News >> Browse Articles >> Security
News >> Browse Articles >> Software & Web Development
Firefox Heads Risky Business App List
Featured Author:
DailyTech
DailyTech is a leading online magazine for a well-educated, tech audience. Its readers enjoy hard-hitting and up to the minute CE, PC, IT and information technology news. DailyTech’s fast-moving content also reaches out via news syndications, public portals, and forums.
Jason Mick / DailyTech
December 13, 2008
‘The good old FF browser gets little love when it comes to security.’ -
Firefox has its plate full when it comes to security. It has grown a substantial enough market share to place it in a strong second after Microsoft. This gives it a high profile and leaves it a desirable target to be exploited by hackers and malware writers. Worse yet, it has less money to fund security efforts that Microsoft, and according to some experts, less focus as well.
While small market share browsers like Opera and Chrome have built a reputation on their security (with Safari’s reputation for insecurity being a notable exception), Firefox continues to plod along in a day to day fight, trying to remain a secure platform while dealing with the challenges of browser celebrity.
Perhaps for this reason, Bit9, an application whitelisting firm that helps employers block employee access to certain apps, placed Firefox on the top its list of most vulnerable apps. The remaining spots on the list were filled out with more familiar names, with two through twelve respectively being: Adobe Flash & Acrobat; EMC VMware Player, Workstation, and other products; Sun Java Runtime Environment; Apple QuickTime, Safari, and iTunes; Symantec Norton products; Trend Micro OfficeScan; Citrix products; Aurigma and Lycos image uploaders; Skype; Yahoo Assistant; and Microsoft Windows Live Messenger.
The Bit9 study looked at several factors in ranking vulnerability. One factor was how popular the applications were. Another factor was how many known vulnerabilities existed, and how severe they were. Lastly, it looked at how hard patching was for the particular application.
In order to make the list, programs hand to run in Windows and not be centrally updatable via services such as Microsoft SMS and WSUS. Many say that the survey was unfair to Apple products because it kept easier patched Microsoft applications off the list.
In some ways, though Bit9’s list is a useful benchmark. It aptly points out that many networks have Firefox installations running on machines, without the system administrator being fully aware of the instance of these installs. Thus, despite the fact that most of the vulnerabilities looked at have been patched, the installs may not receive these patches immediately, until the employee upgrades to the next edition of the browser.
The study’s conclusions only marginally apply to the consumer market. However, when it comes to the business market, the study argues that picking or allowing employees to run Firefox, even with its security plug-ins, is a ticket to the IT danger zone as malware increasingly targets application layer targets such as Firefox.
© 2008, DailyTech
abednegoyulo
11 months ago
28 comments
@Russh: Huh? I am just confused, please enlighten me. Security Measure = Restoration Procedure?
Please prove me wrong but all of the time I thought a Security Measure is done to prevent (frequent) Restoration Procedure.
RussH
11 months ago
2 comments
Windows Secrets article (12/17/2008) was recommended FireFox as an alternative browser to deal with the horrendous flaws in IE. It appears Windows Secrets is wrong!
My conclusion is there is NO browser that can be effectively patched and used on the Internet. It seems that any "active" internet page technology is the primary reason all browsers are gigantic security problems. (Notice" the Bit9 apps list" "Adobe Flash & Acrobat; EMC VMware Player, Workstation, and other products; Sun Java Runtime Environment; Apple QuickTime, Safari, and iTunes; Symantec Norton products; Trend Micro OfficeScan; Citrix products; Aurigma and Lycos image uploaders; Skype; Yahoo Assistant; and Microsoft Windows Live Messenger." Not sure why Symantec Norton products is on the list BUT all the rest involve "dynamic content".
Considering the Bit9 article and the Windows Secrets incorrect recommendation to use Firefox, my 30year IT Sr Manager experiend is that ALL BROWSING on the Internet is an inherently a high risk activity, The CAUSE is ACTIVE CONTENT that "EXECUTES" on your machine without permission.
Grins...RussH
TIP: One security measure you can take that may allow you to fix your system if it's attacked is a feature in Windows XP. It's the System Restore facility which allows you to restore your machine to a previously known checkpoint state. Catch is you have to have the feature active on your machine and you have to be logged in as Administrator to run the "Restore".
All programs/Accessories/System Tools/System Restore
If you go to this menu pick...System Restore settings link is on the left hand side of the screen. You can check to see if you have "system resotore" in operation.
obiwanstoney
11 months ago
6 comments
What a joke this is. Come on now you mean to tel me that they are telling company's to stay away from ff because of security. And to use the crappiest browser on the market. I smell m$.
Mattd
11 months ago
2 comments
agree with doorun on what the function of broswers are. by the way ive been using iexplorer for longest time and no problems with hijackers, toolbars, ect....it really comes down to smarter websurfing, latest security windows updates, good spyware/antivirus protection with rogue website checking, and common sense.
