MS IE8, Google Chrome, Firefox 3.0.9 according to mrizos.

Discussion in 'other software & services' started by Osaban, Jun 23, 2009.

Thread Status:
Not open for further replies.
  1. AKAJohnDoe

    AKAJohnDoe Registered Member

    Joined:
    Sep 26, 2007
    Posts:
    989
    Location:
    127.0.0.1
    To reiterate: A browser's function is to browse.

    Also, even long ago there were recommendations to secure whatever browser you use beyond what the defaults might be. For example, I do not allow much ActiveX to run and that which does prompts me beforehand.

    And since a browser's function is to browse, it follows that the function of security is elsewhere. I find that a firewall often has much of this needed granularity. For example, msiexec.exe cannot run on my machine without asking me if it is OK to do so. I think it is unreasonable to expect (or ask) a browser to perform that type of function.
     
  2. elapsed

    elapsed Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    7,076
    Bull... software evolves, if "a browsers function is to browse" every browser would still be on 1.0

    IE8 takes an amazingly brilliant step with the download scanning, and I no longer need to pester people to switch off IE to Opera or firefox, I just tell them to update to v8.
     
  3. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    True, but, unless something becomes widely used, it won't have much attentions to become a target.

    Initially, IE had most of the attacks targeted at it. Then, people started all moving to Firefox, because the "experts" said to ditch IE because it was secure, due to the fact was the most widely used (still is, not as much, though). Then, maybe more than 40% of the attacks went to target Firefox.

    The same will happen if everybody know started to use Opera or Chrome. The more something gets used, the more "attractive" will be to become a target.

    This is why you don't see, pratically (I'm yet to see one), mentioned attacks on Opera browser.

    Why is that?
     
  4. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    Reality is a browser is meant only to allow people to browse the Internet. Nothing else.

    Just like a car is meant to take you from point A to point B, C, etc. Sure, there are seat belts, which are mandatory, due to security reasons... in case of accidents. The purpose is to save lives. But, still, that's not the purpose of a car. The purpose of the car is to take you to places.

    Of course, is nice to know that the more secure it is, the better. And, people want to be secure. That's why things evolve. That's why browsers evolved to something than just merely web browsers. Its needed to keep up with times.

    And, if a web browser offers more security functionalities, then the better will be for the person using it.
     
  5. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    10,207
    What attacks targeting Firefox exactly? Or any other browser except IE, for that matter ...
    Mrk
     
  6. Eice

    Eice Registered Member

    Joined:
    Jan 22, 2009
    Posts:
    1,413
    http://en.wikipedia.org/wiki/MPack_(software) - "The server-side software in the kit is able to customize attacks to a variety of web browsers including Microsoft Internet Explorer, Mozilla Firefox and Opera."

    Kaspersky Labs http://www.viruslist.com/en/viruses/analysis?pubid=204792056 - "Browser-specific exploits have also been used, targeting Microsoft’s Internet Explorer, Mozilla’s Firefox, Apple Safari, and Opera."

    http://novirusthanks.org/blog/2008/...t-msie-80-exploit-new-web-based-malware-kits/ - "Also in this analysis we have discovered a new version of EL.FIESTA Exploit Kit that contain a very big amount of vulnerabilityes that should be able to exploit new browsers too. The Exploits that we can see from the Image are: MSIE (Microsoft Internet Explorer), OPERA (Opera), FFOX (Mozilla FireFox)."

    http://news.softpedia.com/news/Botnet-Serving-Browser-Targeted-Exploits-102907.shtml - "According to Roger Thompson, AVG's chief research officer, this is a fast-flux botnet, which triggers different types of exploits for Internet Explorer, Firefox, Opera, Chrome and Safari."

    http://blogs.zdnet.com/security/?p=2217&tag=nl.e550 - Modified exploits included within with their associated descriptions : modified MDAC, IE Snapshot, FF Embed, Opera Old+new...

    https://www.wilderssecurity.com/showpost.php?p=1447533&postcount=10

    Advertising for a browser malware exploit kit (URL withheld since against TOS) - "Exploits for Opera9, Firefox, Internet Explorer 4, 5, 6, and 7. Seperate module to exploit Adobe Reader util.printf() (CVE-2008-2992) vulnerability. Also, includes a module to deliver binaries via social engineering the visitor into accepting the download, similar to Fake AV."
     
    Last edited: Jun 24, 2009
  7. StevieO

    StevieO Registered Member

    Joined:
    Feb 2, 2006
    Posts:
    1,067
    ActiveX is a stupid idea, Scripting isn't far behind either. Microsoft should have never allowed it to run free by default, as it did for maybe 20 years or so in various versions of IE.

    All these years later after millions of people have been infected by drivebys etc, MS has finally started to " get it " and improved security in later versions. And yes i do believe Browser/OS coders have a duty to make them as secure as possible.

