DOCSLIB.ORG

Browser Security Comparison – a Quantitative Approach Page| I of V Version 0.0 Revision Date: 12/6/2011

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Browser Security Comparison – a Quantitative Approach Page| I of V Version 0.0 Revision Date: 12/6/2011 Browser Security Comparison A Quantitative Approach Document Profile Version 0.0 Published 12/6/2011 Revision History Version Date Description 0.0 12/26/2011 Document published. Browser Security Comparison – A Quantitative Approach Page| i of v Version 0.0 Revision Date: 12/6/2011 Contents Authors .......................................................................................................................................................... v Executive Summary ....................................................................................................................................... 1 Methodology Delta ................................................................................................................................... 1 Results ....................................................................................................................................................... 2 Conclusion ................................................................................................................................................. 2 Introduction .................................................................................................................................................. 3 Analysis Targets ........................................................................................................................................ 4 Analysis Environment................................................................................................................................ 4 Analysis Goals ........................................................................................................................................... 4 Browser Architecture .................................................................................................................................... 5 Google Chrome ......................................................................................................................................... 5 Internet Explorer ....................................................................................................................................... 5 Mozilla Firefox ........................................................................................................................................... 6 Summary ................................................................................................................................................... 6 Browser Comparison ................................................................................................................................. 8 Historical Vulnerability Statistics .................................................................................................................. 8 Browser Comparison ................................................................................................................................. 8 Issues with Counting Vulnerabilities ......................................................................................................... 9 Issues Surrounding Timeline Data .......................................................................................................... 10 Issues Surrounding Severity .................................................................................................................... 11 Issues Unique to Particular Vendors ....................................................................................................... 11 Data Gathering Methodology ................................................................................................................. 13 Update Frequencies ................................................................................................................................ 13 Publicly Known Vulnerabilities ................................................................................................................ 16 Vulnerabilities by Severity ...................................................................................................................... 17 Time to Patch .......................................................................................................................................... 18 URL Blacklist Services .................................................................................................................................. 20 Comparing Blacklists ............................................................................................................................... 20 “Antivirus-via-HTTP” ............................................................................................................................... 20 Multi-Browser Defense ........................................................................................................................... 20 Comparing Blacklist Services ................................................................................................................... 21 Browser Security Comparison – A Quantitative Approach Page| ii of v Version 0.0 Revision Date: 12/6/2011 Comparison Methodology ...................................................................................................................... 21 Results Analysis ....................................................................................................................................... 21 Conclusions ............................................................................................................................................. 25 Anti-exploitation Technologies ................................................................................................................... 26 Address Space Layout Randomization (ASLR) ......................................................................................... 26 Data Execution Prevention (DEP) ............................................................................................................ 26 Stack Cookies (/GS) ................................................................................................................................. 26 SafeSEH/SEHOP ....................................................................................................................................... 26 Sandboxing .............................................................................................................................................. 27 JIT Hardening .......................................................................................................................................... 28 Browser Anti-Exploitation Analysis ............................................................................................................. 31 Browser Comparison ............................................................................................................................... 32 Google Chrome ....................................................................................................................................... 34 Microsoft Internet Explorer .................................................................................................................... 45 Mozilla Firefox ......................................................................................................................................... 58 Browser Add-Ons ........................................................................................................................................ 67 Browser Comparison ............................................................................................................................... 68 Google Chrome ....................................................................................................................................... 69 Internet Explorer ..................................................................................................................................... 80 Firefox ..................................................................................................................................................... 89 Add-on summary .................................................................................................................................... 97 Conclusions ................................................................................................................................................. 98 Bibliography .............................................................................................................................................. 100 Appendix A – Chrome Frame ......................................................................................................................... I Overview .................................................................................................................................................... I Decomposition .......................................................................................................................................... II Security Implications ................................................................................................................................ III Risk Mitigation Strategies ......................................................................................................................... V Conclusion ................................................................................................................................................. V Bibliography ............................................................................................................................................
