backtop

Print E-mail del.icio.us 49 comment(s) - last by vortex222.. on Dec 28 at 12:41 PM
Firefox 3 is shaping up to be a very secure browser thanks to new features

A scathing report on browser security from Microsoft, which claimed in an "unbiased" analysis that Internet Explorer was vastly more secure than Mozilla's Firefox, ignited a recent war of words between the two browser makers.  However, Mozilla decided that it was wiser to back up its words with action, rather than just more talk.

The end result is that the company just released the second beta candidate of the third iteration of its increasingly popular Firefox browser, and this release ups the ante on security with many new features.

The new browser has tighter protection against cross-site restrictions on cookies, better malware protection, clearer website identification information in the status bar, stricter SSL error pages, version checking for insecure plugins, a built in antivirus program in the download utility, and improved protection against JSON data leaks.

The feature Mozilla is most proud of is its improved protection from malicious sites.  When a user visits a malicious site in Firefox 3, the browser plays sheriff and blocks the site.  Even better; it does it with an interface that does not allow click through.

Mozilla's "Chief Security Something-or-Other" (according to his business cards) Window Snyder says that even the utilitarian features in the Firefox browser double as security aids.  For example, she stated Firefox's ability to restore tabbing makes patching the browser and easier process, thus helping to safeguard it.  She stated, ”I really do believe that every feature is a security feature and should be evaluated as such."

While Microsoft touts that it has fewer vulnerabilities than its competitors, Mozilla measures its browser's security by a different gauge.  It judges its performance based on "days of vulnerability", the number of days between when a known exploit code for a vulnerability appears and the publication of the patch for that vulnerability.   By this measure Firefox was only vulnerable for 9 days in 2006, versus Internet Explorer, which was vulnerable 286 days of the year.

Mozilla also says that its public bug count is a mark of integrity and the lack of a public IE bug database is a way for Microsoft to hide their vulnerabilities.  Mike Schroepfer, Mozilla's VP of engineering said the lack was, "[a] vivid reminder that there is no way for anyone outside of Microsoft to confirm how many vulnerabilities ever existed in Internet Explorer."

Dave Marcus, security research and communications manager at McAfee Avert Labs, threw out an independent opinion on the issue saying the debate over "days of vulnerability" versus vulnerability counts was pointless and that the only thing that mattered was how quickly patches were made.

Firefox is also working frantically to finish fixes for its identified non-security related bugs in time for the final release of Firefox 3.

Who will win the next generation browser war remains to be seen, but as Mozilla's Firefox 3 Beta 2 release indicates, both companies are going to stake their reputation on providing the most secure solution to the consumer.

Comments     Threshold


This article is over a month old, voting and posting comments is disabled
Looks good
By FITCamaro on 12/21/2007 3:07:38 PM , Rating: 2
Does it support Protected Mode in Vista though? That's a big feature that I care about for my parents.




RE: Looks good
By chick0n on 12/21/07, Rating: -1
RE: Looks good
By TomZ on 12/21/2007 4:04:48 PM , Rating: 2
In case you decide you want to pull your head out of the sand any time soon, here is some information about Protected Mode that you might find interesting.

The idea behind Protected Mode IE is that even if an attacker somehow defeated every defense mechanism and gained control of the IE process and got it to run some arbitrary code, that code would be severely limited in what it could do. Almost all of the file system and registry would be off-limits to it for writing, reducing the ability of an exploit to modify the system or harm user files. The code wouldn't have enough privileges to install software, put files in the user's Startup folder, hijack browser settings, or other nastiness.
http://blogs.msdn.com/ie/archive/2006/02/09/528963...

Firefox doesn't have the benefit of Protected Mode under Vista, which can somewhat mitigate the damage that can be done if Internet Explorer 7 is exploited by this vulnerability.

This leads me to question why Mozilla is dragging its feet in supporting Protected Mode. I have asked Mozilla PR and its developers many times if and when it intends to support Protected Mode, and I have yet to receive an answer. The closest I got was when a Mozilla developer admitted that they had had extensive discussions with Microsoft when they were invited to Redmond for some help supporting Firefox in Vista, but I couldn't get a commitment for Protected Mode.

This is unfortunate because Firefox alone in recent months has had more exploits than Windows XP and Vista combined and is in serious need of mitigation measures (not to mention better code auditing).
http://blogs.zdnet.com/Ou/?p=461


RE: Looks good
By cochy on 12/21/2007 4:20:46 PM , Rating: 1
Well Protected Mode is somewhat redundant in Vista anyway if you're running under UAC.

Firefox runs under the current user and has it's rights while running. So if exploited it wouldn't be able to do much damage anyway without the admin password.

