Feeds

Web browsers face crisis of security confidence

Good enough for Donald Rumsfeld. But not for you

Intelligent flash storage arrays

Whatever its faults, Firefox wasn't the browser that brought us ActiveX and therein lies the key reason it has stood up so well when compared to IE over the years. Last year, there were some 339 vulnerabilities in one or more ActiveX controls, according to security bug tracker Secunia. That compares with about 35 flaws in QuickTime, 12 in Java, 12 in Flash and 6 in various Firefox extensions. What's more, ActiveX bugs tend to bite harder because Microsoft designed ActiveX to have much greater control of the underlying operating system than Java and most other browsing components. As a result, ActiveX for years became a cornerstone of the underground malware industry.

"Too many ActiveX controls are of poor quality and haven't been through a quality assurance process and security audit before they're published," Thomas Kristensen, Secunia's CTO says. "A lot of them are inherently insecure and of very poor quality, which makes it easy for the bad guys to find vulnerabilities."

Microsoft choked off much of the most pernicious ActiveX threats four years ago with the release of Service Pack 2 for Windows XP, which made it much harder for miscreants to use the controls to silently install malicious code on end users' machines. And changes in IE 8 previewed here (click "Peace of Mind," then "Browser-Based Exploits") promise users "greater control over who can install Microsoft ActiveX controls and on which sites the ActiveX controls are allowed to run." (The site promises a host of other improvements, including data execution prevention that is turned on by default and features known as Cross Domain Request and Cross Document Messaging to ward off attacks on web servers.)

Cookie mishmash

In addition to largely taming the ActiveX shrew, Microsoft over the last few years has adopted a tireless security posture that places a high premium on communication and patching vulnerabilities within a reasonable amount of time, and that's gone a long way to making people safer.

"IE 7 is a very secure browser," Jim Hahn, a member of the IE team says. "A machine that is fully up-to-date is very secure, and we feel very confident about that."

Last page: As the net burns, browser makers fiddle

Security for virtualized datacentres

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.