Welcome to DU! The truly grassroots left-of-center political community where regular people, not algorithms, drive the discussions and set the standards. Join the community: Create a free account Support DU (and get rid of ads!): Become a Star Member Latest Breaking News General Discussion The DU Lounge All Forums Issue Forums Culture Forums Alliance Forums Region Forums Support Forums Help & Search

steve2470

(37,457 posts)
Mon Mar 17, 2014, 10:57 AM Mar 2014

Firefox is still the least secure web browser, falls to four zero-day exploits at Pwn2Own

http://www.extremetech.com/computing/178587-firefox-is-still-the-least-secure-web-browser-falls-to-four-zero-day-exploits-at-pwn2own

At Pwn2Own 2014, an annual computer hackfest in Vancouver, Mozilla’s Firefox has proven yet again that it’s the least secure major web browser. While all four major web browsers — Chrome, Internet Explorer, Firefox, and Safari — were successfully exploited, for a grand total of $850,000 in prize money awarded to successful security researchers, Firefox was by far the least secure browser, racking up no less than four zero-day vulnerabilities. These vulnerabilities, if they were in the wild, would allow a hacker to do just about anything with your computer if you visited a specially crafted website.

Firefox has never had a great record at Pwn2Own. While the format of the contest has generally changed every year since its inauguration in 2007 (different platforms, different rules, different attack vectors), Firefox has been involved in some way or another since 2009. While Chrome went unhacked in 2009, 2010, and 2011, the only year that Firefox wasn’t hacked was 2011. Since 2012, however, as security researchers have grown ever more wiley, every major browser has fallen to at least one zero-day vulnerability. That four separate vulnerabilities were found in Firefox at Pwn2Own 2014, however, is impressive. (Read: The death of Firefox.)

Firefox’s weaker security is generally attributed to its lack of a sandbox — a shell or firewall around a piece of software that keeps it segregated from the rest of the operating system. In theory, the sandbox should prevent the browser from running other programs, reading the contents of your RAM, or opening other files. Chrome, Safari, and Internet Explorer (newer versions) all have a sandbox, while Firefox does not. In short, if someone finds a big enough vulnerability in Firefox, there’s nothing preventing them from gaining complete access to your computer. It is slightly disconcerting that security researchers found four such vulnerabilities in just three days at Pwn2Own. (Read: How to surf safely: From LastPass to tin foil hats, and everything in between.)

Somewhat fortunately for us, since Pwn2Own 2013, all of the vulnerabilities are reported to the web browser makers so that they can be fixed in a timely fashion. Still, it is a good reminder that Firefox might not be the best choice of browser if security is one of your primary concerns when surfing the web. As for why Firefox doesn’t have a sandbox, it’s most likely because it was conceived in an era when security on the web was still a nascent and naive topic. Chrome, which was developed a few years later, was intentionally designed from the outset to be very fast and secure. Likewise, Microsoft went through a complete overhaul between IE8 an IE9, adding a sandbox and other modern features so that it could actually stand next to its peers without being snickered at. Mozilla would like to add sandboxing to Firefox, it’s very hard to add sandboxing to a program that wasn’t originally designed for it. (For technical people: It’s closely linked to the Electrolysis project, which will eventually give Firefox per-tab processes.)
10 replies = new reply since forum marked as read
Highlight: NoneDon't highlight anything 5 newestHighlight 5 most recent replies
Firefox is still the least secure web browser, falls to four zero-day exploits at Pwn2Own (Original Post) steve2470 Mar 2014 OP
I must be getting a little tech savvy. I actually understood this very interesting message and am monmouth3 Mar 2014 #1
Aw rats.. PasadenaTrudy Mar 2014 #2
Me too. Safari has some bugs that don't exist in Firefox. RebelOne Mar 2014 #4
More FUD RC Mar 2014 #3
Firefox is a dying browser Xithras Mar 2014 #5
Which browser do you recommend? PasadenaTrudy Mar 2014 #6
Whichever works best for you. Xithras Mar 2014 #7
Cool, thanks for info! n/t PasadenaTrudy Mar 2014 #8
Thanks for the info. cui bono Mar 2014 #9
Is there more security in a minor browser just because it's minor? Jim Lane Mar 2014 #10

monmouth3

(3,871 posts)
1. I must be getting a little tech savvy. I actually understood this very interesting message and am
Mon Mar 17, 2014, 11:26 AM
Mar 2014

now worried about my Firefox browser. My banking is all I care about but will have to re-think this...

