Forgot your password?
typodupeerror
Security The Internet

Criminals Prefer Firefox, Opera Web Browsers 172

Posted by CmdrTaco
from the choosy-criminals-choose-chimera dept.
An anonymous reader writes "Security researchers at Purewire have leveraged vulnerabilities in malware infrastructure to track the criminals behind it. In a three-month long project, they used security flaws in exploit kits to get operators to expose themselves (Obnoxious interstitial ad between link and content) when they access the kits' admin control panels. Data collected shows that 50% of those tracked use Firefox, while 25% use Opera."
This discussion has been archived. No new comments can be posted.

Criminals Prefer Firefox, Opera Web Browsers

Comments Filter:
  • by Psychotria (953670) on Friday August 21, 2009 @06:40PM (#29151671)

    I am not sure that I would have liked seeing the operators expose themselves.

  • So the story is.. (Score:5, Insightful)

    by Anonymous Coward on Friday August 21, 2009 @06:41PM (#29151679)

    crim.. *cough* technically inclined people tend to use firefox and opera rather than IE.
    Shocking!

    • The more advanced use telnet.

      • Re: (Score:2, Funny)

        by Anonymous Coward

        Where's "LWP", "wget", "curl", "fetch", or even lynx? These are supposed to be technically savvy criminals, right?

    • by gmuslera (3436) on Friday August 21, 2009 @07:08PM (#29151927) Homepage Journal
      A better reading could be "people that exploit vulnerabilities of browsers prefer to not use those vulnerable browsers". Not sure how much technically inclined they are (not sure if there are a black market of plug-and-exploit-for-dummies kits), but they are aware of how much damage can be done to whoever (including them) using those vulnerable browsers.
      • by Ungrounded Lightning (62228) on Friday August 21, 2009 @09:08PM (#29152667) Journal

        A better reading could be "people that exploit vulnerabilities of browsers prefer to not use those vulnerable browsers".

        In particular:

        "People who create websites containing malware that takes over the browsing computer NEED to use a browser that is immune to their own takeover tools for their command-and-control console."

        Jeez. Think about it a moment. How the heck are they going to work on the thing if it eats their machine when they touch it?

      • Sadly, no [google.com]

        • Re: (Score:2, Funny)

          by FireFlie (850716)
          Hey, the first link actually uses that exact text...

          A better reading could be "people that exploit vulnerabilities of browsers prefer to not use those vulnerable browsers". Not sure how much technically inclined they are (not sure if there are a black market of plug-and-exploit-for-dummies kits), but they are aware of how much damage can be done to whoever (including them) using those vulnerable browsers.

          Wow! Deja vu anyone? Let's delve deeper.

          A better reading could be "people that exploit vulnerabilities of browsers prefer to not use those vulnerable browsers". Not sure how much technically inclined they are (not sure if there are a black market of plug-and-exploit-for-dummies kits), but they are aware of how much damage can be done to whoever (including them) using those vulnerable browsers.

          ...

          Sadly, no [google.com]

          Wait something's not right. Hey the first link actually uses the quoted text. Someone better mod parent down, sheesh.

          A better reading could be "people that exploit vulnerabilities of browsers prefer to not use those vulnerable browsers". Not sure how much technically inclined they are (not sure if there are a black market of plug-and-exploit-for-dummies kits), but they are aware of how much damage can be done to whoever (including them) using those vulnerable browsers.

          Wait a minute... What's happening here?...

          *downscroll*

          Nooooooooooo!

          • Oh, don't do that!!! I'm laughing my ass off here, and you KNOW how hard it is to screw the damned thing back on!!

    • by linear a (584575) on Friday August 21, 2009 @07:27PM (#29152059)

      Close. Hackers know better than to use IE for all the obvious reasons nobody else should use it.

      • Re: (Score:3, Informative)

        by tuxgeek (872962)
        Firefox 3.5 + Adblock + Noscript
        Probably has something to do with this?
  • by MartinSchou (1360093) on Friday August 21, 2009 @06:41PM (#29151687)

    I prefer Opera myself - does that now incriminate me? Or does it merely show that these criminals are security conscientious and knows that using IE on the type of websites they probably frequent would be like throwing stones at bees nests?