So in that sense Protected Mode is a lot of marketing hype.


RE: Looks good
By finalfan on 12/21/2007 4:56:49 PM , Rating: 4
UAC only protects the resource that requires administrator privilege to access. However any user owned resource won't be protected by UAC.

IE process in protected mode runs with a much less privilege than the current user which means it can also stop the unauthorized access to user resource.

That's why the protected mode is actually a great feature


RE: Looks good
By cochy on 12/21/2007 5:01:44 PM , Rating: 2
The only difference is that under protected mode IE wouldn't be able to write to Users personal data. It can still read it. Hence data can still be stolen.

Protected Mode will only protect against data being deleted in case of an intrusion. In that case, I don't care what mode you're using, you should always have a backup of your data. Don't go and tell me that "most users don't backup their data and thats why Protected Mode is so good". Because you're FAR more likely to lose your personal data in myriad other ways before your IE/Firefox is exploited and hijacked by a stack overflow.


RE: Looks good
By finalfan on 12/21/2007 5:08:08 PM , Rating: 2
You can try to create a web page that has a link to your personal file/data, a script that does the same thing or just type the URI in the address bar to see if IE will allow the access.

I cannot speak for you but at least on my machine with UAC on IE will always warn me before it can proceed.


RE: Looks good
By cochy on 12/21/2007 5:11:10 PM , Rating: 1
I'm not sure exactly what you're trying to explain. But here's a snippet from the article TomZ linked to:

quote:
Internet Explorer, on the other hand, running in Protected Mode would "only" permit the malware to have read-only access to the user's files. While that's still very bad, it's not nearly as bad as full read and write permissions. With Protected Mode, the malware still gets to steal and copy all of your personal data, but it can't alter it, delete it, or encrypt it for ransom


Even with Protected Mode personal data can be stolen.


RE: Looks good
By finalfan on 12/21/2007 5:26:26 PM , Rating: 2
The scenario only happens when

quote:
The idea behind Protected Mode IE is that even if an attacker somehow defeated every defense mechanism and gained control of the IE process and got it to run some arbitrary code, that code would be severely limited in what it could do


To prove that, type "file://c:" in both your IE7 with protected mode on and Firefox. You will know what I mean.


RE: Looks good
By cochy on 12/21/2007 6:07:18 PM , Rating: 2
Just tried that with a txt file. Both browsers displayed the contents. No warning poped-up. What did I do wrong? ;)

http://lucidmagic.net/screen.jpg


RE: Looks good
By finalfan on 12/21/2007 6:55:15 PM , Rating: 3
Try a directory instead. If a browser cannot see the file system structure how does it know which file to load. It can guess though. But it's pretty hard.

By the way, the local file is in the Trust Security Zone by default which does not have the Protected Mode on. It is automatically turned off when the content is not downloaded from internet. See http://blogs.msdn.com/ie/archive/2007/04/04/protec...

You will see Protected Mode : Off when a local file is loaded. But isn't there a dialog box telling you that IE is going to open a new instance to open a local file and indeed a new IE process is created for that file? Even there was a malicious script knows where are the files it won't be able to access them since the content is in another IE instance now.


RE: Looks good
By ChronoReverse on 12/21/2007 5:00:10 PM , Rating: 3
Protected Mode ONLY works with UAC on. It's built on the same technology as UAC is.


RE: Looks good
By cochy on 12/21/2007 5:02:58 PM , Rating: 2
Hence why is more or less not doing anything more.

Your data is still vulnerable. If this were a true sandbox, your data wouldn't be visible at all. Which is not the case here. Data can still be stolen.


RE: Looks good
By TomZ on 12/22/07, Rating: 0
RE: Looks good
By cochy on 12/22/2007 10:32:35 PM , Rating: 2
Obviously browser temp files would be in the sandbox as well.


RE: Looks good
By bigboxes on 12/24/2007 10:47:35 AM , Rating: 1
That would be great. I disable the auto-completion, saved passwords and browser history. I suppose you love pop-ups as well. I've got bookmarks for sites I want to visit again. Mozilla wins because it lets the user decide how they want to use their browser. It's not perfect, but is open for improvements. For Microsoft its a low priority. The best thing that ever happened for IE users is Firefox. Without it you'd still be stuck on IE6 and all it's vulnerabilities. I use IE when I have to, but it's only due to sites being written for IE instead of set standards.


RE: Looks good
By vortex222 on 12/28/2007 12:41:14 PM , Rating: 2
Same here. Firefox to me is simply better, for me. Granted IE7 has come some ways since IE6, but IE bit me a long time ago. I will not trust it again.


RE: Looks good
By cochy on