backtop

Print E-mail del.icio.us 49 comment(s) - last by vortex222.. on Dec 28 at 12:41 PM
Firefox 3 is shaping up to be a very secure browser thanks to new features

A scathing report on browser security from Microsoft, which claimed in an "unbiased" analysis that Internet Explorer was vastly more secure than Mozilla's Firefox, ignited a recent war of words between the two browser makers.  However, Mozilla decided that it was wiser to back up its words with action, rather than just more talk.

The end result is that the company just released the second beta candidate of the third iteration of its increasingly popular Firefox browser, and this release ups the ante on security with many new features.

The new browser has tighter protection against cross-site restrictions on cookies, better malware protection, clearer website identification information in the status bar, stricter SSL error pages, version checking for insecure plugins, a built in antivirus program in the download utility, and improved protection against JSON data leaks.

The feature Mozilla is most proud of is its improved protection from malicious sites.  When a user visits a malicious site in Firefox 3, the browser plays sheriff and blocks the site.  Even better; it does it with an interface that does not allow click through.

Mozilla's "Chief Security Something-or-Other" (according to his business cards) Window Snyder says that even the utilitarian features in the Firefox browser double as security aids.  For example, she stated Firefox's ability to restore tabbing makes patching the browser and easier process, thus helping to safeguard it.  She stated, ”I really do believe that every feature is a security feature and should be evaluated as such."

While Microsoft touts that it has fewer vulnerabilities than its competitors, Mozilla measures its browser's security by a different gauge.  It judges its performance based on "days of vulnerability", the number of days between when a known exploit code for a vulnerability appears and the publication of the patch for that vulnerability.   By this measure Firefox was only vulnerable for 9 days in 2006, versus Internet Explorer, which was vulnerable 286 days of the year.

Mozilla also says that its public bug count is a mark of integrity and the lack of a public IE bug database is a way for Microsoft to hide their vulnerabilities.  Mike Schroepfer, Mozilla's VP of engineering said the lack was, "[a] vivid reminder that there is no way for anyone outside of Microsoft to confirm how many vulnerabilities ever existed in Internet Explorer."

Dave Marcus, security research and communications manager at McAfee Avert Labs, threw out an independent opinion on the issue saying the debate over "days of vulnerability" versus vulnerability counts was pointless and that the only thing that mattered was how quickly patches were made.

Firefox is also working frantically to finish fixes for its identified non-security related bugs in time for the final release of Firefox 3.

Who will win the next generation browser war remains to be seen, but as Mozilla's Firefox 3 Beta 2 release indicates, both companies are going to stake their reputation on providing the most secure solution to the consumer.

Comments     Threshold


This article is over a month old, voting and posting comments is disabled
Looks good
By FITCamaro on 12/21/2007 3:07:38 PM , Rating: 2
Does it support Protected Mode in Vista though? That's a big feature that I care about for my parents.




RE: Looks good
By chick0n on 12/21/07, Rating: -1
RE: Looks good
By TomZ on 12/21/2007 4:04:48 PM , Rating: 2
In case you decide you want to pull your head out of the sand any time soon, here is some information about Protected Mode that you might find interesting.

The idea behind Protected Mode IE is that even if an attacker somehow defeated every defense mechanism and gained control of the IE process and got it to run some arbitrary code, that code would be severely limited in what it could do. Almost all of the file system and registry would be off-limits to it for writing, reducing the ability of an exploit to modify the system or harm user files. The code wouldn't have enough privileges to install software, put files in the user's Startup folder, hijack browser settings, or other nastiness.
http://blogs.msdn.com/ie/archive/2006/02/09/528963...

Firefox doesn't have the benefit of Protected Mode under Vista, which can somewhat mitigate the damage that can be done if Internet Explorer 7 is exploited by this vulnerability.

This leads me to question why Mozilla is dragging its feet in supporting Protected Mode. I have asked Mozilla PR and its developers many times if and when it intends to support Protected Mode, and I have yet to receive an answer. The closest I got was when a Mozilla developer admitted that they had had extensive discussions with Microsoft when they were invited to Redmond for some help supporting Firefox in Vista, but I couldn't get a commitment for Protected Mode.

