18 ms·
Zero-Days in Desktop Web Browsers
- fouc 6y agoChrome: 6, Firefox: 5, IE: 4, Safari: 7 I suspect sample sizes are too small to really make strong claims about which browsers are least/most exploited.
- berkes 6y agoDo you mean that there are simply too few 0-days to make this claim? Because in that case I disagree: a 0-day is an important event, every single one counts. It's like nuclear bombs: statistically, it indeed makes no sense to say "amount of employed nukes per capita" or so, but it still makes sense to say "The US employed the most nuclear bombs" and "Japan has seen the most nuclear attacks on it's citizens". Or am I missing your point entirely?
- saagarjha 6y agoMost software sees many more zero days; usually you'll look at these kinds of things over tens or hundreds of exploits. It only takes one zero day to hack someone, of course, but by their nature they are perishable items and often single-use.
- bawolff 6y agoSure, but it would be silly to imply that therefore japan is the most dangerous place to live due to risk of nuclear bombs, like how the website is subtly implying that chrome is the least secure. I would also point out that the website is only tracking vulnerabilities in the last 2 years. I bet IE's number would go way up if you included IE6 (not that that would mean anything). I suppose you could also say that "Japan has seen the (tied for) least nuclear attacks on its citizens in the last 2 years", but i'm not sure what the point would be.
- 411111111111111 6y agoYou can't really have 0 days in software that has been eol for years... That would make the term useless. And I'm pretty sure chrome actually is the most "dangerous" browser wrt 0days. If they're going to exploit them, it's surely going to be the one with the largest market share. But yes, the quantity of bugs doesn't necessarily translate to the actual security of the browser.
- aljgz 6y agoFor anyone in the position to be a victim of a targeted attack (like an activist in a suppressing regime) the unexploited 0days can be important. It can be argued that for personal decision making for the general public, the number of exploited ones can be more meaningful.
- bawolff 6y agoThey could have had 0-days at the time. That would help to determine if chrome is just having a bad year due to luck (albeit i think this entire thing is BS)
- xenocratus 6y agoAgree, and it's also based on the number of 0 days _that have been found_. If more researchers are looking for them and disclosing them for Chrome (and it makes sense, since so much of web traffic goes through Chromium-based browsers and also because Google has a lot more people doing that), then you'll see more.
- paulryanrogers 6y agoChrome is also changing very rapidly. I imagine Firefox's ESR branch may be safer just because less change means less new code in need of review over time.
- dubcanada 6y agoComparing nukes which killed millions to a zero day in a browser is a bit much.
- mulmen 6y agoNukes have not killed millions. Web browsers are used in hospitals.
- dubcanada 6y agoOkay half a million, it’s still a lot of deaths. Has a zero day in a web browser directly resulted in anyone’s death?
- berkes 6y agoWhile this is interesting on itself, it does not make any claim valid or invalid. Proving that A is worse than B does not prove that A is good or that B is bad. Or, if you are more mathematical: a > b does not prove that b < 0 or a > 0, where 0 is neutral. And as I point out above: this was not meant as comparison but as analogy. If my analogy affected anyone, I sincerely apologise.
- mulmen 6y agoNot half a million either. Patients have died in ransomware attacks. Not half a million patients or even a quarter million but still, a browser zero day can be a threat to human life.
- dubcanada 6y agoNow you’re just arguing for the sake of arguing. There was 150,000 + 200,000 reported deaths. Those are also rounded figures. So 350,000.
- mulmen 6y agoI am using the numbers from the Wikipedia summary. I also checked to see if those numbers include long-term effects which is unclear from my cursory review. I don’t know how many people are in hospitals with life threatening conditions but I suspect it is more than a quarter million, or even half. Based on personal experience in deskside hospital IT browser vulnerabilities are a significant vector. We spent a lot of time re-imaging machines. There have been ransomware attacks at hospitals including deaths. A coordinated attack using this vector could easily cause as many deaths as nuclear weapons have. https://en.m.wikipedia.org/wiki/Atomic_bombings_of_Hiroshima_and_Nagasaki https://en.m.wikipedia.org/wiki/Atomic_bombings_of_Hiroshima... https://www.washingtonpost.com/national-security/hospitals-being-hit-in-coordinated-targeted-ransomware-attack-from-russian-speaking-criminals/2020/10/28/e6e48c38-196e-11eb-befb-8864259bd2d8_story.html https://www.washingtonpost.com/national-security/hospitals-b...
