Source: Flickr.com/photos/randyzhang/

A study by Accuvant Labs, commissioned by Google, has concluded that of the top three browsers, Chrome, Internet Explorer and Firefox, Chrome is the most secure. Internet Explorer ranks second and Firefox comes in third. Accuvant took a different approach than previous comparisons that relied on historical vulnerability statistics and URL blacklist services favoring instead a more comprehensive look that included sandboxing, plug-in security, JIT hardening, address space layout randomization (ASLR), and data execution prevention (DEP) as well as URL blacklist services. They concluded:

The URL blacklisting services offered by all three browsers will stop fewer attacks than will go undetected. Both Google Chrome and Microsoft Internet Explorer implement state-of-the-art anti-exploitation technologies, but Mozilla Firefox lags behind without JIT hardening. While both Google Chrome and Microsoft Internet Explorer implement the same set of anti-exploitation technologies, Google Chrome’s plug-in security and sandboxing architectures are implemented in a more thorough and comprehensive manner. Therefore, we believe Google Chrome is the browser that is most secured against attack.

The 140-page report is highly informative, especially if you want to get your security geek on.

For some time now, modern browsers have been coded to detect and block malicious websites. We have all seen the messages like the one shown below:

Have you ever wondered how well your browser stacks up with respect to blocking malware? The answer might surprise you. Msnbc.com’s Technolog reports that IE9 is the clear winner:

Tests by NSS Labs to “examine the ability of five different web browsers to protect users from socially-engineered malware” showed that IE9 was able to block this kind of threat 99 percent of the time, beating out Apple Safari 5, Google Chrome 12, Mozilla Firefox 4 and Opera 11.

(Msnbc.com is a joint venture of Microsoft and NBC Universal.)

The closest another Web browser got to that blocking-the-bad stuff rate was Chrome, at a very distant 13.2 percent. At the low end of the blockers was Opera, with a 6.1 percent rate.

Makes you think twice, doesn’t it? Those tests are meaningful, of course, but they don’t take into account that IE9′s market share is only 6.8 percent whereas IE8 controls the market with 29.23 percent, so the overall effect at this time is not significant. However, perhaps this will spur the others on to increasing the effectiveness of their own technologies.

Why is this necessary? Unfortunately, most of the time the browser that comes pre-installed on new computers, the one that the computer owners will use, is not set up in a secure default configuration. This is one of the worst ideas ever when it comes to security. If I had my way, I’d set the default configuration such that warnings would be issued for any website that wasn’t built with simple, benign HTML. I realize this isn’t practical on today’s interactive Internet and it would break nearly everything out there today (except a site like this one, composed only of an image and some text with a hypertext link).

Fortunately, there are plenty of free resources (including this blog and my free eBook, “14 Golden Rules of Computer Security“) that have good information on what to do. The best one, bar none, is CERT’s “Securing Your Web Browser.” All of the details anyone needs to secure the major browsers – Internet Explorer, Mozilla Firefox, and Apple Safari to name the top three – are all there with general tips on what to do with virtually any of the others you may encounter.

Tell everyone you know about it. Make it part of the setup routine when you deploy PCs or set them up for your family. The Internet will be a safer place if you do.

Now this is the way it should be done.

[kml_flashembed movie="http://www.youtube.com/v/A9WVmNfgjtQ" width="425" height="350" wmode="transparent" /]

If you’re running Firefox, you may have already seen it yourself. Recall that these add-ons were installed into Firefox without the user’s permission, causing quite an uproar in the Mozilla user community. Brian Krebs of The Washington Post wrote:

In May, I wrote about a Windows patch for the Microsoft .NET package that silently installed the Microsoft .NET Framework Assistant add-on into Firefox. The package also included an associated plug-in for Firefox called the Windows Presentation Foundation plug-in. The Mozilla user community was up arms over not just the fact that Microsoft was introducing unwanted components that could potentially weaken the security of Firefox, but that Redmond had made the thing almost impossible to remove.

Mike Shaver, Mozilla’s vice president of engineering, wrote Friday on the Mozilla Security Blog:

Because of the difficulties some users have had entirely removing the add-on, and because of the severity of the risk it represents if not disabled, we contacted Microsoft today to indicate that we were looking to disable the extension and plugin for all users via our blocklisting mechanism. Microsoft agreed with the plan, and we put the blocklist entry live immediately.