This is unfortunate because Firefox alone in recent months has had more exploits than Windows XP and Vista combined and is in serious need of mitigation measures (not to mention better code auditing).
http://blogs.zdnet.com/Ou/?p=461


RE: Looks good
By cochy on 12/21/2007 4:20:46 PM , Rating: 1
Well Protected Mode is somewhat redundant in Vista anyway if you're running under UAC.

Firefox runs under the current user and has it's rights while running. So if exploited it wouldn't be able to do much damage anyway without the admin password.

So in that sense Protected Mode is a lot of marketing hype.


RE: Looks good
By finalfan on 12/21/2007 4:56:49 PM , Rating: 4
UAC only protects the resource that requires administrator privilege to access. However any user owned resource won't be protected by UAC.

IE process in protected mode runs with a much less privilege than the current user which means it can also stop the unauthorized access to user resource.

That's why the protected mode is actually a great feature


RE: Looks good
By cochy on 12/21/2007 5:01:44 PM , Rating: 2
The only difference is that under protected mode IE wouldn't be able to write to Users personal data. It can still read it. Hence data can still be stolen.

Protected Mode will only protect against data being deleted in case of an intrusion. In that case, I don't care what mode you're using, you should always have a backup of your data. Don't go and tell me that "most users don't backup their data and thats why Protected Mode is so good". Because you're FAR more likely to lose your personal data in myriad other ways before your IE/Firefox is exploited and hijacked by a stack overflow.


RE: Looks good
By finalfan on 12/21/2007 5:08:08 PM , Rating: 2
You can try to create a web page that has a link to your personal file/data, a script that does the same thing or just type the URI in the address bar to see if IE will allow the access.

I cannot speak for you but at least on my machine with UAC on IE will always warn me before it can proceed.


RE: Looks good
By cochy on 12/21/2007 5:11:10 PM , Rating: 1
I'm not sure exactly what you're trying to explain. But here's a snippet from the article TomZ linked to:

quote:
Internet Explorer, on the other hand, running in Protected Mode would "only" permit the malware to have read-only access to the user's files. While that's still very bad, it's not nearly as bad as full read and write permissions. With Protected Mode, the malware still gets to steal and copy all of your personal data, but it can't alter it, delete it, or encrypt it for ransom


Even with Protected Mode personal data can be stolen.


RE: Looks good
By finalfan on 12/21/2007 5:26:26 PM , Rating: 2
The scenario only happens when

quote:
The idea behind Protected Mode IE is that even if an attacker somehow defeated every defense mechanism and gained control of the IE process and got it to run some arbitrary code, that code would be severely limited in what it could do


To prove that, type "file://c:" in both your IE7 with protected mode on and Firefox. You will know what I mean.


RE: Looks good
By cochy on 12/21/2007 6:07:18 PM , Rating: 2
Just tried that with a txt file. Both browsers displayed the contents. No warning poped-up. What did I do wrong? ;)

http://lucidmagic.net/screen.jpg


RE: Looks good
By finalfan on 12/21/2007 6:55:15 PM , Rating: 3
Try a directory instead. If a browser cannot see the file system structure how does it know which file to load. It can guess though. But it's pretty hard.

By the way, the local file is in the Trust Security Zone by default which does not have the Protected Mode on. It is automatically turned off when the content is not downloaded from internet. See http://blogs.msdn.com/ie/archive/2007/04/04/protec...

You will see Protected Mode : Off when a local file is loaded. But isn't there a dialog box telling you that IE is going to open a new instance to open a local file and indeed a new IE process is created for that file? Even there was a malicious script knows where are the files it won't be able to access them since the content is in another IE instance now.


RE: Looks good
By ChronoReverse on 12/21/2007 5:00:10 PM , Rating: 3
Protected Mode ONLY works with UAC on. It's built on the same technology as UAC is.


RE: Looks good
By cochy on 12/21/2007 5:02:58 PM , Rating: 2
Hence why is more or less not doing anything more.

Your data is still vulnerable. If this were a true sandbox, your data wouldn't be visible at all. Which is not the case here. Data can still be stolen.


RE: Looks good
By TomZ on 12/22/07, Rating: 0
RE: Looks good
By cochy on 12/22/2007 10:32:35 PM , Rating: 2
Obviously browser temp files would be in the sandbox as well.