- mannykannot 6y agoYes, I think you have missed the point, as the severity of the problem is orthogonal to the issue of whether we have enough information to rank browsers. If they were not orthogonal, then severity of consequences would be a parameter in formal statistical methods for evaluating our confidence in the ranking. Let's take your analogy a step further. Does it follow that the US is the most likely to be the next user of nuclear weapons? Does it follow that Japan is most likely to be the next target? (I'm sure someone is thinking that at least one of those outcomes is quite likely, but note that I wrote "does it follow...", not "how likely is it..." because the issue is what one can deduce from the evidence presented in the above post.)
- kypro 6y agoI suspect that's more of a reflection of IE's market share than the security of the browser.
- viraptor 6y agoGiven the market share: > edge 5.83%, IE 2.15% It's not unexpected that people don't spend lots of time on IE 0days. I mean, Links was the least exploited one with 0 cases.
- saagarjha 6y agoThis website seems to be a great resource in finding exploited zero days for each browser, but using it for any kind of security comparison is likely not a good idea. Generally, "number of CVEs" is a flawed comparison metric for almost every kind of question you're going to ask, and CVSS is not particularly good at matching severity in the sense that most people might care about it.
- piracy1 6y agoIndeed. I would only list driveby RCE
- d33 6y agoA vulnerability that isn't an RCE isn't necessarily shallow: https://xkcd.com/1200/ https://xkcd.com/1200/
- half-kh-hacker 6y agoSurely that xkcd applies more to privilege escalation vulnerabilities, not plain RCE?
- EastSmith 6y agoI am wondering if the same Chrome bugs can be used against Edge that has Windows Defender Application Guard (WDAG) enabled?
- lucideer 6y agoNot sure if @hexatoms is reading this thread but some minor mistakes/typos: - Many of the vendor advisory links are pointing to the wrong place (most of the Firefox ones and at least 2 of the IE ones to start). - The starred note on Hardened IE says "4 out of the last 5" when it means "3 out of the last 4".
- Ygg2 6y agoI do find it interesting how many CVE are use-after-free.
- higerordermap 6y agoBecause memory leaks don't count as security issues :)
- pjmlp 6y agoAnother one to bookmark for heap corruption, use-after-free and type confusion coding error examples that expert C and C++ developers hired by top multinationals, with their PhD level recruiting processes, never make.
- tgv 6y agoDo I notice a hint of resentment?
- whizzter 6y agoI think it's more about tiredness of having people saying that anything not written 100% in C/Assembler using a <20k binary taking more than 300k of memory is a bloated mess and everything was better in the past and we all should use C and C++ for everything. (I will use C/Assembler if I'm coding something for an C64, Amiga or a 4k/64k demoscene intro but I'm not gonna put up a server written like that on the internet for people to exploit)
- pjmlp 6y agoNah, just being tired of being told that only newbies do security errors in C, and the languages that are copy-paste compatible with it. But there is a positive side to it, where would the anti-virus, hardware memory tagging and security consultancy companies be without languages like C, there is a market to keep alive out there.
- hannob 6y agoThis suffers from the same flaws as most CVE statistics. You take some data that you have, assume it's a representative sample and then make some claims based on it. The problem is: It's not a representative sample. If I understand this correct this is looking at CVEs where exploitation has happened as announced by the vendor. It's bad statistics, because you cannot assume all vendors tread these things equally (one vendor may be very open about known exploitations while another may try to hide stuff as much as possible). Creating such statistics also creates an incentive for vendors to be more secretive if such things happen, so it's not just bad statistics, it's also bad for security.
- ThePowerOfFuet 6y ago>The least exploited web browser is IE I'm sorry, I can't take this site seriously.
- djxfade 6y agoIt kinda makes sense though. IE is horrible, but it's usage share is in the single digits, so not a big attack surface to target. Chrome and Safari is far more interesting from a bad actors perspective
- fomine3 6y agoPossibly who still uses IE is mostly on business, so it's attractive target, isn't it?
