NSS Labs - 2013 Browser Security Comparative Analysis: Socially Engineered MalwareTechWorld.com > Internet Explorer 10 blocks more malware than Chrome or Firefox, test findsQuote:
Internet Explorer 10 had the highest malware block rate at 99.96%, followed by Chrome 25/26 at 83.16%. Safari 5 and Firefox 19 were a distant third and fourth, with 10.15% and 9.92% respectively. Opera offered virtually no malicious download protection, with a 1.87% score.
Well yeah but Chrome is like totally faster by like 47 milliseconds which over the life of the average user adds up to like 2 minutes of saved time on the internet which can be used to fend off all of the spam that comes to your gmail account.
Heh
Lol :)
It's an interesting study, but it's really only half done at best. IE 10 on Windows 8 is really a very specific case. Even NSS Labs states that Win7 and IE 9 might not perform as well. It would have been very useful had they tested a platform that's going to be seeing a lot more usage right now and for some time to come than the one they evaluated.
Here's a quick rundown of the last 5 years:
http://www.SpywareDrGuide.com/WinDri...bs_5_years.gif
spywareDr, is that chart right? I was always considering FF to fight best, then chrome and IE at last. Am I being completely wrong? Then why users around the world appreciate FF & hating IE? Now, I'm really confused as it is a matter of malware. Can you tell me what should I use anymore?
Don't sweat it. This is just another example of some s##thook security company looking for a cheap headline to promote their business. It's no different from Matusek's crappy firewall tests. Take a special case, make sure the parameters of the test are skewed to produce the desired results, then exaggerate the significance, and POOF!, suddenly you're the worlds leading security company.Quote:
Originally Posted by ionamartin123
If current versions of Internet Explorer were as effective at blocking "socially engineered" malware as some sources claim, I'd make a lot less money. All browsers are vulnerable. Buy Malwarebytes AntiMalware Pro, and run a good AV program. Stick with the browser of your choice.
You are entitled to your opinion.
Seems just a little strange that I have used FF exclusively for all my years on the net and
I haven't got any infection from malware yet. I spend many hours a day on the net.
Maybe some of these so called experts can explain that if its soooo susceptible to malware?
I feel so liberated! Thank you!Quote:
Originally Posted by SpywareDr
:) You're more than welcome.
Trust a chart from a company that's selling something or go with experience. I'll side with experience.
I believe all browsers are useless at protecting the user base. Not because they're poorly designed but because they have to be overly flexible for the multitudes of features, layouts, and other functions that the general populace throws upon them. The best tool for surfing online is your brain, followed by a backup defense of a good anti-virus and anti-malware as SLGrieb said.
By the way, the most vulnerable software, sites, and OS's tend to be the ones that are the most popular at the time. So the real weakness in any application is it being popular and accessible. Want to make a product safer from attack? Make a more popular one than it or renders it obsolete.
Of course, an even better question is "If SmartScreen is so effective, why am I removing so much malware from Win7 computers running IE 9 & 10, and Win8 machines?" And, I'm not talking about obscure stuff; it is generally common nasties like MyWeb products, GameVance, Gaming Wonderland, TV Fanatic, Weather Blink, Babylon Toolbar, etc. as well as the odd Trojan Downloader or two. Golly, I'm guessing that just gets us back to s##thook security companies cherry picking results, huh?Quote:
Originally Posted by Ferrit
You need a defense-in-depth strategy, one that combines layers of security technologies.Quote:
Originally Posted by slgrieb
SourceQuote:
The web browser is the primary vector by which malware is introduced to computers. Links in phishing emails, compromised web sites, and trojanized "free" software downloads all deliver malware via web browser downloads.
The web browser is also the first line of defense against malware infection. Browsers must provide a strong layer of defense from malware, especially in mobile operations, rather than relying upon third-party anti-malware solutions and operating system protections.
NSS Labs' "2013 Browser Security Comparative Analysis: Socially Engineered Malware" was authored by:Quote:
Originally Posted by Niclo Iste
Quote:
- Randy Abrams - Research Director Randy Abrams brings a wealth of experience in malware and virus research to the NSS Labs team. Previously, he was the Director of Technical Education for six years at ESET, a global antivirus company, and from 1993 to 2005, worked at Microsoft where he developed and managed the processes to prevent their software from being released with malware.
Abrams has presented at dozens of international security conferences, is often quoted in articles for several security publications, and has served on the board of directors for the Association of Antivirus Asia Researchers since 2000.
- Orlando Barrera II - Orlando Barrera II leads the Malware and Phishing Research team. Previously, he worked in communications with the United States Army Signal Corps, 35th Signal Brigade, stationed at Fort Bragg, N.C. While completing his Bachelor of Science degree, he worked in the Computer Science department at Texas State University.
He also previously worked for SecTheory as a code monkey, software developer, and security researcher. Barrera has presented at B-Sides LV, RSS, LASCON, HouSecCon, AHA and is an active member in the local OWASP chapter. His vulnerabilities and exploits published include: CVE-2009-3371, CVE-2010-0160, and CVE-2010-4109.
- Jayendra Pathak - Jayendra Pathak leads the Live Testing team and brings a wealth of expertise in malware, phishing and exploit analysis. Pathak and team maintain a comprehensive database of threats prevalent in the wild and built an automated live testing infrastructure that runs with minimal supervision. Along with NSS Labs Researcher Mohamed Saher, he also built an exploit-hunting tool -- BaitNET -- which gathers real-time intelligence on these exploits.
Prior to NSS Labs, he was a research assistant at University of Houston where he was pursuing his M.S degree. A native of Nepal, Pathak worked as a computer engineer for the Government of Nepal for 4 years prior to coming to United States.
A true researcher, Pathak's hobby is to scan the internet for the threats and try to correlate how those threats affect users. He has a B.E. in computer engineering from Nepal Engineering College and a M.S. in Management Information System from University of Houston.
Sadly what used to be true, that people with really good web habits were unlikely to be infected
is no longer the case.
Because of the move to infect legit pages, it has left all in jeopardy. I just went through a huge
hassle with one of my IT clients and their web page. It has been infected on and off for a year.
I finally had to call the web hosts main tech support and ask if they were aware their
servers were serving up a black hole exploit kit. This from a golf webpage. The crooks know
infecting legit webpages is the way to go now.Not enough money in the fools surfing the pr0n page.
Of course, ionamartin123 has asked a similar question over in this thread, so I think I've already said enough about reputation based blocking.
Hacked websites account for a very high percentage of malware distributed online, and of course there are plenty of sites eager for advertising, and unwilling to screen the ads for malware or links to malicious sites. Nevertheless, plenty of people still get infected by going right to the source, and SmartScreen just doesn't cut the mustard when it comes to prevention.
And, SpywareDr, regardless of the credentials of the staff at NSS labs, cooking a largely bogus and sensational set of test results still makes them a s##thook company. It's just Twenty First Century snake oil.
Like I said ... :)