Hackers turn to Mozilla (1 Viewer)

[Chxta]

The growing popularity of Mozilla-based Web browsers appears to be attracting the attention of the malicious hacking community.

Between July 1, 2004, and Dec. 31, 2004, the number of documented vulnerabilities affecting the Mozilla browser and the Mozilla Foundation's Firefox browser was higher than the number of vulnerabilities affecting Microsoft's Internet Explorer, according to the latest Internet Security Threat Report from Symantec released Monday.

The report, which provides an update of Internet threat activity worldwide every six months, noted 13 vulnerabilities affecting IE. That compared with 21 vulnerabilities affecting the Mozilla and Mozilla Firefox browsers during the survey period.

IE, however, still had a higher proportion of serious vulnerabilities, with 9 of the 13 flaws rated as highly severe. By comparison, 11 of the 21 Mozilla browser flaws were deemed highly severe, and just 7 of the Firefox flaws were seen as highly severe. The IE flaws also took longer to fix--an average of 43 days, compared with 26 days for Mozilla browsers.

Drawing Attention

"We are starting to see Firefox and Mozilla get more attention from attackers, and that is likely to continue," says Alfred Huger, senior director of engineering at Symantec. "People who are writing Trojans and worms that get distributed via Web browser vulnerabilities are looking for the highest yield."

Traditionally, IE has been the most targeted browser because of its widespread use, but that could begin to change as Mozilla browsers gain popularity, he says. Since 1997, Symantec has documented 313 vulnerabilities for IE, and fewer than 100 for Mozilla browsers.

Symantec's study, based on information gathered from over 20,000 sensors deployed on customer networks in 180 countries, also noted a continuing rise in the number of new vulnerabilities discovered. Between July 1 and December 31, 2004, Symantec documented 1403 new vulnerabilities--13 percent more than the 1237 vulnerabilities found in the first six months of 2004. Out of these, nearly half--or 670 flaws--affected Web-connected applications, a 39 percent increase over the first six months of 2004.

Nearly 97 percent of the newly discovered flaws were rated as being of moderate to high severity, while 70 percent were reported as being easy to exploit.

In a break from recent trends however, malicious attackers also appeared to be taking more time to exploit new vulnerabilities. In the latest study, the time it took hackers to exploit new flaws rose on average to 6.4 days, compared with 5.8 days previously.

PC World

 

Buy on AliExpress.com

[Chxta]

The actual report is here. The specific sections are on pages 8 and 9. On p.45 the report says:

"So far, nearly all reports of vulnerabilities exploited in the wild against browsers are associated with Microsoft Internet Explorer. While there have been few, if any, credible reports of attacks against Mozilla, Mozilla Firefox, Opera, or Safari in the wild..."

The methodology for the study is on p.90, which states several things:

- only vulnerabilities confirmed by the vendor were included. I assume this isn't how their AV updates work?

- vulnerabilities need never be exploited to be included. I.e., it may be near impossible to actually exploit.

- A vulnerability could actually be defined as a string of conditions, each one counted seperately, though they may be interdependent. This might "distort" the numbers (their claim, not mine).

Then the actual vulnerabilities are not mentioned, nor if all of these have been patched.

 

[Chxta]

Personally, I think complacency is Microsoft's problem. They've been the leader for so long that they didn't bother looking over their shoulders. Now they are resorting to such cheapskates as using the media to attack the open source community.

I am now a proud (and very happy) user of Firefox, OpenOffice.org and ZoneAlarm.

Yes, ZoneAlarm. Because even the writers of that report, Symantec have become complacent. ZoneAlarm long ago surpassed Norton as the best PC protection suite.

 

[Ramin]

..

oohh nooo