| IE7 or Firefox 2: Which browser
is more secure? Posted by Ed Bott
Microsoft and Mozilla are on a collision course,
both racing to complete major updates to their flagship web browsers scheduled
for release this fall. Over the past two years, Firefox has zoomed from
nowhere to gobble a significant chunk of market share at Internet Explorer’s
expense. The biggest selling point for Firefox is its generally better
record on security issues; so it’s no accident that Microsoft has paid
significant attention to beefing up security features in Internet Explorer
7.
Both browsers are officially out in widely
available public beta releases (Internet Explorer 7 Beta 3 and Firefox
2 Beta 1), so it’s a good time to compare how well each one performs.
For this report, I’ve put together an image
gallery that shows exactly how each browser performs when faced with common
security threats. http://blogs.zdnet.com/Bott/?page_id=108
And what are those threats? Basically, everyone
who spends any significant time on the Internet has to be mindful of the
following four threats:
* Exploits that attack unpatched
vulnerabilities in program code. This is the worst threat of all, because
a successful attack can give an intruder complete control of your computer
and every bit of information on it.
* Deceptive downloads.
Some of the nastiest bits of spyware and malware walk through the front
door, disguised as or piggybacking along with benign or harmless-sounding
programs.
* Phishing attempts. The
most popular form of browser-based crime in 2006 is the phishing e-mail,
which tries to sucker its victim into filling in valuable personal information
– bank passwords, credit card details – in a phony web form.
* Hostile add-ons. A rogue
program can be merely annoying – hijacking your home page and spewing unwanted
pop-ups – or it can take the form of a Trojan horse or dialer that can
drain its victim’s bank account.
Some of these threats are technical, but the
majority take the form of social engineering. A computer user who has administrative
rights over a computer can override any security feature or protective
program. The challenge for the browser designer is to give the user enough
information so that he or she can make an intelligent decision.
Let’s look at the two new browsers and compare
how each one handles different threats.
EXPLOITS
There’s no shortage of vulnerabilities for
either IE or Firefox. In the eight months since Firefox 1.5 was released,
the Mozilla Foundation has published 56 security advisories, 26 of which
involved vulnerabilities that “can be used to run attacker code and install
software, requiring no user interaction beyond normal browsing.” Those
flaws have been fixed in a series of six maintenance releases.
Counting the security bulletins for Internet
Explorer is a little more difficult, because Microsoft doesn’t break them
out neatly by product. Independent security researchers who’ve compared
the two generally give the edge to Firefox; Secunia, for example, claims
that 21 of 105 security advisories for Internet Explorer are currently
unpatched, although only one is rated “highly critical.” By contrast, only
three vulnerabilities are listed as unpatched for Firefox, and none of
them are considered critical.
Brian Krebs, of the Washington Post, compared
the records of Mozilla Firefox and IE6 and concluded:
For at least 38 days in 2005, IE was vulnerable
to unpatched critical security flaws that were being exploited actively
by viruses, worms and spyware. For at least 256 days last year, Internet
Explorer contained unpatched vulnerabilities where the exploit method had
been publicly disclosed but was not necessarily being used.
For Firefox, there were about 35 days in 2005
where exploit code for a known vulnerability was available for an unpatched
flaw, and zero days when a worm or virus was known to be taking advantage
of an unpatched flaw.
The theoretical edge goes to Firefox, but both
companies have kept busy in recent years making updates available, and
there’s no evidence that any widespread outbreak of malware has been attributable
to unpatched vulnerabilities in either one.
Will IE7 improve this spotty record? Perhaps.
According to Microsoft’s Tony Chor, a Group Program Manager on the Internet
Explorer team, part of the problem was old, sloppy code. “Over time, IE
had developed 13 or 14 different places in the code where we place URLs.
Inconsistent results allowed us to get beat. This is where we rearchitected
a big part of IE so that one routine evaluates the URL.” Microsoft is betting
that the new URL parser will make it easier for developers to avoid vulnerabilities
in the first place and to fix them more quickly when they do appear. But
only time will tell whether that effort will pay off as expected.
DOWNLOADS
Both browsers put plenty of speed bumps in
the way of any program code you want to download. Whether you use IE7 or
Firefox 2, you’ll need at least three clicks (and sometimes several more)
to download and install a program.
On this score, at least, IE has a better set
of features to prevent users from being tricked into downloading a program
they really don’t want. In IE7, a download dialog box will only appear
if you click a link that leads directly to that download. If a website
designer uses script to try to pop up a download box and force you to deal
with it, IE intercepts the script and displays a prompt in the Info bar
instead.
The Info bar doesn’t interfere with navigation,
and you can ignore it completely if you want to. By contrast, Firefox permits
web pages to trigger a download dialog box that has to be dealt with.