RE: Looks good
By bigboxes on 12/24/2007 10:47:35 AM , Rating: 1
That would be great. I disable the auto-completion, saved passwords and browser history. I suppose you love pop-ups as well. I've got bookmarks for sites I want to visit again. Mozilla wins because it lets the user decide how they want to use their browser. It's not perfect, but is open for improvements. For Microsoft its a low priority. The best thing that ever happened for IE users is Firefox. Without it you'd still be stuck on IE6 and all it's vulnerabilities. I use IE when I have to, but it's only due to sites being written for IE instead of set standards.


RE: Looks good
By vortex222 on 12/28/2007 12:41:14 PM , Rating: 2
Same here. Firefox to me is simply better, for me. Granted IE7 has come some ways since IE6, but IE bit me a long time ago. I will not trust it again.


RE: Looks good
By cochy on 12/21/2007 4:44:50 PM , Rating: 3
btw that article you quote. Talk about Microsoft biased.

It's already been stated how the difference between the way Microsoft and Mozilla report bugs is misleading if you compare them.


RE: Looks good
By Zurtex on 12/21/2007 5:11:21 PM , Rating: 2
Well, given Firefox's development is open it's not hard to find out where they are on this, here is the bug:

https://bugzilla.mozilla.org/show_bug.cgi?id=26653...

It's on 'wanted' for Firefox 3, but there's no devlopment on it at the moment.


RE: Looks good
By SiliconAddict on 12/21/2007 5:27:38 PM , Rating: 2
They don't support protected mode because Firefox is OS agnostic. The minute you start supporting specific OS features is the minute you start making Firefox way more complicated to port from OS to OS.
Personally I don't really give a shit. With the various extensions Firefox has that you can add to your browser you can easily make is a very secure environment. This is just a pissing match by MS and its fanboi base. As if Protected Mode makes up for a decade of shit browsers. That and show me how I uninstall and reinstall IE when it decides to brake.


RE: Looks good
By Zurtex on 12/21/2007 5:33:11 PM , Rating: 2
This is just not true, while Firefox doesn't want to get in to heavy OS integrated features like the Windows RSS reader, it does pick up some features when it's needed or very useful for users.


RE: Looks good
By FITCamaro on 12/21/2007 6:04:33 PM , Rating: 1
Then don't fucking use it. I didn't ask your personal opinion of it.

I know my parents and don't want shit to get installed on their PC. I would much rather an attack only be able to read data from them (which it can also do through Firefox) than be able to do that and install things on their PC which I then get a phone call about how to fix. I use nothing but Firefox myself but I want them to have the maximum protection they can.

So keep your little snot nosed opinions to yourself unless someone asks for them.


RE: Looks good
By cochy on 12/21/2007 6:40:30 PM , Rating: 2
Well unless I'm wrong here, you can't installed an application on a Windows machine without admin access, which is the whole point behind UAC. Firefox plays by UAC's rules.

Side-note: I can't seem to get Protected Mode working with Vista 64-bit. It's enabled in options, but it indicates that it's off inside IE. Anyone else have this isssue?


RE: Looks good
By finalfan on 12/21/2007 7:21:21 PM , Rating: 2
Without the admin right, an application cannot be installed for ALL users. I have to admit just to install application for only one user sometimes is still difficult all depends on how the installer is written. However, being able to access the user's file space and copy some executables to, hijack user's configuration, modify user's start up folder as well as user's registry (HKCU) can do enough damage to the user.

All of these can be prevented by using the protected mode. It's not perfect but it adds additional protection which Firefox doesn't have.


RE: Looks good
By Chaser on 12/22/2007 11:02:46 AM , Rating: 2
Camaro on roid rage! :)


RE: Looks good
By Etsp on 12/22/2007 3:11:11 PM , Rating: 2
Camaro is a professional baseball player?? I never knew...


RE: Looks good
By Xenoterranos on 12/27/2007 12:18:10 PM , Rating: 2
He could also be a pro football player, bicyclists, various kind of Olympic athlete, and/or a horse.


