Browser vulnerabilities and attacks will continue to mount
629352
(InfoWorld) - Window Snyder, chief security officer at open source browser maker Mozilla, is caught in the crosshairs of the raging browser vulnerability battle. On one hand, her company launched an upgrade to its Firefox browser on Feb. 23 that specifically aims to fix a number of flaws that have been discovered in the program. On the other hand, she's dealing with almost daily reports of newly identified vulnerabilities in Firefox disclosed by a researcher who makes his work public before informing Mozilla of the problems. As trying as the situation may sound, Snyder admits that the day's conflicts come with the territory of her job and those of security experts at every other browser maker. With the high-profile nature of the browser in today's Internet-based economy, working to eliminate vulnerabilities, respond to researchers, and ward-off malware attacks will remain a large part of the daily routine for the foreseeable future, according to the CSO. Snyder said that Mozilla is receiving a lot more customer feedback of late from people concerned about browser security. "The browser is one of most critical pieces of software on the computer in terms of something attackers are going after," Snyder said. "Attacks are constantly changing and every software developer needs to recognize new threats as they emerge, but that's nothing new, we've always considered security to be a top priority." Despite Mozilla's ongoing security efforts, Firefox has come under intense scrutiny from Michal Zalewski, a well-known independent security researcher who has published a collection of previously undiscovered vulnerabilities in the browser during the month of February. The Firefox security update was already delayed several days so that Mozilla could address an issue published by the researcher earlier this month dubbed the location.hostname vulnerability. And on the eve of Mozilla's release of the revamped browser, dubbed Firefox 2.0.0.2, Zalewski published information about yet another flaw in the product involving a memory corruption issue that could allow attackers to take control of computers running the software. Phishing and spoofing threats are among the attacks likely to be aimed at the latest issue, according to Zalewski. Although Snyder said she would prefer it if Zalewski and other researchers would disclose vulnerabilities to Mozilla before taking them public, she said the company relies on such experts to help it keep customers protected from attacks, as painful as the reports may be. "We would prefer that he would notify us first, but more importantly we are glad researchers are looking at Firefox and helping us fix problems," the Mozilla CSO said. "We also see where the researchers are coming from, in terms of their frustration with the amount of time vendors are taking to fix vulnerabilities." Snyder hopes that as Mozilla improves its ability to patch flaws faster, researchers will work more closely with the nonprofit company. The software maker is also developing a range of new security features for use in the Firefox 3 iteration of the browser, code-named "Gran Paradiso," that is slated to arrive sometime in the second half of 2007. Much of the work is focused on improving users' capability to understand and manage their online credentials, the CSO said. Security researchers maintain that attacks on browser vulnerabilities are only going to increase in volume and frequency, in particular during 2007. According to experts at IBM's newly acquired ISS business unit, which is based in Atlanta, the continued emergence of the "exploits as a service" business, through which malware code writers market their attacks to cyber-criminals via underground channels, will only add fuel to the fire. In another daunting development, roughly 50 percent of the browser attacks observed by ISS' X-Force research team during 2006 used encryption to hide themselves and the data they attempted to steal, with the group expecting use of such tactics only to grow during 2007. "Attackers have honed into Web browser vulnerabilities because the amount of protection people have to defend against these types of threats is not as advanced for many end users," said Gunter Ollmann, director of security strategy at IBM ISS. "In addition to the underground communities where exploits are being bought and sold, it's also become much easier for attackers to build engines that sit on Web servers and generate personalized browser attacks." Ollmann said that such threat engines are being armed with increasingly sophisticated levels of programming logic, giving them the capability to look at the specific version of a browser someone is using and launch attacks specifically aimed at the programs. Malware code writers are also sharing libraries of IP addresses known to be used by security researchers to help avoid detection of their latest work, Ollmann said. Another breed of emerging attack attempts to insert itself between end-users' keyboards and browsing programs to steal data and circumvent the security tools being added to the programs. The so-called "man-in-the-browser" threats have already been found lurking in high-value online transactional systems operated by financial services companies, where they seek to intercept valuable information as it entered by customers, said Dr. Chenxi Wang, analyst with Forrester Research. The spiraling complexity of such threats serves as strong evidence that the battle between malware writers and browser makers is only beginning to heat up, and will continue for some time, the analyst said. Wang believes that one answer to the security problem will be for browser makers to adopt more rigorous software development efforts to minimize vulnerabilities, but even those improved processes won't catch every flaw. Microsoft's Security Development Lifecycle (SDL) program, for instance, appears to have lowered the number of vulnerabilities in its newest Internet Explorer 7 browser compared to earlier versions of the product, but the company has already been forced to patch at least one critical flaw in the software, which was released in Oct. 2006. "This is going to be an arms race that is ongoing for the foreseeable future," Wang said. "There is no excuse for people on the defense side not to be more proactive with security and use better mechanisms during software development to protect against future attacks, but the attackers will always have some new approach as well."
