Will switching from Internet Explorer make you safer?

[Night Hawk]

January 22nd, 2010

Will switching from Internet Explorer make you safer?

Posted by Ed Bott @ 3:47 am

The panic over this month’s wave of targeted, zero-day attacks against Google, Adobe, and other companies is over. Microsoft has released a security update for Internet Explorer that patches the underlying vulnerabilities, and everyone can breathe a sigh of relief.

But what does this episode say about Internet Explorer? I’ve seen several pundits argue that Internet Explorer is inherently unsafe. I think they’re overreacting. Yes, there is a case to be made for using a different browser, especially one with a lower market share that is targeted less frequently than Internet Explorer. (And if you’re too impatient to read this entire post, then skip to the last page for that discussion.) But it’s also true that switching browsers is a small part of a comprehensive, defense-in-depth security strategy.

One thing’s for certain: Changing browsers isn’t a magic bullet, and it might not have made a difference in this case, as I explain in this post.

Rest of 5 page blog at: Will switching from Internet Explorer make you safer? | Ed Bott’s Microsoft Report | ZDNet.com

 

[richc46]

I think if you use MSE, Malwarebytes, a good Firewall and most of all common sense,

you will be safe. Is IE8 less secure than some of the other, maybe so, but does not

make much difference if you use the above for security.

 

[Night Hawk]

MSE, System Protect, and a good security sweeper you mean. I found Spyware Terminator found more then Malwarebytes but was also an annoyance like an intensive firewall prompting on every new process with the latest release of that program.

While keeping AVG 9.0 on the disabled list the new IE security bar actually does more to keep bugs from getting on in the first place while MSE detects after something gets on. That was seen with a new trojan lately with the security bar disabled. MSE sprang to life for removing the bogus version of a program.

IE 6 was actually the security nightmare for a browser seen there default in XP. Due to that many rushed right to FireFox assuming they were always going to be invulnerable? Not quite!

Mozilla has issued multiple security updates for Firefox 3.5 addressing memory corruption vulnerabilities similar to those used in this case (two examples are here). Mozilla Security reported 34 Critical security advisories in 2009, defining Critical as those that “can be used to run attacker code and install software, requiring no user interaction beyond normal browsing.”

Even Mozilla with a popular browser runs into some problems. The popularity of the browser makes it a target for the novice malware writer while the pro after important things will look for openings like code flaws. I suspect Opera and at some point Chrome will likely be added on the list of "we got you there too" browsers.

In the case of that trojan that did get on here it was simply one less layer of added protection not active at the time with the security bar disabled. The irony of that was this happened during a seatch with the Bing search engine with a green check mark on the site clicked among the results! Nothing is ever 100% "safe"!

 

[Capella]

That issue only affected ie 6....The media always overreact. They generalized internet explorer with version 6. The issue is PRESENT in ie 8 but because of all the new security in ie 8, even if that was exploited, it wont damage your computer.
If you liked ie from before, don't change simply because of this

 

[whs]

If you are really worried, run in a sandbox - very easy. I think IE8 is one of the better browsers when it comes to security - at least that's what the experts say.

 

[Night Hawk]

You still will want some sort of IE protection inplace regardless of the browser used. The speed at which the trojan was stuffed on the drive suggested that running across the same site with FireFox, Opera, Chrome would have likely been hit as well due to the way that was scripted.

Back when having XP on before IE 7 was even out I used to sick and tired of constantly cleaning off data minders and adbots mostly having tried out a large number of programs for that purpose. Despite some very vast improvements two version generations after IE 6 the XP Mode offers a sandbox approach and sees IE 8 there. I think that will become the new search engine here to avoid any more "unwanted pests"! :roflmao:

 

[whs]

Night Hawk, why so difficult. Just do this:

Step1 - Download and install Sandboxie from here: http://www.sandboxie.com/index.php?DownloadSandboxie
For 64bit go here and use the second link.

Step2 - Go into All Programs, click on Sandboxie and make a shortcut on the desktop from “Run webbrowser sandboxed” (you can also pin it to the Start menu, Quick launch or Taskbar).

Step3 - Launch your webbrowser with that shortcut. Now you are safe.

 

[Night Hawk]

But... Sandboxie - Register Sandboxie and that is the idea with the XP Mode without any lifetime membership fees due or still in beta form. I'm familiar with it however being an older program written originally for 2000/XP.

With the XP Mode or another VM program like Virtual Box you can always nuke a vhd easily if something gets on that. But there it is with the 32bit IE 8 running on it.

 

[whs]

Hmm, I guess I should have a look at it. I use vBox - but on another (Vista) system. On this system I don't have enough space on C - only 40GB total (SSD).

 

[pdaneophyte]

I think if you use MSE, Malwarebytes, a good Firewall and most of all common sense,

you will be safe. Is IE8 less secure than some of the other, maybe so, but does not

make much difference if you use the above for security.

It's not common sense that is needed, but caution & a healthy dose of suspicion.

 

[whs]

I think if you use MSE, Malwarebytes, a good Firewall and most of all common sense,

you will be safe. Is IE8 less secure than some of the other, maybe so, but does not

make much difference if you use the above for security.

It's not common sense that is needed, but caution & a healthy dose of suspicion.

Agreed, but often you cannot control that. The other day I downloaded an absolutely benign program from Broderbund (a reputable site). Some trojan was trailing the download (must be like the subs were trailing ships thru the minefields in WWII). But MSE caught the trojan.
Lesson learned: Even with common sense and careful behavior, it pays to have the best defenses available.

 

[manhunter2826]

January 22nd, 2010

Will switching from Internet Explorer make you safer?

Posted by Ed Bott @ 3:47 am

The panic over this month’s wave of targeted, zero-day attacks against Google, Adobe, and other companies is over. Microsoft has released a security update for Internet Explorer that patches the underlying vulnerabilities, and everyone can breathe a sigh of relief.

But what does this episode say about Internet Explorer? I’ve seen several pundits argue that Internet Explorer is inherently unsafe. I think they’re overreacting. Yes, there is a case to be made for using a different browser, especially one with a lower market share that is targeted less frequently than Internet Explorer. (And if you’re too impatient to read this entire post, then skip to the last page for that discussion.) But it’s also true that switching browsers is a small part of a comprehensive, defense-in-depth security strategy.

One thing’s for certain: Changing browsers isn’t a magic bullet, and it might not have made a difference in this case, as I explain in this post.

Rest of 5 page blog at: Will switching from Internet Explorer make you safer? | Ed Bott’s Microsoft Report | ZDNet.com

Fantastic read, thanks

 

[whs]

Ed Bott is always right on target. Good find Night Hawk.

 

[manhunter2826]

Ed Bott is always right on target. Good find Night Hawk.

Agreed, no (security) pun intended Lol. Yes, he's got a nice writing style too; always an enjoyable and educational read. Everybody: make sure to have read if you have the time

 

[Night Hawk]

He's one of the main contributers at ZD Net there for various reports abd blogs, reviews on things. I see that name quite a bit when going through the "Latest" daily at that site. He provides a good amount of detail for things he writes there to note.

Getting winged by a bug while at an apparently "clean" site? This is what happened when simply clicking on the green checked marked Bing search results and "surprize"!

It never hurts to be a little overprotective at times to say the least. This is why having some additional layer of IE security will do more to help in keeping bugs off in the first place. When you hit a bad site alarm bells sound off giving you a chance to say: "I'm out of here!" .............zzzzzzzzzoom!!!