Risk

12/15/2010
05:57 PM
50%
50%

IE Bests Rival Browsers On Malware Security

Mozilla Firefox is five times less likely to thwart socially engineered malware than Microsoft's Internet Explorer 9; Google Chrome, Apple Safari, and Opera 10 trailed even further behind in NSS Labs' testing.

Microsoft Internet Explorer 9 Beta Revealed
Slideshow: Microsoft Internet Explorer 9 Beta Revealed
(click image for larger view and for full slideshow)

When Internet users stumble upon a malevolent Web site, they are five times less likely to fall prey to malware, if they are using Microsoft's Internet Explorer 9 instead of its closest rival Mozilla Firefox.

That's the conclusion of a recently released report by security firm NSS Labs. In testing Web browsers' protection against socially engineered malware in September, the company found that the public beta of IE9 caught 99% of malicious applications, higher even than its predecessor IE8, which was second at 90%.

Firefox 3.6's showing in the tests was a mere 19%, followed by Apple Safari 5, 11%; and Google Chrome 6, 3%. Opera 10 offered no protection against socially engineered malware, which is typically hidden in a benign-looking Web site that uploads the application when the visitor clicks on its link. The software installed on a person's computer is often capable of forwarding personal information used in identity theft operations. The malware is often disguised as screen savers, video player upgrades, free games, and free virus removal programs.

The report is not the final word on browser security. NSS Labs tests only the browsers' defenses against socially engineered malware. The firm does not look at vulnerabilities within the browsers themselves or in their plug-ins. Therefore, a more comprehensive examination could lead to a different standing of overall scores.

NSS Labs, which made its report publicly available Tuesday, says IE9's malware protection includes SmartScreen URL filtering technology, which is also in IE8, as well as SmartScreen Application Reputation. The latter, new in IE9, uses special algorithms in analyzing programs before they are run or saved. The technology then warns the browser user when a malicious program is detected.

Other than the IE browsers, all the others showed a decrease in their ability to catch malware since NSS Labs' last test in the first quarter of the year. Firefox 3.6's ability to protect fell by 10%, Safari 5 declined by 18%, and Chrome 6 dropped by 14%. While Web users are often advised to download the latest browser updates to ensure the highest level of security, such a practice would have had limited impact with the non-IE browsers in the latest tests "The overall decline in protection offered by Firefox, Safari and Chrome is concerning," NSS Labs says in its report.

SEE ALSO:

Review: IE9 May Be Best Version Yet

Microsoft IE 9 Beta Racks 2 Million Downloads

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Cracking 2FA: How It's Done and How to Stay Safe
Kelly Sheridan, Staff Editor, Dark Reading,  5/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10428
PUBLISHED: 2018-05-23
ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of reflected cross-site-scripting.
CVE-2018-6495
PUBLISHED: 2018-05-23
Cross-Site Scripting (XSS) in Micro Focus Universal CMDB, version 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, 10.33, 11.0, CMS, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1 and Micro Focus UCMDB Browser, version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15.1. This vulnerability could be remotely exploited to al...
CVE-2018-10653
PUBLISHED: 2018-05-23
There is an XML External Entity (XXE) Processing Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVE-2018-10654
PUBLISHED: 2018-05-23
There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.
CVE-2018-10648
PUBLISHED: 2018-05-23
There are Unauthenticated File Upload Vulnerabilities in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.