Bromium Labs:Endpoint Exploitation Trends H1 2014

http://www.bromium.com/sites/default/files/bromium-h1-2014-threat_report.pdf

________________________________________________________________________

Browser (2014)

I.E.11 (94):

http://www.cvedetails.com/version/156607/Microsoft-Internet-Explorer-11.html

Chrome 78

http://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224

Firefox (75):

http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?vendor_id=452

Opera (2):

http://www.cvedetails.com/product/15008/Opera-Opera-Browser.html?vendor_id=1961

 

It's actually really cool that they break down the exploits into categories, as raw numbers are meaningless really.

It shows that while Chrome has a high amount of vulnerabilities in total, most are just DoS which isn't really that big a deal, with only 1 being code execution, 3 being gain information, and very few for the rest.

The results for Firefox and IE are not as positive.

I'd love if they would state how many of these exploits are prevented by IE's EPM but I think no one wants to bother putting the effort in. It's up to Microsoft to suck it up and force it on by default instead of caving in to the whiners that haven't updated their plugins (and still haven't). They won't bother until forced to do so, giving a time extension does nothing.

 

Chrome had a lot of vulnerabilities patched but no public exploit targeting them. IE on the other hand...

 

Old versions of IE..?

 

Also covered at https://www.wilderssecurity.com/threads/h1-2014-endpoint-exploitation-trends.366405/.

 

In report I didn't notice which versions of IE got hit by zero-day exploits. Might be the old ones.

 

Sorry.