News >> Browse Articles >> Security

News >> Browse Articles >> Software & Web Development

-21

Firefox Heads Risky Business App List

Firefox Heads Risky Business App List

Jason Mick / DailyTech

December 13, 2008

‘The good old FF browser gets little love when it comes to security.’ -

Firefox has its plate full when it comes to security.  It has grown a substantial enough market share to place it in a strong second after Microsoft.  This gives it a high profile and leaves it a desirable target to be exploited by hackers and malware writers.  Worse yet, it has less money to fund security efforts that Microsoft, and according to some experts, less focus as well.

While small market share browsers like Opera and Chrome have built a reputation on their security (with Safari’s reputation for insecurity being a notable exception), Firefox continues to plod along in a day to day fight, trying to remain a secure platform while dealing with the challenges of browser celebrity.

Perhaps for this reason, Bit9, an application whitelisting firm that helps employers block employee access to certain apps, placed Firefox on the top its list of most vulnerable apps.  The remaining spots on the list were filled out with more familiar names, with two through twelve respectively being: Adobe Flash & Acrobat; EMC VMware Player, Workstation, and other products; Sun Java Runtime Environment; Apple QuickTime, Safari, and iTunes; Symantec Norton products; Trend Micro OfficeScan; Citrix products; Aurigma and Lycos image uploaders; Skype; Yahoo Assistant; and Microsoft Windows Live Messenger.

The Bit9 study looked at several factors in ranking vulnerability.  One factor was how popular the applications were.  Another factor was how many known vulnerabilities existed, and how severe they were.  Lastly, it looked at how hard patching was for the particular application.

In order to make the list, programs hand to run in Windows and not be centrally updatable via services such as Microsoft SMS and WSUS.  Many say that the survey was unfair to Apple products because it kept easier patched Microsoft applications off the list.

In some ways, though Bit9’s list is a useful benchmark.  It aptly points out that many networks have Firefox installations running on machines, without the system administrator being fully aware of the instance of these installs.  Thus, despite the fact that most of the vulnerabilities looked at have been patched, the installs may not receive these patches immediately, until the employee upgrades to the next edition of the browser.

The study’s conclusions only marginally apply to the consumer market.  However, when it comes to the business market, the study argues that picking or allowing employees to run Firefox, even with its security plug-ins, is a ticket to the IT danger zone as malware increasingly targets application layer targets such as Firefox.

© 2008, DailyTech


-21
  • Imag0080_max50

    TimC

    7 months ago

    586 comments

    I use firefox everyday, don't have any issues with it. Unless I find something that does what I want I will stay with FF.

  • Photo_user_blank_big

    Account Removed

    9 months ago

    Bit9 is in bed with M$, and I have never been infected with Firefox. total and complete rubbish! IE7 isn't much better either if you remember, Day 1, IE7 was hacked. Hello, let's get some perspective!

  • Photo_user_blank_big

    runsrealfast

    10 months ago

    10 comments

    Even though I'm in IT, I have never understood IT's hatred for Firefox. Funny thing is we all use it, but we aren't willing to support it.

  • Photo_user_blank_big

    pjc3

    10 months ago

    20 comments

    complete rubbish. I've only ever been infected twice on this machine, both were trojans exploiting Flash via Opera as a browser. this whitelist needs to be re-evaluated.

  • B_max50

    Bootlegger

    10 months ago

    166 comments

    in respect to the rating criteria listed I would have to agree, but then again most every software not made and maintained by MS would be considered risky by those criteria.

  • Photo_user_blank_big

    Kabiri

    10 months ago

    4 comments

    try "Google Chrome" much better and faster then Internet Explorer or Firefox

  • Photo_user_blank_big

    yoddel

    10 months ago

    232 comments

    greast info
    cmm1200

  • Photo_user_blank_big

    Blakat

    10 months ago

    2 comments

    This entire article is bullshit, plain and simple. I'd not be surprised to find Bit9 either on the M$ payroll, or in some sort of agreement or contract negotiation with Microsoft, in return for producing marketing fluff such as this. It certainly wouldn't be unlike Microsoft' behavior in its past business practices to attempt something like this, to secure a foothold by slandering their largest competition. It's been done before, in other words. I'd take this article with a grain of salt, and forget about it 5 minutes later, settle back in my comfy chair, and happily surf the web with Firefox and/or Opera, both of which I use, on multiple OS platforms. OH, and by the way, 'Popularity' doesn't .... NEVER means 'Security,' which means that this Bit9 'study' was flawed from the beginning. Anyone who isn't a moron could see by their study's description that, out of the gate, they were dead set on favoring a Microsoft product over anything else. Let's not take little jokes like this too seriously.

  • Firewall_max50

    jproffer

    10 months ago

    14 comments

    *scratches head* To start off, what the hell is this article about? It trashes Firefox then goes on to do a review of Bit9.

    This is either the worst marketing ploy for Bit9 ever, or a Microsoft drive-by shooting.

    Firefox, out of the box, is one of the most secure browsers you can use today. It's security is only compromised by the plugins you choose to install, and your browsing practices. This is true for every browser out there, including IE. IE was a huge security flop, the worst ever, due to its strong OS integration.

    I won't ramble on.. but suffice it to say, this is a very bad and misleading article.