Load more

Recommended publications
  • Browser Security Information
    Browser Security Information Customer security is important to us. Our top priority is to protect the privacy of your personal account information and your financial transactions FirstLine Mortgages is leading the way in Internet banking services and uses several layers of robust security technology to help ensure the confidentiality of transactions across the Internet. The first security level begins with your Web browser. When you access FirstLine Mortgages Internet Site , your browser is checked to ensure that it meets our minimum requirements. Additionally, we only allow customers with browsers that use 128-bit encryption (one of the highest levels of browser security available today) to bank on our web site. But, even with this validation, there are other precautions you should follow to maximize your protection. You have a responsibility to ensure your own security. The browser validation will verify the browser type you are using, your browser encryption level, the version of Netscape or Microsoft browser, as well as Javascript and cookies being enabled. To access -FirstLine Mortgages Internet site , you need to use: • a Netscape browser version 4.06 or better with a minimum 128-bit encryption technology • a Microsoft browser version 4.01 SP2 or better with a minimum 128-bit encryption technology • Javascript (please see below for more information about how to check and enable Javascript support) • Cookies (see below) If your browser does not meet all of these requirements, you will need to upgrade your browser to access the FirstLine Internet Site . To upgrade your browser, select the Netscape or Microsoft button below and download the latest browser version.
    [Show full text]
  • Tadiran-Coral-Voicemail-User-Guide-Steadfasttelecom.Com .Pdf
    Coral Message Center (CMC) User Guide Version 2.1 for Windows The flexible way to communicate . © 2002-2003 Active Voice LLC To access your mailbox from inside your organization All rights reserved. First edition 2003. 1. Call the voice messaging system. 1 for Yes, 2 for No, PhoneBASIC, Repartee, TeLANophy, 2. When the system greets you, enter: ViewCall, and ViewMail are trademarks of Active Voice, LLC. Personal ID ______________________________________________________ All other brands and product names used in this docu- ment are trademarks of their respective owners. Security code (if required) ___________________________________________ Licensed under one or more of the following patents: U.S. Nos. 4,994,926; 5,291,302; 5,459,584; 4,696,028; To access your mailbox by computer 4,809,321; 4,850,012; 4,922,526; 4,935,958; 4,955,047; 1. Launch Mailbox Manager. 4,972,469; 4,975,941; 5,020,095; 5,027,384; 5,029,196; 5,099,509; 5,109,405; 5,148,478; 5,166,974; 5,168,519; 2. When the system greets you, enter: 5,249,219; 5,303,298; 5,309,504; 5,347,574; 5,666,401; 5,181,243; 5,724,408; and Canadian No. 1329852. Host name_______________________________________________________ Extension _______________________________________________________ Security Code _____________________________________________________ For assistance, call: Name___________________________________________________________ Extension _______________________________________________________ Contents Introduction ii Changing your mailbox setup 21 Using quick message actions and shortcuts 47 Setting up your mailbox .......................................iv Working with the Mailbox Manager ....................22 Changing your security code..............................24 Quick message actions ...................................... 48 Checking and leaving messages 1 Changing your recorded and spelled names......25 Shortcuts...........................................................
    [Show full text]
  • Clearing of Cache & Cookies
    Clearing of Cache & Cookies What is cache? Cache memory is temporary memory used to store information that you accessed when visiting web sites. Cache speeds up a computer’s connection time with web sites that have been visited previously by locally storing information about that connection on the computer so that it does not have to be downloaded each time a site is visited. Why should cache be cleared periodically? Cache can become corrupt or outdated. As a result, cache can slow down or prevent a web page’s output and/or connection instead of assisting it. Clearing cache deletes corrupt or outdated data. It also removes unnecessary information stored in memory from sites that were only visited one time. Clearing Cache helps all web surfing not just PAWS. Internet Explorer 8 1. Open the Internet Explorer web browser. 2. Click on Tools. 3. Select Internet Options. 4. From the General Tab, click on Delete under Browsing History. 5. Uncheck Preserve Favorites website data and check both Temporary Internet Files and Cookies. 6. Click Delete. Internet Explorer 7 1. Open the Internet Explorer web browser. 2. Click on Tools. 3. Click on Internet Options. 4. Click on Delete under Browsing History. 5. Click Delete cookies. 6. When prompted, click Yes. 7. Click on Delete Internet Files. 8. When prompted, click Yes. 9. Click Close. 10. Click OK. 11. Close and reopen the browser for the changes to go into effect. Internet Explorer 6 1. Open the Internet Explorer web browser. 2. Click on Tools. 3. Click on Internet Options. 4.
