Slashdot Mirror

← Back to Stories (view on slashdot.org)

Internet Explorer Vulnerabilities Increase 100%

Posted by samzenpus on from the protect-ya-neck dept.

An anonymous reader writes Bromium Labs analyzed public vulnerabilities and exploits from the first six months of 2014. The research determined that Internet Explorer vulnerabilities have increased more than 100 percent since 2013, surpassing Java and Flash vulnerabilities. Web browsers have always been a favorite avenue of attack, but we are now seeing that hackers are not only getting better at attacking Internet Explorer, they are doing it more frequently.

10 of 137 comments (clear)

  1. Re:Surprise! by ArcadeMan · · Score: 5, Funny

    Yeah, but no other browser can claim a 100% increase in vulnerabilities!

    Take THAT, Apple, Mozilla, Google and Opera!

    --
    Get free satoshi (Bitcoin) and Dogecoins
  2. Eh? by Sockatume · · Score: 4, Informative

    I can't see where the 100% figure comes from. The report says that IE attacks hit a record high in exploited zero-days in the first half of 2013, but they're now much lower.

    --
    No kidding!!! What do you say at this point?
    1. Re:Eh? by SQLGuru · · Score: 4, Insightful

      Yeah, even reading the PDF (http://www.bromium.com/sites/default/files/bromium-h1-2014-threat_report.pdf/) didn't show any sort of "AAAAAHHHHH!!!! The world is ending!" type of numbers. They show IE decreasing the patch time since 2007. There are charts showing that Zero days are decreasing. The Appendix shows 3 more entries in the National Vulnerability Database. Reporting statistics in percentages without referring to what the percentage is based on is just clickbait.

      All software has holes. Larger use base makes for a bigger target. Blah blah blah. These stories aren't going to chance what people use because the common person isn't reading them.

  3. No actual numbers by CastrTroy · · Score: 4, Insightful
    Even after looking at the full report, I see no actual numbers for how many vulnerabilities there were. Going from 1 vulnerability to 2 vulnerabilities would have been a 100% increase, without a huge reason for concern. They also state:

    a trend underscored by a progressively shorter time to first patch for its past two releases

    Is time to first patch really a bad thing? It really means that vulnabilities were found, and that they were fixed quickly. As opposed to vulnerabilities found and not fixed quickly. I suppose it's worse than "no vulnerabilities found" but even if none are found, it doesn't mean they don't exist. Fixing things quickly is about the best thing you can do. It also goes on to say in the report

    Both IE exploits released in 2014 (CVE -2014-1776, CVE-2014-0322) used Flash to build the ROP chain and launch shellcode

    Which really leads me to believe that the numbers really did go from 1 to 2, and that the exploits were more due to flash than they were to specific functionality in IE. MS was able to work around the bug by stopping it at the first step, but looks like the exploit isn't possible without Flash.

    --

    Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    1. Re:No actual numbers by BasilBrush · · Score: 4, Informative

      Looking at the graphic the raw number looks like about 130 for all of 2013, and slightly more for the first half of 2014.

  4. New Microsoft CEO by ArcadeMan · · Score: 4, Interesting

    Does anyone think there's any chance that the next IE version will simply switch to Blink or WebKit, with a fallback to Trident if the X-UA-Compatible meta is present?

    If that happens, Firefox will be the odd one out as far as rendering is concerned.

    --
    Get free satoshi (Bitcoin) and Dogecoins
  5. Odd Conclusion by bveldkamp · · Score: 5, Insightful

    That's an odd conclusion to draw from the report. What it actually says is:

    1. Number of vulnerabilities in IE remains constant from 2013 to 2014, other applications see a decrease
    2. Number of public exploits in IE decreases from 11 to 3 in that same period
    3. Number of days to patch in IE decreases from ~80 to ~5 between IE7 and IE 11

    1. Re:Odd Conclusion by BasilBrush · · Score: 5, Informative

      We seem to be having a lot of astroturf from MS today.

      IE Exploits.
      2013 = 130
      H1-2014 = 133.

      Bearing in mind the year vs half-year, that's a 104% increase. So no it's not an odd conclusion at all.

  6. Re:Surprise! by Anonymous Coward · · Score: 5, Funny

    Don't worry--those who were responsible for that browser were all just sacked.
     
    ... and those who were responsible for sacking the browser writers were all sacked.

  7. Re:Surprise! by pr0nbot · · Score: 5, Funny

    I think your post constitutes a 100% increase in the number of times I've heard Opera mentioned this year.