WebProWorld Part of WebProNews.com
Page One Link To Us Edit Profile Private Messages Archives FAQ RSS Feeds  
 

Go Back   WebProWorld > Webmaster, IT and Security Discussion > Internet Security Discussion Forum
Subscribe to the Newsletter FREE!


Register FAQ Members List Calendar Arcade Chatbox Mark Forums Read

Internet Security Discussion Forum This forum is for the discussion of security related issues. If you find a new Phishing scheme, spyware, virus or malicious site - let us know about it. If any of the above found you... here's where you ask for help.

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 02-16-2006, 07:32 AM
Tim's Avatar
Tim Tim is offline
WebProWorld Veteran
 

Join Date: Jul 2004
Location: On the edge of the UK
Posts: 447
Tim RepRank 0
Default One in every 67 web pages exploits vulnerabilities in IE

A large and comprehensive study (PDF) by a group of researchers at the Department of Computer Science and Engineering at the University of Washington has found that 1.5 percent of the URLs crawled exploited flaws in Internet Explorer to install malicious spyware. That's one in every 67 web pages analysed included content to exploit vulnerabilities in the browser.

More proof, if it were needed, that Internet Explorer is a major security liability and that having adequate protection from a firewall and good, regularly updated anti-virus/spyware programs is essential. My advice would be to only use IE for security updates and testing pages only.
__________________
Pleasure in the job puts perfection in the work. Aristotle (384-322 BC)
Reply With Quote
  #2 (permalink)  
Old 02-16-2006, 10:32 AM
bodgekaloopie's Avatar
WebProWorld Member
 

Join Date: Aug 2004
Location: Michigan, USA
Posts: 67
bodgekaloopie RepRank 0
Default

Tim,

I, for one, think this is very valuable information. Sadly, it's not entirely surprising.

The fact that the study indicates a trend toward increased malicious spyware online is disturbing. Your advice to only use IE for security updates and testing is excellent.

Thanks for sharing.
Reply With Quote
  #3 (permalink)  
Old 02-16-2006, 11:11 AM
WebProWorld MVP
WebProWorld MVP
 

Join Date: Jul 2003
Location: KCMO
Posts: 1,110
Chris RepRank 4Chris RepRank 4Chris RepRank 4
Default

the sad thing about MS's approach to Internet technologies is that it's reactive instead of preventive. if i'm not mistaken, a number of the security fixes that came with the infamous Service Pack 2 were known to Redmond before XP even launched... but yet it took them about two years to correct these mistakes.

things like this make you realize why Firefox became so popular so fast. it's the only browser to make a "substantial" dent in IE's market share since Netscape... i wonder why.
__________________
Former WebProWorld Admin
Reply With Quote
  #4 (permalink)  
Old 02-16-2006, 12:01 PM
ADAM Web Design's Avatar
WebProWorld 1,000+ Club
 

Join Date: Dec 2003
Location: Toronto, Ontario, Canada
Posts: 2,217
ADAM Web Design RepRank 0
Default

There's only one problem with the study, and something that conveniently gets glossed over:

IE, having a much larger market share than FireFox, is naturally going to be targeted more. Sooner or later, if and when FF ever gets to the same levels, the same targeting will occur and people will be saying the exact same things.

So there's bound to be more spyware attacks in IE than in FF...for now.
Reply With Quote
  #5 (permalink)  
Old 02-16-2006, 12:38 PM
WebProWorld MVP
WebProWorld MVP
 

Join Date: Jul 2003
Location: KCMO
Posts: 1,110
Chris RepRank 4Chris RepRank 4Chris RepRank 4
Default

right you are ADAM, but does Firefox release a product it knows has security issues to the market? also, Firefox is very quick to patch any security issues. in some cases, they've had a fix available the day a vulnerability is reported... something the boys at redmond have not done.
__________________
Former WebProWorld Admin
Reply With Quote
  #6 (permalink)  
Old 02-16-2006, 05:40 PM
Tim's Avatar
Tim Tim is offline
WebProWorld Veteran
 

Join Date: Jul 2004
Location: On the edge of the UK
Posts: 447
Tim RepRank 0
Default

Quote:
Originally Posted by ADAM Web Design
There's only one problem with the study, and something that conveniently gets glossed over:
IE, having a much larger market share than FireFox, is naturally going to be targeted more. Sooner or later, if and when FF ever gets to the same levels, the same targeting will occur and people will be saying the exact same things.
So there's bound to be more spyware attacks in IE than in FF...for now.
I understand where you're coming from Adam but that's not the point. The study is simply focusing on the browser that most people are actually using, IE. At no point do they, or I with my post, advocate a safer browser. There are no conveniently glossed over elements. It's easily said but ultimately a red-herring.

More to the point, there are no 'safe' browsers. Many like to think that Firefox is safe but that is just untrue. Firefox is just a browser, not a security system. The fact that it does not accept ActiveX in the same way as Internet Explorer doesn't make it safe. Most malicious adware doesn't use ActiveX anyway. Actually, Opera 8.x is probably the safest browser.

The thing that pisses me off the most about Microshaft is that most of their good ideas were 'borrowed' from cleverer programmers and then they tinkered with them and messed them up. Take for instance the now defunct Java Virtual Machine v1.1.4 (Build 5.0.3810), originally licensed from Sun Microsystems but later modified by Microsoft. It is suspected that the modifications were the reason why this vulnerability was exploited by CoolWebSearch. Microsoft responded by withdrawing MSJVM without even a patch. To remove MSJVM use this tool and to install a better version of Sun Java Virtual Machine go here.

I like Firefox because it's compliant and versatile but it is also possible to corrupt FF extensions eg. Greasemonkey script. Like Chris said at least Firefox is quick to respond to liabilities and when they do it's not just a patch but a new installation.

This is all sort of irrelevant!

For me, the main point about the findings is that one in every 67 web pages exploits vulnerabilities in IE. The single element that should be focused on is who are these malicious codes aimed at, not which browser. The answer is the young. Whilst pirate sites (illegal software) get the worst score, music and games sites are close behind. Children and teenagers are the biggest consumers within all of these categories.

The bottom line is that, at home, the youngest people and those who think like them are the biggest security vulnerabilities to your computer system!
Get;In the work place, hopefully child like surfing doesn't prevail but if it does, protect your systems with all of the above and the more advanced versions of anti-virus programs that understand exploits without actually having their signatures.

Whatever you do avoid Microsoft Internet Explorer like the plague.
__________________
Pleasure in the job puts perfection in the work. Aristotle (384-322 BC)
Reply With Quote
  #7 (permalink)  
Old 02-17-2006, 02:42 AM
southplatte's Avatar
WebProWorld Veteran
 

Join Date: Jul 2003
Location: Colorado
Posts: 380
southplatte RepRank 1
Default

Tim,

Nice list of utilites there, just don't forget a good AV program. I like Norton myself, but have also had good luck with Computer Associates and AVG. I hear NOD32 is awesome too.
Reply With Quote
  #8 (permalink)  
Old 03-15-2006, 07:33 AM
WebProWorld New Member
 

Join Date: Mar 2006
Posts: 17
encoder RepRank 0
Default

My problem is there are sites that require IE in order for them to be opened. Although I use FF most of the time, I still use IE when I can't open a page in FF.

In my case, FF is much faster than IE. So I often use FF. But why is it faster?
Reply With Quote
  #9 (permalink)  
Old 04-14-2006, 01:52 AM
WebProWorld Member
 

Join Date: Apr 2006
Posts: 31
sacx13 RepRank 0
Default

Quote:
Originally Posted by ADAM Web Design
There's only one problem with the study, and something that conveniently gets glossed over:

IE, having a much larger market share than FireFox, is naturally going to be targeted more. Sooner or later, if and when FF ever gets to the same levels, the same targeting will occur and people will be saying the exact same things.

So there's bound to be more spyware attacks in IE than in FF...for now.
This is not applicable here :)
For example Apache have a larger market than IIS but the most security problems are related to IIS.

My 2 cents

Regards
Reply With Quote
Reply

  WebProWorld > Webmaster, IT and Security Discussion > Internet Security Discussion Forum
Tags: , , , ,



Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Search Engine Optimization by vBSEO 3.2.0