RE: Looks good
By Screwballl on 12/22/2007 12:17:07 PM , Rating: 1
When IE is literally embedded into the OS, it has direct ties to the OS files, settings and security. Since FF is not tied directly into the system and it runs as a normal program, it does not have access to all the system critical functions of the OS so it doesn't have the vulnerability or need to really run under Protected mode. Only if you have saved passwords or keep all secure site cookies does it possibly run that risk.

So your point is mute FITCamaro.

Analogy: your car comes with a car radio that has a built in alarm bypass code. Someone looking to steal these cars knows the code format and bypasses it in a few minutes and your car is now theirs. But if you remove that radio and put in a 3rd party radio (Audiovox, Pioneer, whatever), the alarm bypass function is not usable and your car is secure from that threat.

Since FF doesn't have the same system permissions and embedded files as IE, then it is not likely to cause nearly as many problems or be targeted as much as IE.


RE: Looks good
By TomZ on 12/22/07, Rating: -1
Maybe I missed something
By Belegost on 12/22/2007 5:28:44 AM , Rating: 3
'Dave Marcus, security research and communications manager at McAfee Avert Labs, threw out an independent opinion on the issue saying the debate over "days of vulnerability" versus vulnerability counts was pointless and that the only thing that mattered was how quickly patches were made.'

But, wouldn't "days of vulnerability" be a measure of how long issues took to patch? Certainly it doesn't cover all issues, only the publicly announced exploits, but it at least seems to give some measure of how quickly patches were made.




RE: Maybe I missed something
By rcsinfo on 12/22/2007 1:27:01 PM , Rating: 2
I agree, the two terms are very similar. But I think you could look at two theoretical situations and see a slight difference:

1) A browser that had a single flaw this year, that was patched after 50 days.
2) Another browser where a new flaw was discovered almost every week, but was consistently patched within 24 hours.

Both these situations have ~50 "days of vulnerability."

Dave Marcus would call the second browser superior, as it averaged a 24 hour fix window. Microsoft would call the first browser superior as it only had one public vulnerability. Mozilla would call the two equal.


RE: Maybe I missed something
By TomZ on 12/22/2007 2:36:19 PM , Rating: 1
The problem with these measures is that they don't include the number of days that end users are running unpactched browser versions that are susceptible to the vulnerabilities.

A more sophisticated measure would be number of days until 90% (or 95% or whatever number) of installed browsers are updated for a particular vulnerability. That gives a more accurate view of the potential impact of a vulnerability, and it also allows the efficacy of the update process to become part of the security metric, which is important.


RE: Maybe I missed something
By Zurtex on 12/23/2007 7:08:11 AM , Rating: 2
Mozilla do measure metrics like that if you read in to their security reports.


RE: Maybe I missed something
By tomal on 12/24/2007 9:31:02 AM , Rating: 3
In the light of the opinion from McAfee manager, opera and firefox beats IE by good margins.

By da way, why is everyone busy about security battle between firefox & IE??? When it comes to security, the biggest problem is social engineering. Lack of security knowledge is the main problem and everyone should focus on educating mainly typical users about the importance of security.


Sex of Window Snyder
By 16nm on 12/21/2007 6:29:56 PM , Rating: 2
I gotta know. Is Window Snyder a woman or man. Who would name their child Window? Lol. That sounds very silly in English, but perhaps no more than "Chandelier."

quote:
Mozilla's "Chief Security Something-or-Other" (according to his business cards) Window Snyder says that even the utilitarian features in the Firefox browser double as security aids. For example, she stated ...


So what is it, Window man or Window woman?




RE: Sex of Window Snyder
RE: Sex of Window Snyder
By 16nm on 12/21/2007 9:11:25 PM , Rating: 2
That a picture of Window Snyder? Interesting. She looks American to me. I was expecting more of a foreigner with a name like that. She's a window into her parents' past I guess.


RE: Sex of Window Snyder
By TomZ on 12/22/2007 8:01:40 AM , Rating: 1
How can you tell she's American from a picture? Can you see her accent? LOL.


RE: Sex of Window Snyder
By Xenoterranos on 12/27/2007 12:22:01 PM , Rating: 2
That is one sexy brain.


