Firefox, IE and Chrome hacked at Pwn2Own, Firefox issues secuirty update

eSecurity Planet has the story. Iceweasel in Debian Experimental is still at 19.0-1 a the time of writing, but the update will no doubt be made soon. The vulnerability is critical:

Vulnerability can be used to run attacker code and install software, requiring no user interaction beyond normal browsing.

Internet Explorer destroyed (again)

Here's a report from Pwn2Own, where hackers try to pwn various browsers for prizes.

A team of French researchers exploited two different IE zero-day flaws to break into a fully patched Windows 7 SP1 machine and take an almost unassailable lead in this year’s CanSecWest Pwn2Own competition. The hacking team, from French security research outfit VUPEN, used an unpatched heap overflow bug to bypass DEP and ASLR and a separate memory corruption flaw to break out of the browser’s Protected Mode sandbox. The code execution attack, which required no user action beyond browsing to a rigged web site, also works on Internet Explorer v10 (consumer preview) running on Windows 8.

Déjà vu.

But the real story is that Chrome also got pwned too. The leader of the successful team said:

“We wanted to show that Chrome was not unbreakable. Last year, we saw a lot of headlines that no one could hack Chrome.  We wanted to make sure it was the first to fall this year,” he said.
During the hack,  Bekrar created a web page booby-trapped with his exploit.  Once the target machine visited the page, the exploit ran and opened the Calculator (calc.exe) app outside of the sandbox.”

It looks like Firefox will fall too.

Bekrar’s team came equipped for zero-day flaws for all four major browsers — Google Chrome, Microsoft Internet Explorer, Apple Safari and Mozilla Firefox — but he said the decision to go after Chrome first was a deliberate tactic.

The safest web browser? Part II

I've written before about browser security. I found that if you look at browser exploits in the wild, which is really what matters, Internet Explorer and Firefox have been affected by such exploits in recent history. (Internet Explorer has been affected by far more further back in history, but let's put that behind us.) Looking at that criterion, Opera and Chrome are "more secure".
Of course it's also possible for a browser to be a vehicle of security compromise via a deliberate download of malware, rather than a "drive by" download as the result of a security exploit. I've also written about Microsoft's claim that Internet Exporer is much better at blocking this sort of malware than other browsers, and found that it is, but possibly with a 30-75% chance that the "malware" blocked is a legitimate file or program- a false positive rate that would cause outrage if it was a third-part anti-virus program doing it.
Now there's a new story which claims that Internet Explorer is the safest browser and Firefox is the least secure. To cut to the chase, it's Microsoft doing its own evaluation of browser security, and giving more weight to Internet Explorer's (somewhat contentious) ability to block malware than its record on security vulnerabilities.
 The story has been greeted by derision by two other writers on the ZDNet site, who point out that at the same time the story appeared Microsoft Explorer contained a major security vulnerability that affected even the latest version (IE9) which Microsoft was touting as much more secure, and that the "online security test" that Microsoft was doing was merely looking at the browser ID string and reporting Microsoft's previously-determined security assessment based on its own (some would argue biased) weighting.
Is there any truth to Microsoft's claim that Internet Explorer is "more secure" than Firefox? Another story I came across this week takes a slightly more objective look.

Paul Mehta, senior research scientist at Accuvant, told the SecTOR audience the Web browser rendering process should run at low integrity so, if it is compromised, the underlying system is still ok. In IE, the browser is assigned low integrity and the same is true for Chrome. Firefox runs everything as a medium integrity process, according to Mehta. (eSecurity Planet.)

