IE6 Was Unsafe 284 Days In 2006

An anonymous reader sends us to the Washington Post's Security Fix blog, where Brian Krebs has toted up the total vulnerability days for IE6 users in 2006. From the article: "For a total 284 days in 2006 (or more than nine months out of the year), exploit code for known, unpatched critical flaws in pre-IE7 versions of the browser was publicly available on the Internet. Likewise, there were at least 98 days last year in which no software fixes from Microsoft were available to fix IE flaws that criminals were actively using to steal personal and financial data from users... In contrast, Internet Explorer's closest competitor in terms of market share — Mozilla's Firefox browser — experienced a single period lasting just nine days last year in which exploit code for a serious security hole was posted online before Mozilla shipped a patch to remedy the problem."

I hope stuff like this makes the paper

[RiotXIX (230569)]

Then it might affect people who don't already know it.

Hazards of monoculture

[Kelson (129150)]

Consider that this would be less of an issue if IE weren't used by 70-90% (depending on where you look) of web surfers. Most-used and least-secure is a disastrous combination. This is why alternatives are important [alternativ...liance.com]. If the space broke down at, say, 30% IE, 30% Gecko, 15% Safari, 15% Opera and 10% random, malware authors would have to go to a lot more effort to exploit the majority.

Nothing to see here...

[Thansal (999464)]

you know the drill.

My bet is that the number that COUNTS is probably larger (also larger for FF), the number of days where there was a vulnerability that was known by malicious groups, just not publicly posted.

Re:

[UnknowingFool (672806)]

My bet is that the number that COUNTS is probably larger (also larger for FF), the number of days where there was a vulnerability that was known by malicious groups, just not publicly posted.

True, but this only makes Firefox look better. For the most part, vulnerabilities in open source are generally publicly disclosed in forums and the like. The details of the exploit usually remain secret. Who knows how many IE security bugs MS is not disclosing or acknowledging.

Re:

[Thansal (999464)]

Hey I got modded troll, nifty!

What I was actualy reffering to would be the knowledge in the hands of those that want to use it for evil (or atleast naughty) purposes.

Ok, so MS takes for ever to patch, we know this.

FF patches relatively quickly, we know this again.

But how long were vulnerabilities actualy LIVE (as in some one was tryign to exploit them) in the wild? That is much more interestign to me, everythign else is just sorta old hat.

Re:

[T-Ranger (10520)]

They live in the wild for as long as the product has been shipping, of course. Unfortunately, thats not a useful number. Products ship with bugs, known and unknown to their developers. A "secure" product may eventually become "insecure" because new techniques were developed. (Yes, differing companies/groups have different methodologies/standards/reputations for producing and shipping secure products, but thats a separate discussion all together)

A theoretically useful number would be the number of days from

all a matter of perspective

[macadamia_harold (947445)]

IE6 Was Unsafe 284 Days In 2006

Of course the flip side of this story is that IE6 was safe for 81 days in 2006.

Obviously, the solution is to shorten the year to 81 days.

There are three main factors for this

[Toreo asesino (951231)]

1. IE != OpenSource - many eyes are better than few for finding & fixing defects.

2. Desktop integration - across Windows 98, ME, 2000, XP and to a lesser extent Vista.

3. Application integration - there are tonnes of apps writen either embedded in IE, or using IE as a view-port to data, screens, etc.

All of the above (and more) make IE6 a bitch to keep updated quickly and easily. Breaking not just a browser, but OS shell, and tied-apps with a dodgy patch isn't an option for Microsoft and they know it (despite the odd rogue update that slips through the net).

Re:There are three main factors for this

[HappySqurriel (1010623)]

In my opinion, one of the biggest problems Microsoft faces is that web-page structure and syntax is not handled the same way a C++ program's structure and sytax are (as an example); you can make hundreds of syntax and structural mistakes in HTML, CSS and Javascript and IE will still attempt to display your page. I could be wrong, but I heard a couple of years ago that the majority of code in web browsers was not dealing with displaying correct HTML but was dealing with correcting mistakes to display a page. If IE could simply not display incorrect HTML and CSS the code base should be far smaller, which in turn should make it easier to maintain and probably more secure.

Dealing with broken code

[Kelson (129150)]

If IE could simply not display incorrect HTML and CSS the code base should be far smaller, which in turn should make it easier to maintain and probably more secure.

True. Unfortunately, we've got a decade and a half worth of web pages that were built sloppily. Not all of them, but enough to be an issue, especially since many of them are effectively abandoned and don't have anyone to fix the errors. If it had been designed that way from the beginning, it would be feasible, but there's all that legacy data to deal with. Any HTML browser designed to run on the web, and not just on, say a local set of help pages, has to do something with those pages. Dave Hyatt (of Safari fame) made some interesting comments [mozillazine.org] on the issue when discussing XML error handling in browsers -- basically, learning from the consequences of that decision to tolerate HTML errors without specifying how to recover from them.

Things are a bit better with CSS, as there are explicit rules for how to handle broken code (basically, ignore it and skip to the next line). The bigger problem there is handling code that was written to older, broken implementations -- the IE5 box model, for instance -- and trying to determine whether a page was built for the spec or for the broken implementation. This gets into quirks mode, and doctype sniffing, and things get kind of hairy.

(Then there's the fact that HTML and CSS are both designed with extensibility in mind... any unfamiliar tags or attributes in HTML are supposed to be ignored, so an HTML 3.2 browser can still do something useful with an HTML 4.0 page. But that's a slightly different issue.)

