Slashdot Mirror
Internet Explorer Vulnerabilities Increase 100%
An anonymous reader writes Bromium Labs analyzed public vulnerabilities and exploits from the first six months of 2014. The research determined that Internet Explorer vulnerabilities have increased more than 100 percent since 2013, surpassing Java and Flash vulnerabilities. Web browsers have always been a favorite avenue of attack, but we are now seeing that hackers are not only getting better at attacking Internet Explorer, they are doing it more frequently.
Yeah, but no other browser can claim a 100% increase in vulnerabilities!
Take THAT, Apple, Mozilla, Google and Opera!
Get free satoshi (Bitcoin) and Dogecoins
I can't see where the 100% figure comes from. The report says that IE attacks hit a record high in exploited zero-days in the first half of 2013, but they're now much lower.
No kidding!!! What do you say at this point?
Is time to first patch really a bad thing? It really means that vulnabilities were found, and that they were fixed quickly. As opposed to vulnerabilities found and not fixed quickly. I suppose it's worse than "no vulnerabilities found" but even if none are found, it doesn't mean they don't exist. Fixing things quickly is about the best thing you can do. It also goes on to say in the report
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Does anyone think there's any chance that the next IE version will simply switch to Blink or WebKit, with a fallback to Trident if the X-UA-Compatible meta is present?
If that happens, Firefox will be the odd one out as far as rendering is concerned.
Get free satoshi (Bitcoin) and Dogecoins
That's an odd conclusion to draw from the report. What it actually says is:
1. Number of vulnerabilities in IE remains constant from 2013 to 2014, other applications see a decrease
2. Number of public exploits in IE decreases from 11 to 3 in that same period
3. Number of days to patch in IE decreases from ~80 to ~5 between IE7 and IE 11
Don't worry--those who were responsible for that browser were all just sacked.
... and those who were responsible for sacking the browser writers were all sacked.
if someone gives you a percentage they are trying to make it better or worse than it actually is.
did you forget to take your meds?
I also do not understand, those people still using MSIE
I gather many of them are people at work who lack privileges to install other browsers or to run executables from writable directories. This is reportedly common on government PCs that need to connect to IE-only intranet apps.
Just because you don't know about vulnerabilities, that doesn't mean that they're not there. The vulnerabilities are present in the code before they are discovered.
Having said that, drawing conclusions from vulnerability counts is usually an exercise in futility. There are many factors that affect how many vulnerabilities are discovered and disclosed. Including availability of vulnerability-finding tools, discovery of novel attack techniques, or simply critical mass of interest in the security field.
I'm betting it had more than one vulnerability...
http://xkcd.com/1102/
I think your post constitutes a 100% increase in the number of times I've heard Opera mentioned this year.
Neither can IE. It has a ~5-10% increase.
The summary is absolute garbage; it implies that the number of vulnerabilities is doubled (it isnt), that IE security is worse (but public exploits are reduced from last year, and mean time to patch is vastly reduced), and that its always been worse (last year, Chrome and Firefox had more exploits than IE).
Unsurprisingly, everyone here took the bait.