    [Show full text]
  • Browser Wars
    Uppsala universitet Inst. för informationsvetenskap Browser Wars Kampen om webbläsarmarknaden Andreas Högström, Emil Pettersson Kurs: Examensarbete Nivå: C Termin: VT-10 Datum: 2010-06-07 Handledare: Anneli Edman "Anyone who slaps a 'this page is best viewed with Browser X' label on a Web page appears to be yearning for the bad old days, before the Web, when you had very little chance of read- ing a document written on another computer, another word processor, or another network" - Sir Timothy John Berners-Lee, grundare av World Wide Web Consortium, Technology Review juli 1996 Innehållsförteckning Abstract ...................................................................................................................................... 1 Sammanfattning ......................................................................................................................... 2 1 Inledning .................................................................................................................................. 3 1.1 Bakgrund .............................................................................................................................. 3 1.2 Syfte ..................................................................................................................................... 3 1.3 Frågeställningar .................................................................................................................... 3 1.4 Avgränsningar .....................................................................................................................
    [Show full text]
  • But Were Afraid to Ask!)
    05_576593 ch01.qxd 10/12/04 9:55 PM Page 9 Chapter 1 All You Ever Wanted to Know about JavaScript (But Were Afraid to Ask!) In This Chapter ᮣ Understanding a working definition of JavaScript ᮣ Dispelling common JavaScript misconceptions ᮣ Getting started with JavaScript tools ᮣ Finding information online aybe you’ve surfed to a Web site that incorporates really cool features, Msuch as ߜ Images that change when you move your mouse over them ߜ Slideshow animations ߜ Input forms with pop-up messages that help you fill in fields correctly ߜ Customized messages that welcome repeat visitors By using JavaScript and the book you’re reading right now you can create all these effects and many more! The Web page in Figure 1-1 shows you an example COPYRIGHTEDof the kinds of things that you canMATERIAL look forward to creating for your own site. A lot has changed since the previous edition of JavaScript For Dummies came out. Perhaps the biggest change is the evolution of DHTML, or dynamic HTML. DHTML refers to JavaScript combined with HTML and cascading style sheets, and it’s a powerful combination you can use to create even more breathtak- ingly cool Web sites than ever before. 05_576593 ch01.qxd 10/12/04 9:55 PM Page 10 10 Part I: Building Killer Web Pages for Fun and Profit Figure 1-1: JavaScript lets you add interactive features to your Web site quickly and easily. Along with this increased power comes increased complexity, unfortunately — but that’s where this new, improved, better-tasting edition of JavaScript For Dummies comes in! Even if you’re not a crackerjack programmer, you can use the techniques and sample scripts in this book to create interactive Web pages bursting with animated effects.
    [Show full text]
  • Resolving Issues with Forms
    C1261587x.fm Page 265 Thursday, November 15, 2001 3:51 PM Resolving Issues with Forms In 1988, Alan Cooper demonstrated a prototype called Ruby to Bill Gates. Ruby provided a form designer that allowed you to drag and drop controls, then known as gizmos, to quickly and easily create composite forms—such as dialog boxes, entry forms, and report forms. Microsoft took Cooper’s Ruby product and combined it with Basic to create Microsoft Visual Basic 1. Microsoft has since shipped a version of Ruby with every version of Visual Basic, versions 1 through 6. With every version, that is, until Visual Basic .NET. Visual Basic .NET provides a new forms package called Windows Forms. Although the Windows Forms package was designed using the same basic prin- ciple as Ruby—it is a form designer that allows you to drag and drop controls and set properties—it was never meant to be an extension of, nor to be com- patible with, Ruby. Therefore, there are fundamental differences between the two forms packages that affect the way you create Visual Basic applications. This chapter focuses on some of the fundamental differences between the Ruby and Windows Forms packages. Specifically, it discusses issues that the Upgrade Wizard does not handle for you. Before we get into the differences, however, let’s look at what Windows Forms and Ruby have in common. Similarities in Form Structure When you create a new project in Visual Basic .NET, you will find yourself at home in the environment. The way you create and design forms is the same in Visual Basic .NET as it is in Visual Basic 6.
