No sooner did I do an article about Internet Explorer I spot this study which was completed over an 18th month period, establishing Firefox as the most secure. But what is interesting is the reason why Firefox is most secure. It is because users are more inclined to update the browser with the latest fixes and patches. In fact, Firefox will auto fix itself. The articles states the problem as:

Profit motivated cyber-criminals have rapidly adopted Web browser exploitation as a key vector for malware installation. Due to the methodology of exploiting Web browser vulnerabilities and the unpredictable browsing patterns of typical users, for widespread infection of vulnerable hosts the criminals must seed a mix of popular and high-traffic websites, or incentivize users through email spam, with URLs directing potential victims to Web servers hosting their malicious content. The former method is commonly known as drive-by download, where drive-by refers to the fact that Web browsers must initially navigate to a malicious page and download refers to the covertly downloaded and executed malware – typically trojans. As popularity of this attack vector has blossomed, there have been frequent reports of hundreds of thousands of Web sites succumbing to mass-defacement [1, 4, 5, 6, 7, 8] – where the defacement often consists of an embedded iframe. These iframes typically inlcude content from servers hosting malicious JavaScript code designed to exploit vulnerabilities accessible through the user’s Web browser and subsequently to initiate a drive-by malware download. These mass-defacements cause once-benign sites to turn against their visitors. Even pages owned by institutions like the United Nations (un.org), the UK government (.gov.uk) and many others have succumbed to such attacks. In 2007, Google uncovered more than three million malicious Web addresses (URLs) that initiate drive-by downloads [9]. 

According to the study, which is quite lengthy and very in depth, Microsoft seems to have trouble fixing their browser. This leaves IE users at risk. Strange. One would expect IE to also have a built in fix and patch ability. Maybe this is the price they paid for having IE incorporated with Windows.

What do you think?

Comments welcome.

Source.