JamesL
11 months ago
10 comments
Obviously Bit9 wasn't away of the new Security Exploit found in IE6/7.
Bit9 becoming the new IBM of 09?
Justen
11 months ago
212 comments
So wait... We all know IE is the most popular browser, it's the most vulnerable amongst the big three with ActiveX running and it's not all that tight with it disabled, and we know that many businesses that run IE run IE6 for internal reasons. Both IE6 and IE7 have a large variety of XSS vulnerabilities that Firefox 3 doesn't, as well as more technical exploits that are widely known, and they carry the near pariah in the hacking world of the MS brand name... and Bit9 figures you're better off running IE than Firefox in your business solely because of automatic updates? Interesting. Are they not aware, perhaps, that Firefox has a built-in updater that gets checked every time you launch the application? Or that deploying updated versions of Firefox is not any more difficult than any other 3rd-party app?
augustinas
11 months ago
2 comments
SMS and WSUS are Microsoft products. Why were they the only systems considered. Are they the only two ways the administrators are allowed to update systems? From the start this is a flawed analysis. It is this kind of work that produces bad products and bad decisions. I now give Bit9 the status of [Below Junk Bond and SubPrime mortgages]. Their credibility is ruined in my eyes, my recommendation is for everyone to avoid their recommendations. It is insulting.
By default FF3 is providing updates to the users. And many corporations (I have first hand experience) lock down the systems from automatic MS updates and they select the patches to install and do so during their monthly updates. Much more can obviously be said.
Dan9678
11 months ago
4 comments
You're obviously just checking to see if someone is still reading this because april fools day is still a long way off... I would laugh if it wasn’t for the fact that my company’s brain dead policies are based on the same half baked opinions employed by entities like Bit9.
mondongo
11 months ago
2 comments
Think EI6/7 is safer?.... Here is a real story, from a real RELIABLE Source: BBC News...
Read the whole story here:
http://news.bbc.co.uk/2/hi/technology/7784908.stm
Users of Microsoft's Internet Explorer are being urged by experts to switch to a rival until a serious security flaw has been fixed.
The flaw in Microsoft's Internet Explorer could allow criminals to take control of people's computers and steal their passwords, internet experts say.
ddeambra
11 months ago
28 comments
I'm not a MS cheerleader, but I think the central point of the study is being missed by most people. It doesn't look like they're claiming FF is less secure than IE, just that it's tougher for IT to ensure that patches are applied. If you update your WSUS you can ensure that all copies of IE are updated via group policy. You don't have that option with FF, which is why they're calling it "tougher to patch". Of course, that's not going to stop us from rolling out FF in my office since it runs one of our central apps about 3 times faster than IE.
M4th3wthegreat
11 months ago
4 comments
Who the hell are bit9 anyway? They've got balls I'll give them that
wharfrat
11 months ago
2 comments
What a joke, this article is ... quote - "It has grown a substantial enough market share to place it in a strong second after Microsoft." So Bit9, the "quintessential" resource in application whitelisting lumps IE7 together with IE6 to push Firefox into "second" place in browser usage ... rofl
quote - "The remaining spots on the list were filled out with more familiar names ... Symantec Norton products; ... Trend Micro OfficeScan; Citrix products ... " Symantec was put on the list because they have a business arrangement w/ Norton's competitor - McAfee. Trend Micro OfficeScan - ditto. Citrix products ... Wha' ... ?!!! Yup, that's right ... Citrix is at the top of my Favorites list, if I really want to tick off the IT staff and download malware to my corporate computer ... BLAH ... Citrix shows up on the list because they are more established than Bit9, and they offer solutions in direct competition to Bit9's. I see Bit9 has their marketing staff working overtime - if they're not, they're sleeping w/ Microsoft ... W A J!!!
M4th3wthegreat
11 months ago
4 comments
funny...I've been using firefox on a daily basis since around the time of it's launch and I have never gone back to IE, I've never had any browser hijacks, not one, on the times I have had to resort to IE I have had nothing but browser hijacks, in including full retarded toolbars installing themselves without permission, homepages changing themselves to third party websites, and the list goes on, it took them forever to implement their crappy popup blocker and it sucks anyway. If you think IE is more secure than FF you need to rediscover the web.
Zanta
11 months ago
2 comments
Hihi, funny! I worked at MS for about a year (my contract ended 5 months ago), and guess what? EVERYBODY uses Firefox there, even the top managers.
DonM
11 months ago
2 comments
I've been really happy with Firefox, but know that nothing's perfect. I've owned and used computers since 5 1/4 floppies and DOS 3.0 was the new thing. I've never had to be as involved with the system and software until I installed what I call Virtually Impossible System To Activate. For some reason, all of my software and drivers now require my attention, detracting from their usefulness as tools. I know security demands complex measures, but would appreciate more simplicity for me as a user.