    [Show full text]
  • Mozilla Source Tree Docs Release 50.0A1
    Mozilla Source Tree Docs Release 50.0a1 August 02, 2016 Contents 1 SSL Error Reporting 1 2 Firefox 3 3 Telemetry Experiments 11 4 Build System 17 5 WebIDL 83 6 Graphics 85 7 Firefox for Android 87 8 Indices and tables 99 9 Localization 101 10 mach 105 11 CloudSync 113 12 TaskCluster Task-Graph Generation 119 13 Crash Manager 133 14 Telemetry 137 15 Crash Reporter 207 16 Supbrocess Module 211 17 Toolkit modules 215 18 Add-on Manager 221 19 Linting 227 20 Indices and tables 233 21 Mozilla ESLint Plugin 235 i 22 Python Packages 239 23 Managing Documentation 375 24 Indices and tables 377 Python Module Index 379 ii CHAPTER 1 SSL Error Reporting With the introduction of HPKP, it becomes useful to be able to capture data on pin violations. SSL Error Reporting is an opt-in mechanism to allow users to send data on such violations to mozilla. 1.1 Payload Format An example report: { "hostname":"example.com", "port":443, "timestamp":1413490449, "errorCode":-16384, "failedCertChain":[ ], "userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:36.0) Gecko/20100101 Firefox/36.0", "version":1, "build":"20141022164419", "product":"Firefox", "channel":"default" } Where the data represents the following: “hostname” The name of the host the connection was being made to. “port” The TCP port the connection was being made to. “timestamp” The (local) time at which the report was generated. Seconds since 1 Jan 1970, UTC. “errorCode” The error code. This is the error code from certificate veri- fication. Here’s a small list of the most commonly-encountered errors: https://wiki.mozilla.org/SecurityEngineering/x509Certs#Error_Codes_in_Firefox In theory many of the errors from sslerr.h, secerr.h, and pkixnss.h could be encountered.
    [Show full text]
  • Firefox for Mac Os 103 9 Download
    Firefox For Mac Os 10.3 9 Download 1 / 5 Firefox For Mac Os 10.3 9 Download 2 / 5 3 / 5 10 3 Supplemental Update, Mac OS X Update, and many more programs Firefox For Mac 10.. Mac OS X 10 3 MacOS X was Apple's replacement for their classic MacOS Download Name Version Language CPU File type File size; Apple Mac OS X 10.. Need to move Bookmarks, Extensions & Add-Ons to another Mac; Is the process to delete cache and cookies for Firefox 3. 1. firefox download 2. firefox quantum 3. firefox extensions 5 - Apple's latest operating system for the Mac Download the latest versions of the best Mac apps at safe and trusted MacUpdate. firefox download firefox download, firefox for android, firefox quantum, firefox update, firefox logo, firefox extension, firefox vpn, firefox addon, firefox send, firefox portable, firefox, firefox for mac, firefox app, firefox extensions, firefox cycles, firefox themes, firefox addons Stereo Spread Vst Download 0 2 54) All users should apply this update. 6 8Firefox For Mac OsMac os x 9 free download - R for Mac OS X, Java Update for Mac OS X 10. Cancionero Salesiano Pdf 4 / 5 Rabbids Go Home Wbfs Download For Mac firefox quantum Plague Inc Evolved V0.7.5 download 3 X (Panther) is now being installed on all new Cal Poly faculty/staff Macintosh workstations and the OS only keeps getting better! It has been designed for users who could also be new the Macintosh, users who have only recently upgraded from OS 9 to OS X, or users who simply want to understand more about the good new features available in 10.
    [Show full text]
  • Javascript Security
    Color profile: Generic CMYK printer profile Composite Default screen Complete Reference / JavaScript: TCR / Powell & Schneider / 225357-6 / Chapter 22 Blind Folio 679 22 JavaScript Security ownloading and running programs written by unknown parties is a dangerous proposition. A program available on the Web could work as advertised, but then Dagain it could also install spyware, a backdoor into your system, or a virus, or exhibit even worse behavior such as stealing or deleting your data. The decision to take the risk of running executable programs is typically explicit; you have to download the program and assert your desire to run it by confirming a dialog box or double-clicking the program’s icon. But most people don’t think about the fact that nearly every time they load a Web page, they’re doing something very similar: inviting code—in this case, JavaScript—written by an unknown party to execute on their computer. Since it would be phenomenally annoying to have to confirm your wish to run JavaScript each time you loaded a new Web page, the browser implements a security policy designed to reduce the risk such code poses to you. A security policy is simply a set of rules governing what scripts can do, and under what circumstances. For example, it seems reasonable to expect browsers’ security policies to prohibit JavaScript included on Web pages downloaded from the Internet from having access to the files on your computer. If they didn’t, any Web page you visited could steal or destroy all of your files! In this chapter we examine the security policies browsers enforce on JavaScript embedded in Web pages.
