Risk
12/15/2010
05:57 PM
50%
50%

IE Bests Rival Browsers On Malware Security

Mozilla Firefox is five times less likely to thwart socially engineered malware than Microsoft's Internet Explorer 9; Google Chrome, Apple Safari, and Opera 10 trailed even further behind in NSS Labs' testing.

Microsoft Internet Explorer 9 Beta Revealed
Slideshow: Microsoft Internet Explorer 9 Beta Revealed
(click image for larger view and for full slideshow)

When Internet users stumble upon a malevolent Web site, they are five times less likely to fall prey to malware, if they are using Microsoft's Internet Explorer 9 instead of its closest rival Mozilla Firefox.

That's the conclusion of a recently released report by security firm NSS Labs. In testing Web browsers' protection against socially engineered malware in September, the company found that the public beta of IE9 caught 99% of malicious applications, higher even than its predecessor IE8, which was second at 90%.

Firefox 3.6's showing in the tests was a mere 19%, followed by Apple Safari 5, 11%; and Google Chrome 6, 3%. Opera 10 offered no protection against socially engineered malware, which is typically hidden in a benign-looking Web site that uploads the application when the visitor clicks on its link. The software installed on a person's computer is often capable of forwarding personal information used in identity theft operations. The malware is often disguised as screen savers, video player upgrades, free games, and free virus removal programs.

The report is not the final word on browser security. NSS Labs tests only the browsers' defenses against socially engineered malware. The firm does not look at vulnerabilities within the browsers themselves or in their plug-ins. Therefore, a more comprehensive examination could lead to a different standing of overall scores.

NSS Labs, which made its report publicly available Tuesday, says IE9's malware protection includes SmartScreen URL filtering technology, which is also in IE8, as well as SmartScreen Application Reputation. The latter, new in IE9, uses special algorithms in analyzing programs before they are run or saved. The technology then warns the browser user when a malicious program is detected.

Other than the IE browsers, all the others showed a decrease in their ability to catch malware since NSS Labs' last test in the first quarter of the year. Firefox 3.6's ability to protect fell by 10%, Safari 5 declined by 18%, and Chrome 6 dropped by 14%. While Web users are often advised to download the latest browser updates to ensure the highest level of security, such a practice would have had limited impact with the non-IE browsers in the latest tests "The overall decline in protection offered by Firefox, Safari and Chrome is concerning," NSS Labs says in its report.

SEE ALSO:

Review: IE9 May Be Best Version Yet

Microsoft IE 9 Beta Racks 2 Million Downloads

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Join Dark Reading community editor Marilyn Cohodas and her guest, David Shearer, (ISC)2 Chief Executive Officer, as they discuss issues that keep IT security professionals up at night, including results from the recent 2016 Black Hat Attendee Survey.