Sneaky Microsoft plug-in puts Firefox users at risk

"Computerworld - An add-on that Microsoft silently slipped into Mozilla's Firefox last February leaves the browser open to attack, Microsoft's security engineers acknowledged earlier this week.

One of the 13 security bulletins Microsoft released Tuesday affects not only Internet Explorer (IE), but also Firefox, thanks to a Microsoft-made plug-in pushed to Firefox users eight months ago in an update delivered via Windows Update.

"While the vulnerability is in an IE component, there is an attack vector for Firefox users as well," admitted Microsoft engineers in a post to the company's Security Research & Defense blog on Tuesday. "The reason is that .NET Framework 3.5 SP1 installs a 'Windows Presentation Foundation' plug-in in Firefox."

The Microsoft engineers described the possible threat as a "browse-and-get-owned" situation that only requires attackers to lure Firefox users to a rigged Web site."

Read the full story by Gregg Keizer

Microsoft may have known about critical IE bug for months

Researchers uncovered latest bug in 2007; Microsoft mum on timing

The vulnerability that sent Microsoft scrambling yesterday and is being used by hackers now to attack Internet Explorer (IE) users may have been reported 18 months ago or more.

In the security advisory it issued yesterday, Microsoft credited a pair of researchers -- Ryan Smith and Alex Wheeler -- with reporting the bug. Smith and Wheeler once worked together at IBM's ISS X-Force, although Wheeler now is at Texas-based 3Com's TippingPoint DVLabs.

Wheeler confirmed that he and Smith uncovered the vulnerability, but he gave most of the credit to Smith. Wheeler declined, however, to say when the bug was reported to Microsoft. "I don't feel comfortable talking about that," he said, citing a non-disclosure agreement related to the vulnerability that he signed at the time. Instead, he steered questions to his former employer, ISS X-Force.

Wheeler suggested switching browsers. "Unless they're specially configured, other browsers will face substantially lower risk," said Wheeler. Browsers such as Mozilla's Firefox, Google's Chrome and Apple's Safari don't rely on ActiveX technology to drive add-ons, as does IE.

Read the full Computerworld story by By Gregg Keizer

Browser Battle: Nine Browsers of Today and Tomorrow Compared

Anyone who may have thought the death of Netscape would signal the end of the browser wars, boy were they mistaken. In fact, it could be argued that it was at that point it all began. It didn't take long for Mozilla's Firefox to emerge from Netscape Navigator's ashes, and over time, Firefox would win over enthusiasts with a potent combination of speed, security, and an unprecedented level of customization.

But what started as a two-man battle is quickly growing into all-out warfare. Prepare to be overwhelmed by an onslaught of new browser releases in the coming months as Microsoft, Mozilla, Apple, Opera Software, and Google all vie to provide your vehicle for navigating the web. Each one brings something new to the table, whether it be blazing fast performance or a unique feature-set. Don't worry if you haven't been paying attention - we jump in the trenches with whole lot of them and get to know each one on a personal basis.

read more | digg story

Firefox picks up 2 out of 3 users IE loses

FireFox is predicted to hit more than 21% market share in Dec, IE will drop below 69%. There is also a conclusion that FireFox is stealing more IE users than any other browser out there. 

Internet Explorer 7 is somewhat stable, but shows a tendency to drop. Internet Explorer 6 is on a clear path of decline. Current market share highs during the week are at about 22%, down from more than 25% three months ago. The lows are at about 15%, down from about 18% in October. It is clear that IE7 is not picking up the market share IE6 drops, but what about IE8 (beta)? The browser is showing strong growth, but the growth is based on a base line market share of just 0.48%. There is continuous adoption of the browser, which is now expected to be in the range of about 10 million, give or take a few hundred thousand users. Considering the current trend and estimates that IE may have lost almost 50 - 70 million users this year, IE8 is clearly not picking up users fast enough.

read more | digg story

IE To Get Privacy Mode

Microsoft is planning a "privacy mode" for the next release of its Internet Explorer (IE) web browser. By clicking a button, users of IE8 will be able to limit how much information is recorded about where they go online and what they do. By comparison Apple's Safari browser already has a privacy mode and developers working for Mozilla, creators of Firefox, are reportedly working on a similar feature for future versions.Other browsers, such as Xerobank, take a more thorough approach to privacy and try to anonymise all web use.

read more | digg story

Firefox Users Most Secure on Internet, Study Reveals

"Mozilla Firefox fans might rest a little easier these days after a study released Tuesday revealed that its users are most secure on the Internet. Altogether, the study found that less than 60 percent (59.1) of people use up-to-date, fully patched Web browsers. Failure update browsers exponentially increases the chance for remote attacks executed by hackers, the study found. Firefox users were far and away the most likely to use the latest version, with an overwhelming 83.3 percent running an updated browser on any given day. However, despite Firefox's single click integrate auto-update functionality, 16.7 percent of Firefox users still continue access the Web with an outdated version of the browser, researchers said.The study also revealed that the majority of Safari users (65.3) percent were likely to use the latest version of the browser between December 2007 and June 2008, after Safari version 3 became available. Meanwhile, Microsoft (NSDQ:MSFT)'s Internet Explorer users ranked last in terms of safe browsing. Between January 2007 and June 2008, less than half of IE users -- 47.6 percent -- were running the most secure browser version during the same time period. Opera ranked slightly higher than IE, with about 56 percent of users who said that they have applied the latest version of the browser to their computer. Of the four browsers surveyed, Opera ranked last in popularity, with a just 11 million users that comprise .8 percent of the marketshare."

read more | digg story