Spyware Barely Touches Firefox

[geekerati]

In side-by-side tests of Microsoft Internet Explorer and Firefox, IE proved to be far more vulnerable to spyware infections. Most of the exploits that leveraged IE vulnerabilities to plant spyware were based on ActiveX and JavaScript.

Internet Explorer users can be as much as 21 times more likely to end up with a spyware-infected PC than people who go online with Mozilla's Firefox browser, academic researchers from Microsoft's backyard said in a recently published paper.

"We can't say whether Firefox is a safer browser or not," said Henry Levy, one of the two University of Washington professors who, along with a pair of graduate students, created Web crawlers to scour the Internet for spyware in several 2005 forays. "But we can say that users will have a safer experience [surfing] with Firefox."

In May and October, Levy and colleague Steven Gribble sent their crawlers to 45,000 Web sites, cataloged the executable files found, and tested malicious sites' effectiveness by exposing unpatched versions of Internet Explorer and Firefox to "drive-by downloads." That's the term for the hacker practice of using browser vulnerabilities to install software, sometimes surreptitiously, sometimes not.

"We can't say IE is any less safe," explained Levy, "because we choose to use an unpatched version [of each browser.] We were trying to understand the number of [spyware] threats, so if we used unpatched browsers then we would see more threats."

Levy and Gribble, along with graduate students Alexander Moshchuk and Tanya Bragin, set up IE in two configurations -- one where it behaved as if the user had given permission for all downloads, the other as if the user refused all download permission -- to track the number of successful spyware installations.

During Levy's and Gribble's most recent crawl of October 2005, 1.6 percent of the domains infected the first IE configuration, the one mimicking a naïve user blithely clicking 'Yes;' about a third as many domains (0.6 percent) did drive-by downloads by planting spyware even when the user rejected the installations.

"These numbers may not sound like much," said Gribble, "but consider the number of domains on the Web."

"You definitely want to have all the patches [installed] for Internet Explorer," added Levy.

In the same kind of configurations, Firefox survived relatively unscathed. Only .09 percent of domains infected the Mozilla Corp. browser when it was set, like IE, to act as if the user clicked through security dialogs; no domain managed to infect the Firefox-equipped PC in a drive-by download attack.

Read on
Oh yea!

[andrew247]

Makes me glad I've switched to Firefox

[Kenmcfa]

But think about the following: Morons are more likely to be infected with spyware (e.g. if a banner says 'click here' they generally do so). A moron is not even going to think of changing browsers (they probably don't even know that alternatives exist). So a spyware manufacturer can reasonably assume that all morons are easy to infect with spyware, and all morons use IE. So they only need to make spyware which infects IE users, knowing that this will infect a lot of people.

P.S. I'm not saying that all IE users are morons.

[dexterweb]

I was with FF since 0.4
great software but only if you get familiar with extensions