73 replies to this topic

[iargue]

http://www.net-secur...rld.php?id=8489

Specifically, the report identified over 3,100 total vulnerabilities, which is a 10 percent increase in Web application vulnerabilities compared to the second half of 2008. Cenzic analyzed all reported vulnerability information from sources including NIST, MITRE, SANS, US-CERT, OSVDB, OWASP, as well as other third party databases for Web application security issues reported during the first half of 2009.

'

Um... Perhaps I should uninstall Firefox?

Edited by iargue, 11 November 2009 - 12:47 PM.

[Georgina]

tbh i prefer IE ^^ i think i shall change back. Much easier to control imo

[Waser Lave]

It'd be more interesting if they included the amount of vulnerabilities with firefox + noscript.

[iargue]

It'd be more interesting if they included the amount of vulnerabilities with firefox + noscript.

Doesn't no script remove things like javascript and such, or does it just remove vulnerabilities?

[Waser Lave]

Doesn't no script remove things like javascript and such, or does it just remove vulnerabilities?

It's effectively using a whitelist rather than a blacklist so you only allow websites which you are confident are safe to use javascript/flash. Which means that if you get redirected to a possible attack site scripting will be disallowed by default.

[iargue]

It's effectively using a whitelist rather than a blacklist so you only allow websites which you are confident are safe to use javascript/flash. Which means that if you get redirected to a possible attack site scripting will be disallowed by default.

Do you have to enable it to each page you visit, or do it have some already programmed in?

And if I where to okay a website, do I have to reload the page for the script to work again?

[Hydrogen]

I checked out the website and the full report as well. The report concentrated mostly on web application technologies and their respective implementations as it mentioned a lot about SQL injection and cross-site scripting (XSS). These are browser independent as they have to do with the code written for the web application and not for any specific browser. Any browser is just as susceptible to these attacks.

I couldn't find much about vulnerabilities that affect the browser. They have a single page dedicated to the topic (page 12) out of the entire 22 page document. It's just a small blurb of about 100 words and a huge graph to take up the rest of the page. They have no discussion on the vulnerabilities they found for each browser, or even how they tested for them. It's just a blurb stating some statistic. They give no evidence. I didn't' even see a mention of version numbers for each browser. There are vast amounts of people still using IE 6. There are many who use IE 8. While they are part of the same browser family, they are vulnerable to very different attacks essentially making them two completely separate browsers. You would think that if they went into such detail in web application vulnerabilities, they would go into at least a little bit of detail for vulnerabilities that affect the browser.

If we were to say that SQL Injection and XSS attacks were still at large based off the findings of this report, that would be a reasonable claim to make. However, given the inadequacy of information given about actual browser vulnerabilities, I don't think its a fair claim to make that Firefox and Safari are more vulnerable than IE. This report may have spoken a lot about the state of web applications, but it has changed nothing as far as browsers themselves go.

Let me know if I missed something in that report though .

[Waser Lave]

Do you have to enable it to each page you visit, or do it have some already programmed in?

And if I where to okay a website, do I have to reload the page for the script to work again?

You start off with a blank whitelist and you add domains as you go along. Pretty soon you end up with all your frequently visited sites being white listed so you don't have to bother with them again.

The page reloads itself when you ok a website.

And yeah Hydro I noticed that too, it seems like a pretty shoddy report to me personally. I won't go so far as to accuse them of trying to grab headlines with their conclusion though.

Edited by Waser Lave, 11 November 2009 - 01:39 PM.

[iargue]

You start off with a blank whitelist and you add domains as you go along. Pretty soon you end up with all your frequently visited sites being white listed so you don't have to bother with them again.

The page reloads itself when you ok a website.

And yeah Hydro I noticed that too, it seems like a pretty shoddy report to me personally. I won't go so far as to accuse them of trying to grab headlines with their conclusion though.

Bah. Sounds like too much of a hassle.

[Waser Lave]

Bah. Sounds like too much of a hassle.

Well it's had 50mil+ installs so it can't be that much of a hassle for a lot of people.