    [Show full text]
  • VI. Lotus Domino
    Le groupware - 1 / 60 - Sommaire I. Introduction ................................................................................................ 2 A. Histoire (Source : Michel Alberganti) ................................................................................ 2 B. Définition................................................................................................................... 2 C. L'offre....................................................................................................................... 2 1. Intranet / Internet................................................................................................. 2 2. Messagerie........................................................................................................... 3 II. Les clients de messagerie ............................................................................... 3 A. Windows Messaging : Msmail........................................................................................... 4 1. Installer et administrer un bureau de poste .................................................................. 4 2. Propriétés du client MAPI......................................................................................... 7 B. Utiliser Outlook ......................................................................................................... 15 1. Les options .........................................................................................................15 2. Envoi de messages ................................................................................................20
    [Show full text]
  • Presentation Materials
    The House Call is Back and It's Better Than Ever! Brad Wegrzyn Media Engineer UUHC Dept of Telemedicine Disclaimer Contents of this presentation are under pressure. Shake well before using. Batteries not included, but lots of MSG and preservatives are. Avoid prolonged exposure to this presentation. Void where prohibited. Use only as directed. This presentation may not be suitable for young children. Side effect of listening in this presentation are not common but my include itching, redness and occasional fainting. If conditions persist, consult your physician. No fur-bearing animals were harmed during the creation of this presentation. Do not participate in this presentation while operating a vehicle or heavy equipment. This presentation may contain peanuts, but we doubt it. Any resemblance between this presentation and others, good or bad, is purely coincidental. This presentation is meant for educational purposed only. Listening to this presentation does not include legal advice. Should you need legal advice, seek a legal adviser. Like most good stories, the story of house calls has a humble beginning. in 1940 the majority of provider visits saw their patients in their homes. in 1960 house calls by providers were 40% of the doctor-patient meetings. in 1980 that number dropped to less than 1%. Benefits of house calls • Offers insights not available during an office visit • Provides accessible healthcare for the patient • Helps to save money by helping to keep those who are having a minor ailment from turning into a major operation. The decline of the house call • Lack of efficiency • Time required • Fewer family physicians • Poor reimbursement • Biomedical knowledge and technology • Growth of 3rd party payers • Heightened liability concerns Why are house calls coming back? • Projected increase in the number of elderly • Consumer demand • Hospital readmission reduction • The concept also has had "absolute rock-solid bipartisan support" among federal lawmakers.
    [Show full text]
  • Written Testimony of Keith Enright Chief Privacy Officer, Google United
    Written Testimony of Keith Enright Chief Privacy Officer, Google United States Senate Committee on Commerce, Science, and Transportation Hearing on “Examining Safeguards for Consumer Data Privacy” September 26, 2018 Chairman Thune, Ranking Member Nelson, and distinguished members of the Committee: thank you for the opportunity to appear before you this morning. I appreciate your leadership on the important issues of data privacy and security, and I welcome the opportunity to discuss Google’s work in these areas. My name is Keith Enright, and I am the Chief Privacy Officer for Google. I have worked at the intersection of technology, privacy, and the law for nearly 20 years, including as the functional privacy lead for two other companies prior to joining Google in 2011. In that time, I have been fortunate to engage with legislators, regulatory agencies, academics, and civil society to help inform and improve privacy protections for individuals around the world. I lead Google’s global privacy legal team and, together with product and engineering partners, direct our Office of Privacy and Data Protection, which is responsible for legal compliance, the application of our privacy principles, and generally meeting our users’ expectations of privacy. This work is the effort of a large cross-functional team of engineers, researchers, and other experts whose principal mission is protecting the privacy of our users. Across every single economic sector, government function, and organizational mission, data and technology are critical keys to success. With advances in artificial intelligence and machine learning, data-based research and services will continue to drive economic development and social progress in the years to come.
    [Show full text]