So Internet Explorer and Chrome are "sandboxed", and Firefox isn't. Doesn't that make Firefox less secure? Well not if there are exploits which can get through the sandbox and infect the system, which is exactly the sort of exploit reported in Internet Explorer above. Which makes the Microsoft claim regarding Firefox debatable. I have reported a story which claimed that Chrome's sandbox had been breached, but never found out if there was any truth to it. So the Microsoft claim that Internet Explorer is more secure than Chrome is also debatable: we have a proven exploit of the MS sandbox, verses an unsubstantiated claim of a breach in the Chrome sandbox.
An important point to make here is that Internet Explorer is "sandboxed" and Firefox not because Microsoft won't let non-Microsoft software use its sandbox. The playing field is not level for Mozilla, Google or Opera. Chrome has chosen to add its own sandbox, which may give it a security advantage.
So what is the safest browser? Well, if you really feel the need for a sandbox, possibly Chrome. If somebody tells you its Internet Explorer 9, they've probably been listening to the Microsoft FUD. If they tell you Firefox is the least secure, then they've definitely been listening to Microsoft FUD, and as I pointed out before, they're very likely doing so for partisan rather than evidential reasons.

Microsoft's bad reputation(s)

A new report claims that Internet Explorer 9 is far better at blocking socially-engineered malware than other browsers. (This is malware which tricks the user into installing it rather than look for security weakness in software to install automatically.) IE9 is claimed to have a 96% protection rate, and its closest rival only a 13% protection rate.

Normally I'm quite sceptical of reports like this because they often turn out to have been sponsored by the firm that did so well, and that the test proves to have been biased in some way to favour the sponsor's product.
In this case, this doesn't seem to be true. The test is not Microsoft funded and the testing organisation seems to have gathered its own test samples. (However, Trend Micro has contested the findings.)
Microsoft has achieved this success using something it calls SmartScreen URL Reputation and Application Reputation. In other words, they are trying to blacklist every malicious URL that comes into existence, and whitelist every good download that exists on the web. Their users will be warned if a web site is malicious or if a download is known to be good.
How does Microsoft identify malicious URLs? windowsteamblog.com explains:

SmartScreen's reputation systems begin with telemetry feeds: reports from end users, data from third parties, traffic from URLs showing up in e-mail, logs from our services, etc. Some of these feeds contain billions of URLs per day. Other feeds contain URLs that a third party has certified to be known phishing sites, and still others contain little more than the fact that an URL has appeared in spam e-mail messages.

(End users? Does that mean that Microsoft checks every URL Internet Explorer users visit? Well, as Microsoft call it a cloud-based URL-reputation service, I would imagine yes. Cloud based would imply that URLs are sent to the mother ship to be categorised good or bad, or investigated if unknown.)

These feeds are checked largely by an artificial intelligence, but in some cases by human analysts.

we take every URL in every feed and use machine learning to predict the probability that the URL is abusive. At a high level, this involves examining each URL for suspicious substrings (for example, the word "pharmacy" in the URL), looking up the history of the URL–its associated domain, IPs, DNS servers, routers, subnets, ASNs–and combining these into tens of thousands of potentially predictive features for the URL. We then apply models based in machine learning, which pore over these features and separate the abusive URLs from the honest ones. Most of the time, we are confident enough in the findings of our machine learning engine that we can flag a URL as abusive based on this recommendation alone. Sometimes a URL is suspicious but we're not certain; we send many of these suspicious URLs to our analysts for final classification.

Microsoft seems to be being quite aggressive in extending this list of suspected malicious URLs:

With the right evidence, SmartScreen's reputation system will flag whole domains as abusive.

URLs and domains are concepts that let humans refer to computers. But every computer that's directly on the Internet also has a numeric code, called its IP address, that lets other computers refer to it. For example, 109.22.33.142 might be the IP address of the computer that's running the web server that's hosting the canada-pharmacy.us domain. SmartScreen's reputation system tracks these as well and will mark specific web server IP addresses as abusive. SmartScreen will also generalize to other computers "in the neighborhood" of known bad ones. For example, IP addresses are often allocated in blocks, and it's likely that the person who owns 109.22.33.142 also owns 109.22.33.143 and .144 and .145. We use knowledge about the way infrastructure blocks are allocated–into subnets, ASN (Autonomous System Number) blocks, the way message routing works, and more–to figure out what other computers the abusers own, and prevent those abusers from attacking Microsoft customers.