In addition, IE provides more information about
the publisher of a program as well as whether the program is digitally
signed. That’s not necessarily a big advantage for users, however, especially
when dealing with publishers who are actively trying to deceive them. During
the course of testing, I found one program that had been digitally signed
using a legitimate certificate but phony information, and two others that
had been signed using homemade certificates, including one from – no kidding
– Joe’s-Software-Emporium.
PHISHING
Both IE7 and Firefox 2 include features designed
to prevent users from being tricked by phishing attempts. Neither set of
features is completely new; Microsoft’s version appeared in its MSN toolbar
for IE6 last year, while the Firefox equivalent first appeared as the Google
Safe Browsing extension and later in the Google Toolbar for Firefox.
Both programs claim to use similar techniques,
analyzing the URL, the page content, and the structure of the page. In
addition, both programs use external blacklists that are updated regularly.
Firefox displays this pop-up balloon:
While IE7 displays a blood-red badge and warning
box:
It’s difficult to test any phishing filter with
authority. ISPs shut down most phishing sites when they’re reported, so
any link that’s more than a day or two old is likely to lead to a 404 error.
The two “live” sites I visited in each browser hardly constitute a scientific
sample, but it’s still worth noting that IE7 flagged both pages as confirmed
phishing sites, while Firefox 2 missed them both. In my experience with
IE7 over the past few months, it’s been consistently accurate, flagging
suspicious sites with a yellow label and turning them into confirmed sites
within a matter of hours. I haven’t spent enough time with the Firefox/Google
code to form an opinion.
BROWSER ADD-INS
Last, but certainly not least, is this category,
which includes IE7’s infamous ActiveX feature. Conventional wisdom blames
most spyware installations on ActiveX prompts and “drive-by downloads,”
but that reputation may be based on behavior from a bygone era.
First, some definitions. ActiveX controls are
simply binary code that runs inside the browser. It’s a powerful way to
bring the power of local computing resources into the browser; unfortunately,
it’s also been a vector for unscrupulous software makers to push spyware,
pop-ups, and home-page hijackers onto unsuspecting users’ machines.
Before Windows XP Service Pack 2, if you used
IE to visit any web page that contained an ActiveX control, it could display
a dialog box inviting you to install that software, and spyware vendors
specialized in making those controls sound like essential system patches.
Because the old-style ActiveX dialog box resembled a system prompt, it
was easy to trick users into installing unwanted software by pitching it
as a required update. And if the user said no, well, pop up that dialog
box again, and keep doing it until you wear down his resistance.
In post-SP2 versions of IE, including IE7,
ActiveX prompts appear in the Info bar, where they don’t interfere with
navigation and can be safely ignored. In addition, a page can prompt the
user only once – no more multiple requests to install a piece of software.
In fact, the behavior is essentially identical to any other software download
In addition, IE7 adds a mechanism to prevent
sites from exploiting controls that are already installed on your PC, such
as those included with Windows. The so-called ActiveX opt-in provides a
warning message when any page tries to use a control it didn’t install.
In IE7, it’s literally impossible for an ActiveX control to do a “drive-by
install” – it requires the, um, active participation of the user.
Those changes make it far more difficult for spyware
pushers to deceive an innocent and unsophisticated user, but they don’t
eliminate ActiveX completely. And that’s probably a good thing. After all,
at least a half-dozen high-profile Internet Explorer add-ins, including
Macromedia Flash, QuickTime, and the iTunes Music Store use ActiveX controls
– not to mention Windows Update and a host of small but useful tools like
Crucial Technology’s System Scanner and the test suite from PC Pitstop.
And what about Firefox? It doesn’t
do ActiveX, so it’s perfectly safe, right?
Well, not exactly. Firefox has its own add-on
model with its own set of security issues. A poorly written or hostile
Firefox extension can cause serious problems. The popular Greasemonkey
extension had to be yanked last year after security researchers uncovered
a serious security flaw. And a security researcher earlier this year wrote
a simple extension that sniffs HTML forms in search of passwords and sends
the results to an e-mail address specified in the extension. Yes, the user
has to choose to install that extension, but the same is true of ActiveX
controls. In fact, extensions can even be used to install executable programs,
a technique that Sun uses with its Java installation.
As a Mozillazine article noted
earlier this year:
The Mozilla Foundation has never claimed that
extensions willingly installed by users are safe and it's long been known
to the savvy that extensions can do practically anything once they are
running on a user's system. However, it's worrying that some users believe
that extensions are implicitly safe.
And there’s the bottom line. Come this fall,
when both browsers are officially released, the playing field will essentially
be level. Both IE7 and Firefox 2 add extra layers of protection and provide
additional information to users to help them make intelligent decisions.
In the final analysis, though, no browser can force a user to make smart
or sane decisions. They can only point the right way. |