IE 8 is Microsoft's champion in browser wars

[javajolt]

The biggest looser of them all is Opera

SAN FRANCISCO, 8.13.2009 @ 1932hrs (7:32PM) — Microsoft is touting freshly-launched Internet Explorer 8 as its champion in the competitive Web browser arena, urging holdouts to upgrade from earlier versions of the software.

IE 8 has been catching on since its release five months ago, but Microsoft is hoping to leave behind aging IE 6 as well as much-maligned Vista after Windows 7 operating system launches in October.

Despite being released nine years ago, IE 6 still claims 27.2 percent of the browser market, according to figures released in July by Net Applications.

"The reason to still be on IE 6 at this point is lack of awareness, or the 'good-enough' problem that people are satisfied with what they are using," said Amy Barzdukas, general manager of IE and consumer security at Microsoft.

"Particularly in this economy, it is difficult to be cavalier and just say update to IE 8."

Schools, hospitals and other cash-strapped operations could be daunted by the cost of upgrading computer systems to new software.

IE 6 also tends to be used with pirated versions of Windows XP operating system because newer software is better designed to expose illegitimate copies, according to Barzdukas.

Microsoft reports seeing more XP use in emerging economies such as Brazil and India where piracy rates are higher than in the United States.

A drawback to people sticking with IE 6 is that Microsoft's image can be maligned by software deficiencies that have been fixed in newer versions," according to Barzdukas.

"People can get frustrated with that experience and say Microsoft stinks, or IE stinks, and base that perception on technology released ten years ago," Barzdukas told AFP during a visit this week to San Francisco.

"We want them to experience the latest."

Microsoft on Thursday released NSS Labs research indicating that IE 8 excels at blocking phishing and malware attacks.

In Microsoft-sponsored testing at a Texas lab, NSS found that IE 8 and an open-source Firefox browser from Mozilla tied for first place when it came to catching "social-engineering" phishing attacks.

"Internet Explorer 8 and Firefox 3 were the most consistent in the high level of protection they offered," the NSS study said.

When it came to blocking malicious software, malware, IE 8 caught 81 percent of the "live threats" as compared with the 54-percent finish by the second-place Firefox browser.

"I think our biggest area of concern in terms of competition is getting people onto a modern browser and protecting people from the bad guys," Barzdukas said.

"We don't spend a lot of time worrying about what the other browsers of doing."

Google leapt into the browser wars last year with Chrome software that industry insiders suspect will mesh with a new operating system the California Internet powerhouse plans to launch in 2010.

Apple has long challenged Microsoft with operating systems and other software customized for Macintosh computers. Mozilla's free Firefox web browsers based on open-source software have been gaining fans.

Barzdukas said her team is "juiced" by competition in the browser market.

"I think we have a great opportunity for the industry to evolve what the browser is able to do," Barzdukas said.

"IE is still the most broadly used browser in the world; we will continue to evolve. We are focused and here to play."

Microsoft this month abandoned a plan to strip IE 8 from versions of Windows 7 shipped to the European Union.

Microsoft said it will instead present customers with a "ballot" option, allowing them to choose whether to install IE or another browser.

Microsoft said the option had been tentatively welcomed by the European Commission, and received positive feedback from computer makers.

The Brussels-based EU executive, which wields broad anti-trust powers, had called on Microsoft to open Windows to different Internet browsers in order to fend off litigation.

[javajolt]

Internet Explorer 8 blocked about four out of every five sites that attempt to trick visitors into downloading malicious software in browser security tests performed by NSS Labs, according to a report released yesterday.

In the Microsoft-sponsored tests, Firefox 3 came in at a distant second with 27 percent. Safari 4 scored 21 percent, Chrome 2 blocked 7 percent, and the Opera 10 beta was barely there with a 1 percent block rate. The tests did not include sites that use hidden exploits and drive-by-download attacks to attempt to install malware without your ever having a chance to recognize an attack.

According to the report, NSS Labs tested against a list of 2,171 608 socially engineered malware URLs, which it defines as "a web page link that directly leads to a ‘download' that delivers a malicious payload whose content type would lead to execution," over the course of 12 days in July. The tests focused on sites that try to trick you into doing the dirty work of installing the malware, such as sites that disguise malware as a video codec or player.

Blocking these sites is a good thing for any browser, but so is blocking exploit sites. Hidden attack code on exploit sites will search for software flaws in an ActiveX control or browser plugin, for example. If such a flaw exists, the attack code can install malware without having to trick you into downloading anything.

NSS Labs also tested against phishing sites, with much closer results. IE 8 blocked 83 percent of the information-stealing sites, and Firefox 3 blocked 80 percent. Opera 10 beta stopped the pages 54 percent of the time, Chrome 2 blocked 26 percent, and Safari 4 intervened for only 2 percent.

While these results may be fully legit and highlight a real advantage for IE, eyebrows go up whenever a company being tested is also footing the bill. NSS Labs could quell such skepticism by saying where it got its list of malicious URLs, and why it left out exploit sites. The company's report doesn't include this info, and NSS Labs hasn't yet returned calls.

Update:

Rick Moy, President of NSS Labs, provided details about the company's test methodology, URL sources and why it left out exploit testing.

Per Moy, the company's methodology was in place before Microsoft contacted NSS Labs about performing the test. Microsoft asked plenty of questions about the methodology, but NSS Labs didn't change the methods used for Microsoft's test. Microsoft paid for a private report, and presumably could have chosen to not release the results had they not been complimentary, but Moy says Microsoft didn't push to change the methodology or source URLs to favor its browser.

Those methods involve using an array of crawlers and spam traps to compile a list of potentially malicious list of URLs. NSS Labs also pulls in data from other sources, such as Sunbelt Software, Telus security labs, and Mailshell, Moy says, but the bulk of URLs is gathered by the company's own crawlers.

Those URLs aren't gathered until the test begins, so that the products are tested against current malicious sites. NSS Labs starts with a large list of suspicious sites (12,000 for this test), and then verifies which of those sites foist actual malware by testing downloads using sandboxes and other methods. The company first narrowed the 12,000 sites down to 2,171, and then further filtered it down to 608 verified sites that contain malware (I incorrectly only listed the 2,171 number above).

And finally, Moy says that testing exploit sites essentially breaks the test apparatus used by the company. If any one of its test machines became infected by malware as a result of visiting an exploit site, it would have to be fully rebuit before it could continue testing. NSS Labs' method requires pointing all the browsers at a given site at the same time to see which browsers block a site, and these forced halts in the process would drastically slow things down.

Moy agrees that having test results for exploit sites would be helpful in gauging a browser's overall security effectiveness, and noted that sites with socially engineered malware and even phishing will sometimes include exploits as well. But leaving them out of this analysis was a matter of understandable test bed limitations.