DNS servers are another key to SmartScreen's reputation system. DNS servers translate the URLs that you type into your browser into the IP addresses used by computers. SmartScreen assigns a lower reputation score to DNS servers that seem to know just a little bit too much about abusive domain names.

The aim is to increase the "costs that abusers incur as we dig deeper into their infrastructure".

Source: windowsteamblog.com.

But is Microsoft being too aggressive in blocking URLs, and downloads, because the Application Reputation system is also URL based?
The Sophos nakedsecurity blog contends that there is a 30-75% chance that Application Reputation warnings will be a false positive.
There's certainly evidence that Microsoft is sometimes getting it wrong:

Ever since the release of Internet Explorer 9, we (and other smaller sites) have been plagued by visitors who, when they attempt to download our stationery files, see a strong warning in Internet Explorer 9 about downloading and installing our files. This is worrisome. Even visitors who have been downloading our stationery for over a decade are writing and expressing their concern about the safety of our files.

We’ve changed nothing as far as the way our files are created. The problem lies with Microsoft and Internet Explorer 9′s obviously misnamed, SmartScreen filter.

And concern that Microsoft's aggressive attitude to abusers is damaging legitimate users:

When users who know us and have trusted us for years write us expressing their concern, what do you think users who have just discovered our site are going to do? You’re right: They’re going to leave and never come back. There is nothing we can do about it – Microsoft doesn’t care about the damage this kind of thing causes to small, niche sites like ours. They’re concerned about Microsoft and protecting what’s left of its reputation.

thundercloud.net

The Sophos nakedsecurity blog identifies the problem:

Users think, "If this were truly dangerous, it would have simply been blocked, right?" Microsoft's statistics show that in a real world attack 99% of users did delete the file, but this warning message is still a new phenomenon. It will be interesting to see how many click through over the long run.

Even worse, if up to 75% of the time you get the warning you are downloading a legitimate file, will you continue to pay attention to the warning when it really matters?

The statistics show that at the moment the warnings are causing Internet Explore 9 users to delete legitimate downloads. Internet Explorer 9 users need to be aware of this issue.

Microsoft may be saving you from yourself (to save its reputation?), but handing out some undeserved bad reputations. Don't assume that a SmartScreen download warning mean a file is malware, but don't become complacent and assume a warning is a false-positive too. Get the balance right.

Intelligence quotient and browser usage

OR: Correlation is not proof of causation.

New online study says Internet Explorer users are dumb, smarter users use Firefox, even smarter users use Chrome, but the smartest users use Opera.


Internet Explorer users confirm they are dumb by threatening a dumb lawsuit.

I think the Internet Explorer 6 result may have something to do with my previous post. Does the daily tedium of office life for civil service and other corporate users of IE6 decrease IQ with time?

(Story first seen on the Debian Forum.)

Update: The BBC has the story.

The findings have been treated with scepticism by Professor David Spiegelhalter of Cambridge University's Statistical Laboratory: "They've got IE6 users with an IQ of around eighty. That's borderline deficient, marginally able to cope with the adult world.

Just for fun, I tried searching Google for an image of an Internet Explorer user to see if it matched the description.

LOL.

Image: shoutEx.

Update 2: The story seems to have been a hoax, according to the BBC.

Why Firefox dumped corporate users

From a BBC story on UK government being ripped off on IT:

I'm a civil servant and have to use these IT systems. For all the money that is spent on them I'm using a machine that's 7 years old, has minimal memory and hard-drive capacity, is running Internet Explorer 6, has snail's pace connectivity speed and find it really difficult to do my job. And as you all may know, everything is done on computers these days.

Corporate use = browser fossilisation.

The safest web browser?

(OR: What connects Internet Explorer and Rush Limbaugh)

Surely not a difficult question to answer? Just look at the statistics for security vulnerabilities- especially those that were exploited by malware "in the wild" before a patch was issued and how long those vulnerabilities remained unpatched.

Source: Web Devout.

