Chrome is the most secure browser, claims new study
Posted on 12 December 2011.
Microsoft's Internet Explorer does a better job protecting systems from attackers who already have gained some degree of access than Mozilla's Firefox, and Google's Chrome trumps both of them, says security firm Accuvant.

They came up with those results by analyzing the security features of the three most popular web browsers, but have decided not to employ the usual metrics: numbers of patched vulnerabilities, the severity of the flaws and the time it took for the developers to fix them.

Instead, they chose to assume that hackers have already exploited a bug and have managed to gain some access to the machines, and see what exploit mitigation techniques the browsers use to lessen the potential damage to the system.

And while all three browsers employ address space layout randomization (ASLR), data execution prevention (DEP) and stack cookies (GS), Firefox does not implement sandboxing (the separation of running programs), plug-in security and Just-In-Time hardening (preventing javascript located on websites from compiling code that can be run on the target system).

On the other hand, it turns out that URL blacklisting techniques used to warn users about malicious sites work only in a small percentage of cases and are, effectively, not enough.

"As with antivirus, the question is not whether the pattern-based detection will fail, but when and how," point out the researchers. "As such, blacklisting services should be considered a part of the overall browser defense model, rather than the only perimeter an attacker must traverse."

These conclusions were the result of a study performed by the security company on behalf of Google, so they should perhaps be taken with a grain salt. Nevertheless, Accuvant is a respected firm that is unlikely to sully its reputation by letting the results be affected by the fact that Google asked for the analysis.

The researchers made great points regarding their choice of metrics and the need to look at the complete picture when evaluating the efficacy of any software. "Drawing conclusions based solely on one category of protection, such as blacklisted URL statistics, doesn’t give a valid perspective on which browser is most secure," they pointed out. "Instead, they should be considered in the context of other mechanisms such as anti-exploitation technologies and malicious plug-in protection, which play a more important role in protecting end users from exploits and persistent malware."

"There will always be browser vulnerabilities, but browser appraisal must be derived from metrics that can be accurately correlated," they concluded.

To download the 102-page-long report issued by Accuvant, go here.


Critical bug found in Cisco ASA products, attackers are scanning for affected devices

Several Cisco ASA products - appliances, firewalls, switches, routers, and security modules - have been found sporting a flaw that can ultimately lead to remote code execution by attackers.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Feb 12th