A security researcher has published exploit code for the latest Internet Explorer zero-day flaw on the Web and Microsoft is warning that more attacks against the unpatched vulnerability can be expected in-the-wild. One thing seems to be more apparent with each passing Internet Explorer (IE) vulnerability: its time to upgrade the Web browser.
IE6 is Not Secure
Wolfgang Kandek, CTO of Qualys, noted via email “IE6 is a 10-year old browser, with its architecture designed when the Internet was a much more innocent place. IE8 has many additional security features and had the Microsoft SDL [Security Development Lifecycle] applied throughout. Its CSS and JavaScript support are much better than IE6, or even IE7, and it is a much more robust interface for the new Web 2.0 type applications.”
Joshua Talbot, Security Intelligence Manager, Symantec Security Response agreed “IE 6 does not have the security features implemented in later versions of IE; for example, Data Execution Prevention (DEP) and Protected Mode. DEP makes it more difficult for attackers to successful exploit memory corruption vulnerabilities, while Protected Mode limits what an attacker can do if they are able to gain control of the IE process.”
This is the part where many readers stop reading and jump over to the comments to express their opinion–sometimes quite passionately–that everyone should just stop using Internet Explorer completely and that anyone who chooses to continue using IE as their Web browser deserves the issues and security concerns that come with it.
Judging from the Web browser market share trends, there are many who subscribe to the “drop Internet Explorer” mantra. Microsoft has seen steady–although minute–declines in market share month after month, while rival Web browsers such as Firefox and Chrome continue to make gains. Still, Microsoft holds a dominant stake at almost 62 percent–more than double the share held by second-place Firefox.
If you drill a little deeper in the browser market share data, though, you will find that not only is Internet Explorer the number one browser, but IE8 specifically is at the top of the list with more than 22 percent of the browser market. Not too shabby for a browser that will celebrate its one-year anniversary next week.
What is concerning is that the number two browser is the nine year old IE6 at almost 20 percent of the market. Although IE7 has been available for almost four years, it is the number four browser, coming in behind Firefox 3.5 with a meager 13.57 percent.
Wean Off of IE6
IE6 is simply not secure and businesses and IT administrators should make it a priority to upgrade the Web browser as soon as possible. The Web is a major vector for cyber attacks and the Web browser is the Achilles heel that makes organizations vulnerable and creates the weakest link in the security chain.
Of course, it’s not quite that easy. Many organizations that still rely on IE6 would like to make the switch to IE8 but can’t. Kandek explained “In the corporate environment, software is managed, and IE6 or IE7 are part of the initial, approved build that works on all internal applications. Requalifying that build against all internal applications is a large effort that many companies do not have resources for.”
“If they do, they might find applications that specifically use IE6 features that are incompatible with other browsers. Recently one of our larger customers told me that they had dozens of applications that do not run under IE8,” continued Kandek.
Symantec’s Talbot shared the same concerns “For enterprises, not only is there a cost to purchase software, there is also the cost to deploy and maintain. An enterprise must quality-assure software to ensure the new version meets the current needs and that there are no compatibility issues. They must also allocate IT resources to deploy the update. Then there is also an education component that must be provided for users to address differences between versions and how to handle known compatibility issues.”
A Microsoft spokesperson commented via e-mail to say “Microsoft has consistently recommended that consumers upgrade to the latest version of our browser. Internet Explorer 8 offers improvements in speed, security and reliability as well as new features designed for the way people use the web. While we recommend Internet Explorer 8 to all customers, we understand we have a number of corporate customers for whom broad deployment of new technologies across their desktops requires more planning.”
I understand that it can be a daunting undertaking to ensure that all commercial software and custom internal applications used by the organization will work properly under a newer Web browser–or find and implement alternate applications that will. Continuing to run IE6, though, is like leaving your car unlocked with the keys in the ignition.
Internet Explorer 8 Wins Against Social-Engineering Attacks
Socially-engineered malware attacks–or phishing attacks–pose an increasing risk to organizations. These attacks use social engineering and exploit the trust of the end-user to compromise, steal, or damage sensitive information.
The NSS Labs report claims “53 percent of malware is now delivered via Internet download versus just 12 percent via e-mail according to statistics from Trend Micro. And, according to Microsoft, as many as 0.5 percent of the download requests made through Internet Explorer 8 are malicious.”
NSS Labs tested five Web browsers (IE, Firefox, Safari, Chrome, and Opera) over the course of 18 days. Testing was conducted 24×7 during the evaluation period, attacking the browsers with more than 550 socially-engineered malware links.
This was the third time NSS Labs has conducted these Web browser security tests. According to the report, “Over the three tests, Windows Internet Explorer 8 provided the best protection against socially-engineered malware and was the only browser that improved its block rate test-over-test, successfully stopping 69 percent, 81 percent, and 85 percent of threats in each respective test.”
Talbot explained that there is nothing magical that makes any Web browser inherently superior to the rest. “Applications and operating systems from any vendor typically don’t have anything special in terms of their code that makes them impervious to vulnerabilities and therefore attacks.”
“It really comes back to the fact that the more popular software is the more it will be targeted. Thus, if everyone in the world switched to some obscure browser with very little market share, attackers would start targeting it. Attackers go where the money is, and the money is wherever the people are,” summed up Talbot.
Tyler Reguly, lead research engineer for nCircle, also responded by e-mail and expressed similar sentiment that the browser itself is not the issue. “The insecurity these days comes from a lack of ‘smart browsing’ or ‘safe browsing’. People are too willing to browse the seedy underbelly of the internet. Many people wouldn’t walk down a dark alley and purchase items from a guy sitting in the dark, but they’re willing to visit (and purchase from) websites that are the cyber-equivalent.”
To sum it up–stop using Internet Explorer 6. You will be doing yourself, your company, and the rest of the world that shares the Web with you a tremendous favor. And, as long as you’re upgrading away from IE6, IE8 offers a solid Web browser to switch to.
Other Web browsers such as Firefox or Chrome would also be exceptionally more secure than IE6, however organizations that are used to managing IE through Group Policy and updating it using the tools provided by Microsoft need to consider how supporting and patching alternate browsers will fit into the network infrastructure.
R.I.P. IE6. We knew thee (too) well.
Tony Bradley is co-author of Unified Communications for Dummies. He tweets as @Tony_BradleyPCW. You can follow him on his Facebook page, or contact him by email at tony_bradley@pcworld.com.