Historically, the answer would certainly not have been Internet Explorer. It has the worst record for zero-day vulnerabilities leaving the browser open to "drive-by" malware attacks for considerable periods before a patch was released- it has left its users vulnerable to such attacks on numerous occasions.

To my knowledge, Firefox has only exposed its users to one such vulnerability, and only briefly, and only to malware on one specific website, rather than widespread attacks. Still, to my recollection, Opera, although it has had vulnerabilities, has patched these before they were used in malware attacks; the same for Chrome.

So, historically, if I had to guess, Opera or Chrome might get the award. To Microsoft's credit, they recognised the security problems with their browser and recent versions have been a lot more secure. Anybody interested in the original question could look at the data on browser vulnerabilities for recent versions and follow the evidence.

The evidence will tell you the answer- a purely logical process that tends to invoke irrational responses. Why?

The first illogical response is the common statement that Internet Explorer is used by more people and therefore a bigger target and therefore more looked at for vulnerabilities. This excuse ignores the evidence that Internet Explorer is more open to exploit because it has features that other browsers don't have that have their own security weaknesses, such as ActiveX, and because it is more integrated into the Microsoft operating system. It also ignores the evidence that hackers find Internet Explorer easier to hack.

The second illogical response is usually an attack on Firefox, usually along the lines of "Firefox sucks" or similar. Should Firefox users then point out the evidence, they are then often labelled as "fanboys", despite the juvenile nature of their own emotional response- an unsophisticated form of ad-hominem attack known as "projection".

Back to the question- why? And why is it Firefox that is resented by Internet Explorer users? I think the answer is political. The people who resist the evidence that Internet Explorer is not as secure as other browsers often subscribe to a loud-mouthed extreme right wing ideology. Take for example this post to a thread on browser security:

Anything has to be better than FF. (Roll Eyes)

With the signature:

"If you want to make a Conservative angry, tell him a lie. If you want to make a Liberal angry, tell him the truth." - Rush Limbaugh

Now you could say I'm stretching one comment to make a point.

But the internet long called Poe on the American fringe right's antipathy to Firefox: Exhibit 1, Exhibit 2.

The extreme hard right mentality resents a group of people working together to produce a better browser for free: it undermines their belief in the superiority of free-market capitalism in producing better software, and indeed a better world than any collective, altruistic enterprise run by wishy-washy socialists, as they would see the open-source community.

The idea that open-source software is a tool of socialism designed to undermine capitalism is of course total nonsense. Wherever could the hard right have got that idea from?


(Possibly it's the result of a complete lack of a sense of humour?)

As a footnote, the only thing the hard right hate more than a collective, altruistic enterprise interfering with a commercial enterprise, it's a collective, altruistic enterprise interfering in the economy itself- which is why the anti-Firefox trolls have turned their attention to climate science and global warming.

Internet Explorer destroyed

Here's a report from Pwn2Own, where hackers try to pwn various browsers for prizes.

Internet Explorer 8 was utterly destroyed by the security researcher Stephen Fewer who used three various techniques crack through the IE 8′s security parts such as ASLR/DEP. He also managed to escape the protected mood of the IE 8 and that was a quite a mesmerizing feat by a independent researcher. Here is what Aarion Portnoy, the organizer of Pwn2Own said about the amazing feat -

“He used three vulnerabilities to bypass ASLR and DEP, but also escape Protected Mode. That’s something we’ve not seen at Pwn2Own before,” Aarion Portnoy

A good excuse to post the wallpaper above by Joshua Holbrook.

Favicon malware

Nothing could seem more innocent than a favicon. It's the little website icon that sits next to the website address in the browser address bar and is added to your list of favourites (or bookmarks according to the browser you're using). But the little favicon.ico can be infected with malware. (See here and here.)
Nothing is more frustrating than a malware detection from your anti-virus program which reappears every two minutes whatever you do, as seen here on the avast! forum, and here detected by AVG- favicon malware was the cause both times, of course.
But why was the malware reappearing every two minutes? My best guess is that IE was downloading missing favicons, either after the cache had been cleared, or malicious favicons deleted.