  • New_photoshoped_max50

    nmyers09

    10 months ago

    34 comments

    I think that its funny that Adobe and Java are on here when its pretty much vital to have those to be able to look at just about anything on the internet. Also Firefox I'm sure is a lot more secure then IE...if you noticed the latest breach in security in IE and they suggested that everyone switch to another browser Firefox being one of the main ones.
    Ive never had any issues with Yahoo and MSN Live, yes maybe the assistant is a little annoying but i haven't picked up any viruses.

    Seriously people think!

  • Photo_user_blank_big

    mdshann

    10 months ago

    6 comments

    @ RussH
    System restore is not to fix a virus or spyware infection. All it does is restore Windows system settings, it does not remove programs / files / etc. Windows system restore is mostly useless when it comes to removing infections.

    Back to the article: I agree with having Adobe products, Apple products, Symantec, and Trend Micro products on the list. Yahoo Assistant and Windows Live Messenger are also pretty crappy products. Most of the computers I see in my shop that are full of viruses and spyware have Symantec, McAfee, or Trend Micro security products on them. Most of the time the viruses either deactivated them or the scanners are simply oblivious to the fact that the computer is even infected. This is on computers with many levels of infections, from just a few to hundreds of malware programs. Updated or not these products are generally crap.

  • Dcpx_3975_lo_max50

    ninzo

    10 months ago

    2 comments

    Internet browsers, other applications and all operating system and network communications software needs to be periodically updated by those technical organizations who use them. In the case of home users it's up to the individual to do the updates.

    Once a software vendor provides quick response times to patching known vulnerabilities and a quick notification and update service to users, then the onus falls on the users themselves to maintain their software properly, which in this case means doing the updates.

    The article suggests that rogue software installations and lax update procedures are causing security vulnerabilities in IT organizations, but it fails to place any burden of responsibility on the technical organizations themselves who are tasked with ensuring that these conditions do not exist, so it's inherently unbalanced and it's conclusions are questionable.

    The study on which the article was based provides a ranking of based on the various risk factors. That somewhat subjective exercise provides a rough metric for risk analysis and is thus valuable, however IT organizations need to design and implement their systems and maintenance procedures with a high priority on best security practices.

    Firefox comes with built-in automated update notification and installation and has been adequately responsive in providing timely security updates. So Mozilla has met it's obligations to the user community.

  • It_s_me_max50

    UnkieBo

    11 months ago

    1040 comments

    In my opinion Firefox is much better than Internet Explorer. I mean the fact of the matter is that regardless of what browser you use, it is subject to attack by some hacker and I think that Microsoft can't stand losing so they are trying to bring Firefox down with them but for me I am sticking with Firefox until I am totally convinced that there is a need to change.

  • Photo_20_max50

    macguru

    11 months ago

    2 comments

    This has got to be the most skewed article that I have ever read. Browsers don't just run on windows, are not just upgradable through the not so easy to use windows upgrade agent, and should be considered more and more like an actual operating system when it comes to the internet age. Let me just say, anyone who doesn't understand that a stable and secure product is released through vigorous development and Quality Assurance testing. Once you do have a "solid product" you will not need to release daily or weekly updates, which is more of the M$ and Google way of thinking.

  • Photo_user_blank_big

    KlassenT

    11 months ago

    2 comments

    Honestly, I'd be interested to see if Bit9's methodology to gauge the effectiveness of browser security measures took safe browsing habits into account. There are several serious potential "security risks" that a business can face that aren't the fault of any failed security protocol, but instead of exploitable dynamic procedures that are universal to a particular programming or content delivery paradigm. A person with relatively conservative browsing habits will seldom notice a difference in most of the mainstream browsers' respective security mechanics, but I'm far more interested to see which of the browsers best covers those cases where malicious content can weave its way into responsible web usage.

    If that's already the case, then I would applaud Bit9 for taking it that far, but I'd suspect that this is just one more report where businesses without a tech-savvy IT department will find reason to blacklist programs when their focus should ultimately be on prevention at the user-level instead of the app-level.

What's the Scoop?

Post a link to something interesting from another site, or submit your own original writing for the InsideTech community to read.

Report News Here

IT Career Advice

Sf-skyline-main_sq32

Top 25 Cities for Tech Jobs

Now more than ever, it’s important to get the best bang for your buck. And there’s no question about ...

Hotcareers-250_sq32

10 Recession-Proof IT Careers

Companies are cutting back spending, shrinking staff sizes, and making tough layoffs at a rate that most of us ...

50books_sq32

50 Books Every Geek Should Read

Ever find out one of your friends hasn't read "Neuromancer" or doesn't know what a Babelfish is or why ...

Recent Activity

Photo_user_blank_big
dimatrix03 is ranked No.1 for the day in Game, 1 minute ago.
Photo_user_blank_big
dimatrix03 is ranked No.1 for the day in Game, 1 minute ago.
Photo_user_blank_big
dimatrix03 is ranked No.1 for the day in Game, 1 minute ago.
Photo_user_blank_big
dimatrix03 is ranked No.1 for the day in Game, 2 minutes ago.
Photo_user_blank_big
dimatrix03 is ranked No.1 for the day in Game, 2 minutes ago.