Easy updates best for browser patching
Google and Swiss researchers prod insecure surfers
Easy update mechanisms have a far greater effect on browser patching than perceived threats or other factors, according to a new study by Google and Swiss academics.
The in-depth comparative study into how browser security packages are updated discovered that Firefox's update mechanism is the most successful at getting users onto the latest version. Despite this, a steady percentage of insecure surfers - never lower than 20 per cent throughout 2007 - is always using an insecure version of Firefox.
By comparison, 54 cent of Opera users are relying on older versions of the web browser software.
The study - Firefox (In)Security Update Dynamics Exposed by Stefan Frei, Thomas Dübendorfer and Bernhard Plattner of the Swiss Federal Institute of Technology and Google Switzerland - is a follow-up to a paper published last year entitled Understanding the Web Browser Threat. The research is described as the first global scale measurement of the patch dynamics of a popular browser.
The latest study looked in more detail at how the update mechanisms of browsers compared and analysed how many users failed to apply the latest browser security patches, based upon analysis of Google USER-AGENT data. The researchers paid particularly close attention to Firefox but also looked at Opera, IE and Safari. Duebendorfer, Plattner and Frei discovered that ease of use issues played a far more important role in updates which perceived threats or other factors.
Users in large part do not actually patch their Web browsers based on recommendations, perceived threats, or any security warnings.
We found that the patch level achieved is mainly determined by the ergonomics and default settings of built-in auto-update mechanisms. Firefox’ auto-update is very effective: most users installed a new version within three days. However, the maximum share of the latest, most secure version never exceeded 80 per cent for Firefox users and 46 per cent for Opera users at any day in 2007. This makes about 50 million Firefox users with outdated browsers an easy target for attacks.
Looking at anonymous data from Google, the researchers discovered that weekend fluctuations in the usage pattern of IE 6 and IE 7. IE7 consistently grows in popularity over the weekends. The same pattern is seen with later and earlier versions of Firefox.
"What this most likely means is that the newer version of IE is probably in greater use by home users," Gunter Ollmann, a security researcher at IBM's ISS security tools division, explains. "Meanwhile corporates, with greater restrictions on patch/update rollouts have stuck with IE6 for longer periods. Therefore you see IE6 getting greater use during the working week, and IE7 over the weekends."
This might imply that home users are protected against drive-by download attacks (which often rely on exploiting holes in older browser packages to serve up malware), were it not for the fact that other factors are in play.
"Unfortunately the big unknowns are the plug-ins - which I suspect are a bigger problem for home users," Ollmann cautions.
The Firefox (In)Security Update Dynamics Exposed paper was published in the January 2009 edition of the ACM SIGCOMM Computer Communication Review. An online copy can be found here (pdf). ®
A lot of workplaces, especially cost-conscious companies, don't upgrade their IT systems that often - I've worked in quite a few places that were still using old Pentiums running NT4 and Windows 2000 even a couple of years ago, because their systems work, the staff know how to use them, and there's no need to upgrade.
That might explain the weekend/weekday discrepancy, since during the week most people would surf from the older systems in their workplaces, and on the weekends surf with the shiny new computers they popped on the credit cards last year along with the new stereo and plasma TV.
FF 220.127.116.11 here.
Because I prefer to use a stable browser that is a known quantity. There are a few well-known bugs in this version, all of which I'm completely safe from with NoScript. If I updated it, those would be fixed, but I would be subject to an unknown quantity of new bugs of which I would have no knowledge how to protect myself against; that's a hiding to nothing in my book. So the only way I'm at more risk is if there is a serious yet as-yet-undisclosed 0-day that works without any scripting in this old version - and of course, there could just as well be such 0-days for the newer versions, which get a lot more intensive attention from people looking for exploits than some antique that only a small percentage of surfers use; it's not an effective use of the attackers' time to be still trying to break this old version. Steam-powered tech FTW!
we are /all/ using insecure browsers - it's just that the details of the remaining vulnerabilities aren't public yet...