Feeds

Google questions tests that praise IE's bad website blocker

Er, they're testing against Chrome 6

High performance access to file storage

The methodology of tests that found IE is tops for blocking a particular type of malware attack have come under fire from Google.

NSS Labs was commissioned by Microsoft to access the ability of browser to block socially engineered malware attack URLs. The exercise focused on the effectiveness of in-built browser technology to block access to malware portals or sites known to be contaminated with malicious code (e.g. scareware portals). Such protection should be supplemented by anti-virus protection, as NSS makes clear.

The tests found that Internet Explorer 9 beta had a 99 per cent detection rate of malicious URLs, IE 8 hit a creditable 90 per cent, with Firefox 3.6 on 19 per cent, Safari 5 hit 11 per cent in the benchmark with Google's Chrome 6 browser achieving just three pre cent. Standalone Opera offered no protection from this type of attack, according to the tests.

Microsoft commissioned the results as a private benchmark, authorising their publication on the receipt of favourable results. That's not the only reason to question whether the tests should be read at face value. The exercise was conducted with Chrome 6 even though the latest version of the open sauce browser is Chrome 8. In a statement, Google defended the overall security of its browser and questioned the value of NSS's tests.

These sponsored tests are limited in their sole focus on socially engineered malware, while excluding vulnerabilities in plug-ins or browsers themselves. Additionally, the testing methodology isn't available in a way that can be independently verified. Google Chrome was built with security in mind from the beginning and emphasizes protection of users from drive-by downloads and plug-in vulnerabilities — for example, we recently introduced a new security sandbox for Flash Player.

Security testing is often a contentious business, with even the methodology of unpaid, independent tests from the likes of Virus Bulletin coming into question from time to time. That observation goes double for sponsored tests, especially those that focus on a narrow security metric, however competent the actual testers, and NSS has some of the best in the industry. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.