RebelOne

(30,947 posts)
4. Me too. Safari has some bugs that don't exist in Firefox.
Mon Mar 17, 2014, 12:24 PM
Mar 2014

Whenever Safari gives me grief, I switch to Firefox and the problem is solved.

 

RC

(25,592 posts)
3. More FUD
Mon Mar 17, 2014, 11:53 AM
Mar 2014

All browsers, by their very nature, have insincerities that can be exploited. Fix one and create another.
I'm sticking with Firefox. The article has to do with the best and the brightest being paid to find flaws in software. All software will have flaws in them, especially if someone is being paid a lotta bucks to discover them.
Browsers, being software, are no exception. How many script kiddies can take advantage of any of these kind of flaws? I am not losing any sleep over this.

Xithras

(16,191 posts)
5. Firefox is a dying browser
Mon Mar 17, 2014, 12:33 PM
Mar 2014

Its usage base has been on a continuous slide since 2010 (where it was once used by nearly a third of web users, the latest numbers put in the 18% range). It was years late to the mobile game and its mobile browser has since failed to gain traction outside of its hardcore cheerleaders. It's new mobile OS has barely elicited a shrug from the tech world, The browser is relatively slow and a bloated resource hog compared to its competitors. Tales of its bugginess abound, and even developers have been turning on it lately...Internet Explorer used to be a real thorn in developers side, but with Microsoft's apparent surrender on the "Standards Compliance" front in over the last few versions, Firefox has become the "pain in the ass" browser that developers struggle with nowadays (it's even picked up the nickname "Firefix", because you're going to have to fix all your damned code to get anything to display properly in it.) Most developers will tell you flat out that the two browsers that cause the most problems nowadays are IE8 (5 years old and 3 version out of date, but still stubbornly used by die-hard XP users), and Firefox (pretty much any recent release, on any platform). Most tellingly, one recent survey found that Firefox usage among the under-25's, who will be driving technology usage over the coming decade, was in the single digits, with Chrome and Safari absolutely dominating that demographic.

These security hole revelations certainly aren't going to help turn things around.

The problem isn't that Firefox has dropped the ball recently, but that they dropped it years ago and apparently forgot how to pick it back up.

PasadenaTrudy

(3,998 posts)
6. Which browser do you recommend?
Mon Mar 17, 2014, 01:37 PM
Mar 2014

I'm a Mac user, I don't like Safari, not crazy about using Chrome (I use Duck Duck Go or Startpage HTTPS) to avoid Google...hmmm

Xithras

(16,191 posts)
7. Whichever works best for you.
Mon Mar 17, 2014, 02:16 PM
Mar 2014

Chrome is fast and stable. I understand that a lot of people worry about their privacy, but it's trivially easy to block it from tracking you. Just to to "Settings" and make sure your browser isn't signed into a Chrome account. Then go under "Privacy" and turn off all of their helper features, like autocomplete, bug reporting and malware protection. These bring the browsers security in line with what you'd expect from Firefox and completely blocks Google from tracking your online activities.

If you really want to avoid Google, I'd suggest giving Maxthon a try. It's been around for 6 or 7 years now and has financial backing from some serious players and isn't going away any time soon. Importantly, it uses licensed rendering engines from both Internet Explorer AND Chrome, so it's capable of rendering any page that they can. Even more importantly, it was designed specifically for security and privacy. The founder of the company made a statement last year that it would be a waste of time for government agencies to try and subpoena data about the browsers users, because the system was specifically designed to prevent governments and corporations from spying on it. Everything that the company stores is encrypted, and the company doesn't keep the keys.

I don't use Maxthon myself, but if you really want privacy without giving up features, they have a Mac version (and a version for pretty much every desktop and mobile platform out there). The browsers users are a pretty loyal bunch.

 

Jim Lane

(11,175 posts)
10. Is there more security in a minor browser just because it's minor?
Mon Mar 17, 2014, 03:03 PM
Mar 2014

Somehow I happened upon the Comodo browser and I use it sometimes. Presumably, hackers who seek to exploit browser vulnerabilities do a cost-ben analysis and direct their efforts where the time spent will do the most "good" (i.e. the most harm). If Comodo is used by many fewer people than the four major browsers named in the OP, is it therefore less likely to be attacked?

Latest Discussions»General Discussion»Firefox is still the leas...