Normal users won't care
By Some1ne on 12/22/2007 5:59:23 PM , Rating: 2
While I understand why neither side wants to have an "insecure" browser, and that security issues make for good fodder for debate amongst engineers and computer geeks about which browser is technically superior, I don't think it's something that's really viewed as a high priority by a typical computer user (ditto for other things like standards compliance...if a typical user visits a webpage and it doesn't render correctly because the browser is processing the CSS incorrectly, they're not going to think "well that's my browser's fault for handling CSS incorrectly", they're going to think "well that's the website's fault for being coded wrong"). I think that most users care primarily that their browser be fast, easy to use, and stable. So while it's good that progress is being made (on both sides) in the area of security, I'd also like to see them do more to point out the progress being made (and the difference between one platform and another) in the areas that typical users care about.

For example, a typical user looking at the list of new security features added in beta 2:

quote:
The new browser has:

1. Tighter protection against cross-site restrictions on cookies.
2. Better malware protection.
3. Clearer website identification information in the status bar.
4. Stricter SSL error pages.
5. Version checking for insecure plugins.
6. A built in antivirus program in the download utility.
7. Improved protection against JSON data leaks.


...might respond with something along the lines of:

1. I don't care. I can't even tell what that feature even does.
2. I don't need my browser to do something my antivirus/antispyware software is already doing.
3. Okay, fine.
4. I don't care. I don't even want to have to see an error page if there's an SSL error. I want the browser to just go.
5. I don't care. I almost never install plugins anyways.
6. Same as #2, the browser should just be a browser, and not an antivirus utility.
7. Wtf is a "JSON data leak"?




RE: Normal users won't care
By FITCamaro on 12/23/2007 10:39:42 PM , Rating: 2
You assume a typical user is even going to look at the list of improvements.


RE: Normal users won't care
By tomal on 12/24/2007 9:23:32 AM , Rating: 2
i dont think firefox users are mostly typical home users. In fact most typical users use mainly IE coz they dont even bother about using alternative browsers. I mean why bother about something else when you can already browse. Most firefox users know that IE is insecure or they just want to use another browser that is different from IE and typically these users have some technical knowledge.

So i think the list of improvements is important as it is mainly addressed for the beta testers.


Big Brother?
By Some1ne on 12/22/2007 5:39:25 PM , Rating: 2
quote:
The feature Mozilla is most proud of is its improved protection from malicious sites. When a user visits a malicious site in Firefox 3, the browser plays sheriff and blocks the site. Even better; it does it with an interface that does not allow click through.


That doesn't seem like the greatest idea in the world. Or at least I, for one, do not want my browser trying to tell me what pages I can and cannot be visiting, even if it is supposedly "for my own good". What happens if someone compromises the list that Mozilla uses to specify "malicious" sites to its browser and then adds a bunch of popular, benign websites to it.

At the very least, I hope the user is able to completely disable this feature if they want.




RE: Big Brother?
By tomal on 12/24/2007 9:11:33 AM , Rating: 2
You can disable the feature. It is not trying to be big brother. You do have the liberty to disable such options.


Here's a thought:
By Pythias on 12/23/2007 9:19:48 AM , Rating: 2
Either browser is as safe as the person using it.




RE: Here's a thought:
By tomal on 12/24/2007 9:15:59 AM , Rating: 2
yeah i agree 100% with you. If you dont visit malicious websites, either browser is as safe as others.


No built-in antivirus
By Lezmaka on 12/24/2007 8:59:31 PM , Rating: 2
Firefox 3 does not have a built-in anti-virus in the download utility. It has functionality to inform anti-virus software when it is downloading an executable. Which seems kind of pointless, since don't most real-time anti-virus software scan files when they are created?




RE: No built-in antivirus
By Master Kenobi (blog) on 12/28/2007 10:46:43 AM , Rating: 2
You nailed it. It's just a PR stunt.


paranoia is also bad
By mforce on 12/22/2007 9:37:55 PM , Rating: 2
Security is good but when it gets too much and gets in the way I start hating the security features. Security should be coded in such a was as to protect the user as much as possible but also not complicate his usage of that software too much. If you get something that bothers you with everything you want to do, asking for you permission or can't access almost all of your data then that isn't nice anymore and the thing that it's secure somehow doesn't make it that much better.




"This is from the DailyTech.com. It's a science website." -- Rush Limbaugh

DailyTech Poll
Which web browser do you use on your primary personal machine? 






44 Comments









botimage
Copyright 2009 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki