Feeds

Web browsers face crisis of security confidence

Good enough for Donald Rumsfeld. But not for you

SANS - Survey on application security programs

Whatever its faults, Firefox wasn't the browser that brought us ActiveX and therein lies the key reason it has stood up so well when compared to IE over the years. Last year, there were some 339 vulnerabilities in one or more ActiveX controls, according to security bug tracker Secunia. That compares with about 35 flaws in QuickTime, 12 in Java, 12 in Flash and 6 in various Firefox extensions. What's more, ActiveX bugs tend to bite harder because Microsoft designed ActiveX to have much greater control of the underlying operating system than Java and most other browsing components. As a result, ActiveX for years became a cornerstone of the underground malware industry.

"Too many ActiveX controls are of poor quality and haven't been through a quality assurance process and security audit before they're published," Thomas Kristensen, Secunia's CTO says. "A lot of them are inherently insecure and of very poor quality, which makes it easy for the bad guys to find vulnerabilities."

Microsoft choked off much of the most pernicious ActiveX threats four years ago with the release of Service Pack 2 for Windows XP, which made it much harder for miscreants to use the controls to silently install malicious code on end users' machines. And changes in IE 8 previewed here (click "Peace of Mind," then "Browser-Based Exploits") promise users "greater control over who can install Microsoft ActiveX controls and on which sites the ActiveX controls are allowed to run." (The site promises a host of other improvements, including data execution prevention that is turned on by default and features known as Cross Domain Request and Cross Document Messaging to ward off attacks on web servers.)

Cookie mishmash

In addition to largely taming the ActiveX shrew, Microsoft over the last few years has adopted a tireless security posture that places a high premium on communication and patching vulnerabilities within a reasonable amount of time, and that's gone a long way to making people safer.

"IE 7 is a very secure browser," Jim Hahn, a member of the IE team says. "A machine that is fully up-to-date is very secure, and we feel very confident about that."

Last page: As the net burns, browser makers fiddle

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.