739909
(InfoWorld) - Hackers are hitting paydirt in their search for browser bugs. According to Symantec's twice-yearly Internet Security Threat Report, hackers found 47 bugs in Mozilla's open-source browsers and 38 bugs in Internet Explorer (IE) during the first six months of this year. That'sÂ up significantlyÂ from the 17 Mozilla and 25 IE bugs found in the previous six months. Even Apple's Safari browser saw its bugs double, jumping from six in the last half of 2005 to 12 in the first half of 2006. Opera was the only browser tracked by Symantec that saw the number of vulnerabilities decline, but not by much. Opera bugs dropped from nine to seven during the period. And while Internet Explorer remained theÂ most popular choice of attackers, no one is invulnerable. According to the report, 31 percent of attacks during the period targeted more than one browser, and 20 percent took aim at Mozilla's Firefox. "There is no safe browser," said Vincent Weafer, senior director with Symantec Security Response. "If you've got a browser, make sure you're configuring it correctly," he added. "That's a far better strategy than running some browser just because you haven't heard of it." Part of the rise is due to the growing market for vulnerabilities, Weafer said. Legitimate companies such as 3Com's Tipping Point and Verisign' s iDefense pay for this information, and there is also a growing black market for exploits. "People are encouraged and getting money for finding vulnerabilities, so now you have more people looking," said Weafer. Browser bugs are also relatively easy to find and exploit, said Marc Maiffret, chief technology officer with eEye Digital Security. "Everyone has realized that targeting the applications on the desktop is a better way to break into businesses and consumers and steal things than server flaws," he said via instant message. Businesses and consumers may both be targets, but home users are the victims in about 86 percent of all attacks, according to Symantec. And the U.S. is the biggest source of online attacks, thanks to its large number of compromised machines with broadband connections, Weafer said. About 37 percent of all online attacks originate in the U.S., he said. While there may have been more bugs in Mozilla than in IE, Symantec gave the open-source project high marks for its bug-fixing. On average, it patched bugs within one day of their public disclosure -- the fastest turn-around of all measured browsers. Opera came in second, averaging two days. Safari was next, with a five-day window, followed by Microsoft, which averaged nine days per patch. Microsoft may lag as a browser patcher, but when it comes to operating systems, the company leads the pack, according to Symantec. The slowest? Sun Microsystems.
165927
Critical Opera and Firefox bugs menace IE-refuseniks There's bad news for users of alternative browsers this Friday, with both Opera and Firefox subject to security vulnerabilities.â¦
634907
Researchers are publishing security vulnerabilities this week that could offer attackers new ways to get into the enterprise. Mozilla updated its Firefox Web browser on Tuesday to thwart attacks that target a flaw in Apple&#39;s QuickTime player. Meanwhile, security researchers detailed new vulnerabilities in Windows and Windows Media player.
352797
InfoWorld - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update.
314789
Recent updates to IE contain a serious regression that leaves systems once more vulnerable to a flaw fixed more than two years ago, according to security researchers.
86222
In brief Exploit circulating for unpatched vuln
445454
Mozilla chief security officer says Firefox has the same flaw that the company called a "critical vulnerability" in IE, patch is in the works.
127768
Third-party fix plugs a recently discovered browser flaw that's increasingly being exploited in cyberattacks.
424227
While Microsoft's Internet Explorer has become the bane of computer security, switching to Mozilla may not be the simple answer after all. Security firm Secunia has issued a "highly critical" advisory that details 10 separate vulnerabilities found in Mozilla, Firefox and Thunderbird. The flaws can be exploited remotely, allowing an attacker to compromise a system and expose sensitive data. Mozilla users are urged to upgrade to the latest releases of each application, which contain the necessary fixes.
221126
The Firefox browser offers superior security features over Internet Explorer -- and as long as IE drives more than 90 percent of the world&#39;s computers, hackers will continue to make it a target.
387344
On 20 November 2004, a major malicious-code attack emerged targeting European Web sites via banner ads. This two-step attack exploits two previously identified security vulnerabilities: the Bofra (or IFRAME
490340
Browser beware Security experts are crying foul over a new supposedly secure browser application.â¦
106450
The &quot;highly criticial&quot; vulnerability affects Internet Explorer 5.01, 5.5, and 6 on fully patched PCs running either Windows XP SP1 or the newer SP2.
676055
Three more vulnerabilities in Microsoft&#39;s Internet Explorer 6.0 browser were disclosed by Danish security vendor Secunia. By Gregg Keizer, TechWeb News.
679547
Microsoft&#39;s flagship Internet Explorer has once again come under the spotlight, albeit for all the wrong reasons. Two more vulnerabilities were uncovered in the widely used Web browser version 6, according to security firm Secunia.
197264
Feds say switching browsers is one way to deal with security threats.