Feeds

4 in 5 surfers open to browser exploits from fixed flaws

Patchy patches provide pretty paltry protection

Choosing a cloud hosting partner with confidence

Eight in 10 browsers remains vulnerable to attacks targeting already patched bugs, with the majority of problems stemming from plug-ins such as Java.

The figures come from real world scans by users of Qualys's BrowserCheck service, a free of charge consumer-focused scanning utility released last year. The web-based service scans Windows, Mac and Linux machines for security problems either in the browser itself or in 18 commonly used plug-ins, such as Adobe Flash and Windows Media Player. Browsers supported include IE, Firefox, Safari, Chrome, Opera (ie all the big five).

In January 2011, 80 per cent of all machines were vulnerable to at least one browser-based security bug. This figure has varied between 65 per cent and 90 per cent since July 2010, according to a presentation by Wolfgang Kandek, CTO of Qualys, at the RSA Conference on Thursday. Kandek expressed surprise at the high figure of vulnerable systems.

The figures are especially troubling when you consider that consumers who have chosen to scan their system with BrowserCheck in the first place are likely to be more security-aware than the majority of internet users.

The most commonly unlatched plug-in turned out to be Oracle Java (vulnerable in more than 40 per cent of cases), software that coincidentally received a monster patch batch on Thursday. The security shortcomings of Java on browsers has prompted some security experts to begin advising surfers to disable the technology.

Adobe Reader (32 per cent), QuickTime (25 per cent), Flash (24 per cent), Shockwave (22 per cent), and WMP (10 per cent) plug-ins were also frequently left vulnerable to attack.

Kandek concludes that Browser Security is in a "shaky state", especially because of frequently outdated and easily attackable plug-ins. He said that virus writers have adapted to this trend by launching more attacks against browser plug-ins, but home users and enterprises are yet to respond by more diligently patching systems.

Kandek's presentation, complete with multiple pie-charts and graphs illustrating the dodgy state of browser security, can be downloaded from the Qualys website here. ®

Beginner's guide to SSL certificates

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.