupidity. And he wasn't sure about the cosmos....
Don't worry--those who were responsible for that browser were all just sacked.
... and those who were responsible for sacking the browser writers were all sacked.
if someone gives you a percentage they are trying to make it better or worse than it actually is.
did you forget to take your meds?
I also do not understand, those people still using MSIE
I gather many of them are people at work who lack privileges to install other browsers or to run executables from writable directories. This is reportedly common on government PCs that need to connect to IE-only intranet apps.
Just because you don't know about vulnerabilities, that doesn't mean that they're not there. The vulnerabilities are present in the code before they are discovered.
Having said that, drawing conclusions from vulnerability counts is usually an exercise in futility. There are many factors that affect how many vulnerabilities are discovered and disclosed. Including availability of vulnerability-finding tools, discovery of novel attack techniques, or simply critical mass of interest in the security field.
I'm betting it had more than one vulnerability...
http://xkcd.com/1102/
History shows that more than 80% of windows vulnerabilities are IE based. Only the gullible and foolish would use such an unsecure and worthless piece of crapware. IE has never been good M$ couldn't even give it away when Netscape cost money. Nobody would use it when it was free. M$ had to incorporate it into the OS before they got any real market share.
Professional Politicians are not the solution, they ARE the problem.
FTFY
I think your post constitutes a 100% increase in the number of times I've heard Opera mentioned this year.
Mynd you, møøse bites Kan be pretti nasti...
Get free satoshi (Bitcoin) and Dogecoins
Another 'news' article that contains almost nothing.
Still, at least it's not another news article by someone pretending that a reseller of hardware would have no interest in pushing old tin.
You think that is bad I know someone who is still running Aol.
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
Neither can IE. It has a ~5-10% increase.
The summary is absolute garbage; it implies that the number of vulnerabilities is doubled (it isnt), that IE security is worse (but public exploits are reduced from last year, and mean time to patch is vastly reduced), and that its always been worse (last year, Chrome and Firefox had more exploits than IE).
Unsurprisingly, everyone here took the bait.
Don't worry--those who were responsible for that browser were all just sacked.
... and those who were responsible for sacking the browser writers were all sacked.
Thankfully, my 401k is heavily invested in many and various Sack businesses ... Retirement here I come!
It must have been something you assimilated. . . .
1. Write software to sandbox $APPLICATION
2. Release report exaggerating "increase in vulnerabilities" in $APPLICATION
3. Profit!
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
I use I.E. for one reason these days. Every company I end up working for has some internal business application that only gets tested and supported on I.E. and this is particularly the case after I lock down Firefox for actual web browsing. These kind of internal business applications often fail with even minimal security restrictions.
I hold out little hope that apps designed to be run in controlled environments will ever work with a decently locked down browser. The issue is that the most vulnerable business users will take their corporate issued laptop with I.E. and default settings and use that as if it's sane to use that configuration on the internet.
Good points. The first thing that I thought when I read the summary was that the only way there could be a 100% increase is if the number of previous vulnerabilities was very small. Finding two vulnerabilities in the same period of time in which one was previously found is a 100% increase. Just like finding 60 when the previous amount was 30 is also a 100% increase.
US-CERT used to post a report some time ago advising to switch to other browser, after a few hours they changed the statement.
http://martin.iturbide.com/2014/04/do-you-trust-us-cert.html
There are portable version of FF & Chrome
Depends on how those bugs were discovered. If reported by the outside community, chances are hackers might have exploited them before they were patched. Also, the hacker community culture is important. Avoidance is prudent. If a red honda civic is a target for crime, then drive a blue toyota corolla.
(!) This article appears to be written like an advertisement. Please help improve it by rewriting promotional content from a neutral point of view and removing any inappropriate external links.
Bromium
Microsoft patches to IE include patches to vulns in Flash - which is embedded in IE. The increase in vulnerabilities is the result of the horrible Flash code.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Even after looking at the full report, I see no actual numbers for how many vulnerabilities there were.
How this was modded insightful I'll never know.
Someone must be exploiting a vulnerability in your pdf viewer/browser that is causing it to not work properly (IE maybe), because mine clearly shown in the appendix at the bottom.
Internet explorer:
2013 130 vulnerabilities
H1-2014 133 vulnerabilities
Looking at the raw figures in the report, the count is up from 130 to... 133. That's an increase of 2.3%. Even extrapolated to a full year, it's a 5.6% rise.
No colour or religion ever stopped the bullet from a gun
A strength of IE is here - nothing else truly really "integrates" as well (in my professional development experience thusfar) into Intranet internal to corporate environs quite as well
Why was this moderated down, other than knee-jerk ad hominem?
Close, but no cigar. last year was 65 per six months, this year its 133 per six months.
Does this mean that IE has acquired a second user? And do they use it simultaneously?
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"