That's nothing

[hellfire (86129)]

My truck was unsafe 365 days. I could have been in an accident on any one of those days!

This is why I used SetSAFER

[reh187 (182368)]

Nothing like a quick Software Restriction Policy to "disallow" the use of IE :-)

I also have to admit, that since FireFox 2.0, I can trictly tell my browser which to sites to masquerade as IE.

Quite handy if I do say so myself...

Re:

[the dark hero (971268)]

I also have to admit, that since FireFox 2.0, I can trictly tell my browser which to sites to masquerade as IE.

Quite handy if I do say so myself...

i have to agree. some websites just dont function properly using firefox. a few people just dont bother testing the websites for multiple browsers.

What does this mean?

[creimer (824291)]

If IE6 was unsafe for nine months out of the year, what did it give birth to? Inquiring minds want to know...

Re:

[Aqua_boy17 (962670)]

So THAT's where the Zune came from.

Lobbyist hat on

[greymond (539980)]

At MS it is our commitment to better our security on all our applications. In 2006 we spent over 284 days researching and developing a series of bug fixes for our IE product line. This gave us over 98 days where IE was impenetrable to attackers and didn't require the need for any patches. Mozilla would like to claim that there product is safer than ours, yet they admit themselves that they had a period of 9 days where their browser was highly vulnerable to hackers and exploits. IE offers a web experience unsurpassed by any other browsers, compatible with every major website online today. If you choose to use an alternative browser it will still have flaws, but MS Windows allows you to choose, and having choices is what MS is all about. Would you really not want to have a choice in web browsers? Would you really want to only have Firefox and that be the end all be all to browsers? People need to have a choice, that's part of why this great country of America was founded.

I'M A WINDOWS GUY

[eno2001 (527078)]

I use IE for everything and I've never once been hacked by these supposed security holes. I do all kinds of stuff like online banking, eTrade, eBay, online shopping, the works! And it's totally secure because it's all encrypted. Sure, I've had something like $24,000 worth of charges applied to my credit cards that weren't mine, but that wasn't because of IE. That was because I made the mistake of dealing with a few companies that use Linux or some Unix variant (heh, sounds like a disease we're talking about here instead of an OS) for their web portals and they probably got rooted. Open source software is just not safe. The hackers are all over it since it's all out in the open. Once they get a chance to look at how it works, they can easily make it do their bidding. At least Microsoft has the sense to keep stuff private. NO hackers in the entire world could figure any of that stuff out because there just isn't any single person as smart as Bill Gates and his crack team of developers. I wouldn't touch Firefox with a ten foot pole since it's open source. Although they only report the bugs they think they've found, there are probably billions more than MS has in IE because the hackers have a roadmap with open source. It says, "Here's the keys to the kingdom. Come hack me". I Trust MS products because MS is all about making great, innovative software that is secure and robust and stable.

NOTE: The above post is merely a parody of the Windows user who's "got religion". A reasonable Windows user knows better. A reasonable *nix user knows better. Let the games begin...

Re:

[cyber-vandal (148830)]

The idea is you post it without the disclaimer and laugh at all the flames ;-)

Re:

[Abcd1234 (188840)]

You mean troll?

As Long As IE Runs ActiveX

[Master of Transhuman (597628)]

it's unsafe.

Which means it was unsafe for the last 365 days of last year.

I just did another five hour spyware cleaning last night (which still isn't complete). A fifteen-year-old kid managed to bring a Dell PC to its knees over just a few days of browsing the wrong sites.

The kid was visiting the client. The kid has an Apple at home - so he didn't know what he was doing was death to Windows...:-)

Re:

[ubergenius (918325)]

While normally I'd agree with you, the article is from the Washington Post, and is very well supported. Not to mention that there is little "bashing" and much more statistical support.

I am by no means a Microsoft hater. I use many of their products (specifically Windows and Office) because they are simply better than the alternatives, even the free ones. However, I am also not a Microsoft zealot, and realize the company has it's flaws (not talking about business practices, just software) and IE is one of

This article is absurd

[acidrain (35064)]

I wonder what windows would add up too

IE and windows are really one big insecurity mash-up that is hard to see individually. Remember the Netscrape lawsuit over bundling IE? When M$ was arguing in court that taking something as insecure as a web browser and tightly integrating it into something that is supposed to be secure like an OS was required for their continued innovation.

Anyway, I think this is absurd. IE6 had a patch available. It was IE7. M$ released IE7 as a "high priority security upda

No IE 7 for Windows 2000

[tepples (727027)]

Anyway, I think this is absurd. IE6 had a patch available. It was IE7

Replacing Microsoft Internet Explorer 6 Service Pack 1 with Windows Internet Explorer 7 requires replacing Microsoft Windows 2000 Professional with Microsoft Windows XP Professional. Not all users of Windows 2000 want to pay for the patch. Mozilla, on the other hand, plans to continue to make its products compatible with Windows 2000 even through the 3.0 series.

Re:

[Bertie (87778)]

Completely different approach, though. It's not "integrated into the OS" as such, it's just a wrapper for other functionality which it calls upon as and when necessary. The effect is very similar from where the user's sitting, but underneath there's a clear separation between it and the components it provides an outlet for. Personally I think it's rather elegant.

Re:

[by Anonymous Coward]

Are you basing that on anything scientific? No. Just an uninformed opinion.

Welcome to Slashdot. Try the ramen.