- 1_player 6y ago* since 2019-01-01
- graderjs 6y agoIf anyone is thinking about remote browser isolation, please check out my open-source dual-licensed version at https://github.com/c9fe/ViewFinder https://github.com/c9fe/ViewFinder
- superkuh 6y agoThere's going to be more and more of these as browsers fully accept and cement themselves into their role as operating systems and inevitably expose more bare metal functionality. The only way to stop it is to not use a browser that thinks it's an OS. That means not being able to use websites that use new OS features like web components, webgl, etc. It means not using these features as web dev unless you're forced into it by getting paid. Browsers that treat the web as a document instead of an application will have far, far fewer remote exploits.
- d33 6y agoDo you actually see it as a practical solution? When you use those features only when you're a web dev, not only you're actually using them anyway (which defeats the purpose by driving demand), but you also increase supply by creating new websites of the kind. Also, if you not use the websites "that think they're an OS", you're ending up not being able to function in today's world to an increasing extent. e-governments are all about web applications, often with "bare metal functionality" such as legacy Java, ActiveX or Flash applets. They should be long gone, but given that somebody pumped millions into them, it will take them years to go away. Hell, even regular JS is bare metal today with all the complexity of JIT. I'm getting the impression that suggesting to go away from this realm is naive and a better solution would be to look at it from the perspective of "OK, it happened. How can we make it more secure?". After all, becoming an OS isn't an excuse to doing less. In fact, browsers now have more responsibility to keep their security philosophy up to date.
- labawi 6y agoHard disagree. I'm not giving WebGL a pass, nor wasm, web notification, webrtc, webusb, HTTP3, websocks, DOH or whatever bright idea they had last month, just to read a newspaper. I actually like and use webrtc, but only for actual RTC, otherwise it's a shitshow and disabled. Some things are indeed useful, but I don't see how you go OK, it happend, time to make it secure - with an ever expanding scope and attack surface. Note - "more secure" is not enough, we need secure.
- 6y ago
- px43 6y agoIMO the most interesting metric these days is bug price. https://zerodium.com/program.html https://zerodium.com/program.html Chrome bugs are currently selling for $500k and Firefox/Edge bugs are selling for $100k. It's kind of shocking that we got to this point, but for comparison, a full Chrome exploit sells for the same amount as a full exploit for IIS or Apache. Firefox and Edge sell for the same price as a full exploit in Wordpress.
- stilisstuk 6y agoWhy is that interesting? It reflects number if users, not breeder security?
- px43 6y agoIf you track over time, which that site doesn't show, you'd see that "number of users" isn't much of a factor. There are a bunch of popular apps with shitty security practices that have cheaper bugs than less popular apps with better design practices. This is a great way to measure "attacker utility". That is, it's not only a measure of how rare some of these bugs are, but how useful they are to attackers. Chrome bugs have been significantly more expensive than IE bugs since long before Chrome overtook IE in popularity. For a while, Firefox bugs and Chrome bugs we neck and neck, because even though it was easier to find exploitable bugs in Firefox, the Intelligence Community was buying up Firefox bugs like mad in order to exploit Tor users, since Firefox is the underlying tech behind the Tor browser.
- DoctorNick 6y agothis is basically an advertisement for an IE spin-off.
- kentonv 6y agoWasn't CVE-2020-15999 a bug in Freetype, which Firefox also uses? Why isn't there a Firefox CVE on the list from the same time? Was the bug not exploitable in Firefox for some reason, or is this list just incomplete? (Never mind that comparing counts of CVEs is a ridiculous way to compare security of products. CVE counts seem more indicative of the amount of research targeting the product than of the number of bugs in the product.)
- rebelwebmaster 6y agoFirefox only uses Freetype on Linux (the system-installed version) and on Android, and the vulnerable code path was only reachable in Firefox with a non-default pref set (gfx.downloadable_fonts.keep_color_bitmaps).
- fortran77 6y ago"The most exploited web browser is Safari" And considering Safari is not by a longshot the most popular browser, what does this say about Apple?
- robocat 6y agoSafari is very popular in some markets (e.g. 36% usage share in the USA), and you cannot select a more secure browser if you want to browse on your iDevice. Als Safari signals you are a high value target, so a Safari zero-day is generally worse for Safari users than say a Chrome zero day.
- samtheprogram 6y agoIs there any reference that these are actually zero days, or are these just particular CVE's based on some other category? e.g. the sources/links do not indicate that these were actually used in the wild? There's no indication that these were not responsibly disclosed.