    There are 2 things here. Sloppy code, as in bugs, and holes that get taken advantage of by baddies. Either way it's still bad code that needs re-writing/improving.

    As for other browsers, eg FF. Sure you can install NoScript, but for more complete protection, you should also disable as much as possible of the other things included with it as well. For eg, iframes, as this is still being used by baddies to infect.

    Unfortunately, most people out there have never heard of NS etc, and wouldn't have a clue what to do with all those options/settings even if they had.

    That's why MS etc need to make sure browsers are secure by default. Web designers etc also have a big responsibility to ensure that sites/pages are secure. They do NOT need to code in ActiveX or scripting etc, as there are much better/safer options like CSS for eg.
     
  8. AKAJohnDoe

    AKAJohnDoe Registered Member

    Joined:
    Sep 26, 2007
    Posts:
    989
    Location:
    127.0.0.1
    Firefox 3 scans downloads, too, if a product to do so is installed, and did it before IE8. reference There is nothing wrong with a browser placing the hooks to invoke these functions, it just should not provide those functions itself.
     
    Last edited: Jun 24, 2009
  9. Eice

    Eice Registered Member

    Joined:
    Jan 22, 2009
    Posts:
    1,413
    Not sure how this discussion turned into IE invoking a locally-installed antivirus, because SmartScreen Filter doesn't need one to work. My laptop is antivirus-free, and this is what IE8 pops up when I try to download a malicious file masquerading as a toolbar uninstaller:

    Untitled.png

    Firefox, incidentally, remains blissfully silent.
     
  10. Osaban

    Osaban Registered Member

    Joined:
    Apr 11, 2005
    Posts:
    5,614
    Location:
    Milan and Seoul
    This is all about the tests carried out by mrizo, whereby IE8 scans for executables, it may not be infallible like any other AV, but why not, especially for the very casual user who doesn't even know what kind of AV is installed, if any.

    MS has embarked on a major redevelopment of their products putting security as a priority: OS (firewall + UAC), IE8, AV, AS. But no matter what the results are, it is always seen cynically.
     
  11. AKAJohnDoe

    AKAJohnDoe Registered Member

    Joined:
    Sep 26, 2007
    Posts:
    989
    Location:
    127.0.0.1
    And for the average (or below-average) computer user out there, this is probably a good strategy. Not everyone wants to tweak, be an expert, or mix and match the best of breed software packages.

    As long as there are documented methods of disabling or circumventing the default settings it really only bothers me on a philosophical level. I still would prefer discrete entities with well-defined interfaces rather than tightly integrated or hard-coded interfaces.

    If I wanted to be spoon-fed a corporate mantra I would have bought an Apple.
     
  12. Kerodo

    Kerodo Registered Member

    Joined:
    Oct 5, 2004
    Posts:
    8,013
    Yep, I'd say not even 1 person in 10,000 want to do any of that.
     
  13. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    Here is what SANS handler Jason Lam says about Web of Trust:

    If a browser (or browser add-on) can do the following:
    a) works as well as the above anecdote indicates
    b) imposes little performance penalty

    then why not? I'm all for making things tougher on miscreants, even if they are not 100% solutions.
     
  14. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,164
    Location:
    UK / Pakistan
    Good work IE8. :thumb:

    Anyone knows what data base it uses to scan downloads? It must be in cloud scanning. Am I right?
     
  15. elapsed

    elapsed Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    7,076
    Actually I believe it uses the MSRT?
     
  16. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
  17. benton4

    benton4 Registered Member

    Joined:
    Nov 29, 2004
    Posts:
    158
    Location:
    Oregon
    Sadly, I think most would rather have someone else, like software programmers, make a product that the "average user" can set and forget, and be able to surf anywhere on the web without consequence- aint gonna happen.
    Companies will continue to modify/update their software on a mission to satisfy this hunger.
     
  18. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,164
    Location:
    UK / Pakistan
    MSRT? sorry what is that?
     
  19. elapsed

    elapsed Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    7,076
    MicroSoft Removal Tool
     
  20. elapsed

    elapsed Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    7,076
    May I also point out how cars have also evolved, much like most things, with in-built sat-nav, wipers that sense when your screen is wet, lights that turn on when it's dark, under-seat heaters that warm up your cold butt.. :D
     
  21. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,164
    Location:
    UK / Pakistan
    Ok
    I just read somewhere it uses data base from One care and Windows Defender too. Not sure though.
     
  22. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    :thumb:
     
  23. MaB69

    MaB69 Registered Member

    Joined:
    Dec 9, 2005
    Posts:
    540
    Location:
    Paris
  24. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
  25. m00nbl00d

    m00nbl00d Registered Member

    Joined:
    Jan 4, 2009
    Posts:
    6,623
    You're right (http://blogs.msdn.com/ie/archive/2008/07/02/ie8-security-part-iii-smartscreen-filter.aspx)

     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.