At least Microsoft agreed with Mozilla’s action to block the insecure add-on, but shame on them for blatantly compromising the security of a browser they don’t even own.

Conspiracy theorists: Do you have an opinion on this?

“http://google.com/safebrowsing/diagnostic?site=[URL of site you want to check]” (Leave off the http://).

For example, this URL produced the report shown in the screen shot (click on the image to view it full size):

http://google.com/safebrowsing/diagnostic?site=itknowledgeexchange.techtarget.com

Try it out for yourself on your favorite sites. You might be surprised at what you find out.

(Thanks to Steve Gibson and Leo Laporte of Security Now! for presenting a reader comment that brought this to my attention.)

What do you think? Leave a comment!

As of today, I’m embarking on a major pre-release revision of the eBook, 14 Golden Rules of Computer Security to make sure all of the bases are covered in a logical combination and sequence. In essence, the book will begin with the concept of a security baseline—the bare security essentials—for a normal home PC setup and will branch from there.

What’s a good PC security baseline? In “The Lazy Man’s Way to System Security,” I proposed these four bare security essentials: “…a NAT router; a good antivirus program; a good anti-malware program; and, a good software firewall.” That was good enough at the time, but these days antivirus, antimalware and a software firewall are usually combined into a single suite. I choose to align with Windows Secrets’  Security Baseline page: “…a hardware firewall that’s built into your [NAT] router, security software that guards against all types of malware threats, a software-update service to ensure that your applications are patched against the latest exploits, and a secure browser.”

There are many possibilities for implementing those four basic items and that will be well covered in the book.

That’s why I use LastPass and have been using it for more than a year now. All of my passwords are stored online, encrypted, and I only have to remember one master password to unlock the vault. I don’t have to carry anything with me on a thumb drive or install any programs on someone else’s computer in order to access my stuff when I’m not using my own PC.

Don’t take my word for it, check out this list of features. And then decide for yourself.

Oh, by the way, you can generate very secure passwords with LastPass and you don’t have to worry about remembering them, because LastPass will do it for you. Firefox and IE add-ons make things even easier. When you come to a new site you need to set up an account with, LastPass offers to generate a password for you. Then, when you log in, LastPass offers to save all information for the site. If you do that and then come back to the site later, LastPass will give you the option to either auto-fill the information or perform an auto login.

Highly recommended if you don’t want to do your own password management. You can still use all of the methods I’ve proposed for generating secure passwords, but you’ll never have to worry about remembering them.  Use my methods to generate the most secure password you can for your LastPass master password and encode it so you can write it down securely, but use LastPass for all your password management needs.

One of the biggest problems is that the bad guys, using Black Hat SEO techniques, grab onto the trending search terms of the moment and use their popularity to get links to compromised sites placed high in the search engine rankings. This, coupled with the fact that 77% of Websites carrying malicious code are legitimate sites, make for an increasingly dangerous environment for the casual surfer.

This is yet another reason to continue to beat my drum: If you use IE, disable scripting and ActiveX (IE8 has increased security, so consider upgrading). Better yet, switch to Firefox and use the NoScript plugin. Tell the users who trust you to do the same, will you? And make sure they have the latest security patches on their systems. Most people are trusting souls; on the web, they shouldn’t be. Let’s instill the “trust no one” (except for us white hats, of course) mentality into everyone we can.

The bug can be exploited by a malicious website and can cause the browser to execute malware with no user intervention. All 3.0.x versions of Firefox running on Windows, Mac, and Linux operatintg systems are vulnerable. According to the Mozilla Wiki, the patched version, Firefox 3.0.8, “…is a high-priority firedrill security update to Firefox 3.0.x” and will be rolled out April 1.

The 3.0.8 release also fixes the Pwn2Own bug discovered at CanSecWest 2009, an issue that NoScript also mitigates.

I’ve said it before (see “Software for Secure Computing: Firefox & NoScript“); now’s a good time to say it again: install NoScript, and enjoy secure computing.

SecurityFocus bulletin: http://www.securityfocus.com/bid/34235/info.
The Register article: http://www.theregister.co.uk/2009/03/26/new_firefox_exploit/.
Mozilla Security Blog post: http://tinyurl.com/mozillasecurityblog