[Winnie777]

I'm so surprised to IE is safer. But I guess with the increasing number of people using Firefox, hackers and malicious programs have started targeting them more. But personally, I'm SO reluctant to switch back because IE is sooooooo slow for me~

[iargue]

Well it's had 50mil+ installs so it can't be that much of a hassle for a lot of people.

Norton gets millions of installs a day, and millions of complaints...

People just dont understand computers

[Hydrogen]

I'm so surprised to IE is safer. But I guess with the increasing number of people using Firefox, hackers and malicious programs have started targeting them more. But personally, I'm SO reluctant to switch back because IE is sooooooo slow for me~

I wouldn't go so far as to say that just based off of this report.

There are more people using IE 6 than there are Firefox and Safari combined .

[Winnie777]

I wouldn't go so far as to say that just based off of this report.

There are more people using IE 6 than there are Firefox and Safari combined .

Yah, I guess you're right
Most businesses still use IE as their default browser because Microsoft designs custom functions for them. Also, Microsoft was agreements with most (if not all) major computer manufacturers to have IE pre-installed on their computers. I guess that's why it has majority market share as a web browser. I don't mind it really, except it's quite slow compared to the other browsers out there.

[beanso]

Norton gets millions of installs a day, and millions of complaints...

People just dont understand computers

That's only because that pile of SHIT is bundled with like every new computer.

[iargue]

Yah, I guess you're right
Most businesses still use IE as their default browser because Microsoft designs custom functions for them. Also, Microsoft was agreements with most (if not all) major computer manufacturers to have IE pre-installed on their computers. I guess that's why it has majority market share as a web browser. I don't mind it really, except it's quite slow compared to the other browsers out there.

No. Internet Explorer is a feature of Windows. The Manufactures didnt have to do anything. If you install windows on our own...You will still get IE.

I loved IE6 > Firefox in my opinion. 7 and 8 became too bloated

Edited by iargue, 11 November 2009 - 05:11 PM.

[Qwerty54]

I use chrome. My firefox got a wierd virus where it'd redirect any google search links to ad sites. -.-

[iargue]

I use chrome. My firefox got a wierd virus where it'd redirect any google search links to ad sites. -.-

Your infected with spyware/Hijack program. Please visit Here. Run the program, and clean it up

[BellaBleu]

No. Internet Explorer is a feature of Windows. The Manufactures didnt have to do anything. If you install windows on our own...You will still get IE.

I loved IE6 > Firefox in my opinion. 7 and 8 became too bloated

Internet Explorer is now a real "option" in windows 7, brought you by lawsuits against windows...

[iargue]

Internet Explorer is now a real "option" in windows 7, brought you by lawsuits against windows...

In....Europe...

[Hydrogen]

Internet Explorer is now a real "option" in windows 7, brought you by lawsuits against windows...

That's a good thing .

[iargue]

That's a good thing .

Not according to these statistics

[Hydrogen]

Not according to these statistics

What do you mean? They said nothing about browser vulnerabilities . The report only spoke about web application vulnerabilities. I spoke more about this in my above post .

[iargue]

What do you mean? They said nothing about browser vulnerabilities . The report only spoke about web application vulnerabilities. I spoke more about this in my above post .

Vulnerabilities in Web browsers were concentrated among four popular technologies - Internet Explorer, Mozilla Firefox, Opera, and Safari. The number of browser vulnerabilities in first half of 2009 comprised about 8 percent of total Web vulnerabilities. Mozilla Firefox had the largest percentage at 44 percent. What was surprising was that the Safari browser had a lot more vulnerabilities at 35 percent this time around mainly due to vulnerabilities reported in iPhone Safari. Internet Explorer was third at 15 percent and Opera with six percent of total browser vulnerabilities.

[Hydrogen]

I saw that page, iargue . I also posted about it in the first post I made in this topic . That paragraph says nothing about the current state of browser vulnerabilities. I don't want to rewrite my entire argument when everyone can just go up a few posts and read it .