Firefox flaws account for 44% of all browser bugs

[Night Hawk]

Firefox flaws account for 44% of all browser bugs

Apple's Safari takes second, with 35%, IE in third with 15%, says vulnerability tally

By Gregg Keizer
November 9, 2009 04:13 PM ET

Computerworld - Firefox accounted for almost half of all browser vulnerabilities in the first six months of 2009, a Web security company claimed today.

According to California-based Cenzic, Mozilla's browser had the largest percentage of Web vulnerabilities over the six-month span, while Apple's Safari had the dubious distinction of coming in second. Microsoft's Internet Explorer (IE) was third, while Opera Software's flagship browser took fourth place.
The Cenzic report can be downloaded from the company's site (download PDF).

"It's not rocket science," said Lars Ewe, Cenzic's chief technology officer, referring to the browser bug counting. "We used several databases, including the CVE (common vulnerabilities and exposures) database to count the number of known vulnerabilities."

Firefox accounted for 44% of all browser bugs reported in the first half of the year, said Ewe, while Safari vulnerabilities came to 35% of the total. IE, meanwhile, accounted for 15%, while 6% of all the flaws were in Opera.

More at: Firefox flaws account for 44% of all browser bugs

 

[Zidane24]

Sounds like to me that we have a modern case of the Roman empire here...

They build themselves up greatly only to crumble away

 

[HughShaw]

Don't trust everything you read on the internet.

 

[Zidane24]

Don't trust everything you read on the internet.

That is true...but if you read the article (and do some research on your own...), you will see that Microsoft and Mozilla have clashed the last year or so on this issue because Microsoft took the opportunity to try and stop Mozilla's momentum: expose its flaws

Of course it isn't working a great deal but it helps Microsoft's cause

Let me say as a final note and I hope that anyone out there that feels that their firefox is unbeatable listens to this...As Firefox gains more and more momentinum....so will its "hacker appeal". DO NOT BE SURPRISED IF MORE FIREFOX REPORTS INDICATE INCREASED BUGS FOUND OR VIRUS ATTACKS. This is the nature of popular software vs. un-popular software.

Windows is a prime example...it is hit by many many more virus attacks compared to its rival OSX. If the tables were turned...OSX would be in the same boat

 

[Lee]

Very interesting. For those who remember the early years of the Mac vs Windows wars (I was a Mac guy) Mac's had more problems with viruses then Windows. As Windows became the OS of choose it gained in the virus department. Albeit, that is what is now happening in the browser wars. The more popular you become the better chance you become the new target.

 

[logicearth]

Mozilla needs to seriously implement Low Mandatory Integrity Control, like Microsoft did for IE7 in Windows Vista. While it is not a cure for any security holes, it will prevent most of them from harming the computer. Granted it will not work for those who disable UAC, but who cares about them. Currently only IE and Chrome implement Low MIC.

More on MIC: Mandatory Integrity Control - Wikipedia, the free encyclopedia

 

[Night Hawk]

Very interesting. For those who remember the early years of the Mac vs Windows wars (I was a Mac guy) Mac's had more problems with viruses then Windows. As Windows became the OS of choose it gained in the virus department. Albeit, that is what is now happening in the browser wars. The more popular you become the better chance you become the new target.

That's one thing I've been saying right along about how FF would become the next "item of interest" for those who write malwares. When looking for a secondary browser to IE I found Opera was more favorable and now read this one on that seeing the lowest percentage of problems!

 

[zezasu]

Very interesting. For those who remember the early years of the Mac vs Windows wars (I was a Mac guy) Mac's had more problems with viruses then Windows. As Windows became the OS of choose it gained in the virus department. Albeit, that is what is now happening in the browser wars. The more popular you become the better chance you become the new target.

That's one thing I've been saying right along about how FF would become the next "item of interest" for those who write malwares. When looking for a secondary browser to IE I found Opera was more favorable and now read this one on that seeing the lowest percentage of problems!

Thats a shame for Firefox, i started with Firefox when it was good in 2.0 then in 3.0 i turned away. I moved to Opera too, it is very easy (mouse gestures) to do more stuff quickly. Also It doesn't have huge memory issues with multiple tabs open and if it does close it saves without asking.

Aside from all that bashing I remember reading that a huge chunk of hackers prefer using Opera so I think it makes sense. As to where i got this, well i sort of forgot, except for the part that hackers prefer it and my eyes shined with happiness that Opera is liked. I cant prove it but I thought id throw this in

 

[Crazy Buddhist]

...

Aside from all that bashing I remember reading that a huge chunk of hackers prefer using Opera so I think it makes sense. As to where i got this, well i sort of forgot, except for the part that hackers prefer it and my eyes shined with happiness that Opera is liked. I cant prove it but I thought id throw this in

Probably from Web Security Service by Purewire: Safe and Secure Web Browsing - the widely quoted source:

Firefox and Opera appear to be the browsers of choice for hackers running web sites that launch drive-by malware attacks, according to new research.
Paul Royal, a security researcher with web security service provider Purewire, is reported to have obtained the data after infiltrating the toolkits used by hackers to carry out these attacks, such as LuckySploit and UniquePack.
The research found that 46 per cent of the hackers use Firefox, while surprisingly Opera is second with 26 per cent, despite having just a two per cent market share.
Ironically, the hackers are using browsers with a smaller market share in order to avoid being hacked themselves, according to Rik Ferguson, senior security advisor at Trend Micro.
"They don't want to get compromised themselves," he said. "They stand to lose a lot - the profits of their criminal operations, control of botnets and so on - so they're looking after themselves."

So the hackers are using Firefox and opera as that makes them LESS likely to be hacked - which throws a slightly different light on this information.

It makes sense of it if you think about it. The report is that Firefox has more vulnerabilities - not more exploits.

Internet explorer has about 2/3 of the browser market so it will still gain most attention from hackers if it has fewer vulnerabilities (which is uncertain if Microsoft truly have been putting research $$$ into documenting FF vulnerabilities to make it look weak - a dumb idea really because it subsidises FF in edge in improving itself)

Firefox will certainly be targeted more and more this year and next as it seems to continue growing share. Maybe less hackers will use it less as this happens.

Opera however seems stuck at a relatively low 2.5% or so of the market so I can see the hackers will continue using that ... unless this information gets out and the world switches to Opera ... then they'll target that

Crazy B

 

[zezasu]

Thanks Crazy B. but I still think i read it somewhere else lol. Then someone probably got it from there though. I will still keep using Opera though and enjoy it regardless of all this.

Safe browsing and not going to dodgy sites also helps, unfortunately the average person does not know this and word by mouth keeps spreading Firefox.

 

[halluc1nati0n]

Where is Chrome in the statistics?

Honestly, I used to love FF before. Now, I find myself leaning towards Chrome. Granted, Chrome does not possess the all-encompassing-plugins as on date, but it could get there. I found Chrome to be more compatible than FF.

 

[Night Hawk]

I think one of the main reasons that FireFox is seeing the highest percentage over IE is that MS made some serious improvements first with IE 7 and now IE 8 as far as security including the "suggested sites" option. That tends to steer the novice user away from garbage sites to MS screened sites while searching.

This is turn around there from the old IE 5.0, 5.5, 6 days where FF had the edge and wasn't open to trojans, trojan downloaders, adwares, spywares like you saw with the older IE versions. Watching what addons/toolbars for browsers are used can also help limit the vulnerabilities.

 

[macgyver2]

Granted it will not work for those who disable UAC, but who cares about them.

I take great offense to that statement.

We should be concerned about how everyone secures their computers as all the insecure computers keep all of us fighting the issues of attacks and virus. UAC isn't perfect and is highly annoying when your setting up a computer and trying a lot of software demo's like myself UAC becomes more of a negative then a positive aspect to my computer experience.

 

[Lucretius]

That is interesting, however, I never experience any issues while I use Firefox (official releases).

I don't find it unbeatable but I have yet to find anything that is faster, more customizable, and easier to use.

 

[Crazy Buddhist]

Thanks Crazy B. but I still think i read it somewhere else lol. Then someone probably got it from there though. I will still keep using Opera though and enjoy it regardless of all this.

Safe browsing and not going to dodgy sites also helps, unfortunately the average person does not know this and word by mouth keeps spreading Firefox.

As I said it's a widely quoted source - all links I found lead back to that one piece of research.

Of course Firefox with noscript and flashblock installed is not vulnerable to these attacks - if you are also aware of social engineering tricks - as you point out - and avoid them, that helps too.

Opera will stay (relatively) safe as long as it stays at 2.5% market share

Where is Chrome in the statistics? ...snip ...

If you use your google-fu and search for BROWSER MARKET SHARE you will find out quicker than asking

Matthew

 

[logicearth]

Granted it will not work for those who disable UAC, but who cares about them.

I take great offense to that statement.

You really shouldn't take offense. Because if you of your own free will disable the security that protects you. Well that is your own doing. And if something requires that security that you disabled to be on to work, well? Software cannot protect you from yourself, and as long as you disable the security.

 

[Night Hawk]

Where is Chrome in the statistics?

Chrome was still in beta form when first released there and won't be seeing any percentage share until that briwser and OS is generally available. The article there simply makes comparison between the browsers that already see regular use. Even Opera has been around for some time seeing it's own 10 Unite release lately.

 

[macgyver2]

Granted it will not work for those who disable UAC, but who cares about them.

I take great offense to that statement.

You really shouldn't take offense. Because if you of your own free will disable the security that protects you. Well that is your own doing. And if something requires that security that you disabled to be on to work, well? Software cannot protect you from yourself, and as long as you disable the security.

the offense is the "but who cares about them" part sounds like your saying if they don't want to protect themselves then they don't need protecting by others. I guess its my army values of protecting those who can't protect themselves.

 

[logicearth]

...I guess its my army values of protecting those who can't protect themselves.

You cannot protect those that do not protect themselves. You could give them all the best protection in the world, but that protection becomes useless when the ones being protected shot themselves. Turning off UAC is the same thing as shooting yourself, UAC handles a lot more then just prompting you for confirmation. It also handles the transfer between the various levels of Mandatory Integrity Control (Low, Medium (everything normally ran without admin rights), High, System). And MORE!

 

[macgyver2]

Well I won't debate the comment " You cant protect those that do not protect themselves" as the army, police, moms and dads etc do this on a daily basis.

As for what UAC does I have read so many different opinions on what it does or does not do that I concluded that what I know, it takes up some portion of my HDD space is all it does or ever will do.

So until I read otherwise its just like any other program for security and its flawed and until they fix the flaws for me its just an annoyance to tell it to trust what I am doing and can't detect when actions are initiated by some rouge program.

So basically it sounds like UAC is strictly a control mech. that "criminals" will find ways around and apparently already have. this program (UAC) is like a card access system into a building some cards have higher access then others. UAC should grant or deny access based on a set of rules in its programing. Only problem is UAC locks the doors what about the windows? or the garage? I am not saying UAC isn't a good idea I just think its to little to late and not fully fuctional for what ever reason.