    They did neglect to mention the most frequently used operating system. If it's equally divided between Linux, OS X and Windows it'd be hard for Internet Explorer to get beyond 33% to begin with.

  • by Hatta (162192) *

    This is obvious. People implementing malware and running botnets are going to be more technically capable than most. The more technically capable you are, the more likely it is you'll use Firefox or Opera. No big deal.

    • Is it the mouse-clicking or the keyboard-typing that requires more technical capability while using Firefox or Opera rather than IE?

      • Re: (Score:3, Informative)

        by Hatta (162192) *

        It's simply being aware of alternatives. If you know what a browser is, and that you have a choice of browser, you're well ahead of the average internet user.

      • by MichaelSmith (789609) on Friday August 21, 2009 @06:50PM (#29151767) Homepage Journal

        Is it the mouse-clicking or the keyboard-typing that requires more technical capability while using Firefox or Opera rather than IE?

        Knowing about them.

      • by Itninja (937614) on Friday August 21, 2009 @07:24PM (#29152031) Homepage
        FF or O don't require more technical skill, but people with more technical knowledge with usually opt to use them. For example, only a technically savvy person knows the dangers of allowing scripts to run without direct user permission. With FF one can get NoScript running in less than a minute. With IE, you might be able to cobble together some goofy proxy, but for the most part you are on your own.

        No one knows better than a scumbag malware distributor how to protect themselves online.
        • Re:What do you mean? (Score:5, Interesting)

          by REggert (823158) on Friday August 21, 2009 @09:37PM (#29152829)

          Less than a minute? Wow! That's almost as fast as the four seconds it takes in my browser!

          I've always been fascinated by the fact that disabling scripting in FireFox requires a plugin. In Opera, all you do is click a checkbox in a drop-down menu (or to do it per-site, a checkbox in a dialog window). The same goes for enabling/disabling plugins, applets, sound, cookies, animated images, popups (actually a set of radio buttons and not a checkbox), proxy servers, and sending referer information. It seems to me to be an excessive amount of work to have to install additional software just to get basic security features.

          And yes, I'm an Opera fanboy. ;-)

          • Disabling scripting in FF does NOT require a plugin.

            • Okay, then since I don't use FF, I'm honestly confused as to the utility of NoScript, if it's possible to disable scripting without it. Elucidate?

              • by REggert (823158)

                Me too.

              • by swillden (191260)

                Okay, then since I don't use FF, I'm honestly confused as to the utility of NoScript, if it's possible to disable scripting without it. Elucidate?

                NoScript allows you to turn off scripting in general, but to allow it for specific sites. By default, with NoScript turned on, no Javascript is executed, but there's an icon in the status bar that will allow you to allow this site, or a portion of this site, to execute scripts, either temporarily or permanently, and when you change the permissions it automatically reloads the affected page elements.

                It also does things like blocking cross-site scripting attacks, even when you are allowing a site to execut

          • Damn, if only I could go "Edit -> Preferences -> Content -> Enable JavaScript" in Firefox :(
          • by Itninja (937614)
            As long as you want to disable it GLOBALLY, them yeah that's great. Even IE can do that. But that makes many legitimate and useful sites useless. I don't want to have globally enable and disable scripts every time. With NoScript I can 'whitelist' specific sites or just temporarily allow scripts for a single page if I want.
        • Re:What do you mean? (Score:4, Informative)

          by Eravnrekaree (467752) on Friday August 21, 2009 @11:50PM (#29153409)

          Actually you can at least when i used IE years ago, turn off the scripts. In fact, you can tell it to allow just scripts to run on certain pages but not others. On firefox? Cant do it without the plugin! Furthermore, IEs feature is a part of a security profiles feature which included a huge number of site features you could turn off, including many others like cookies. You would create a series of profiles, and then establish certain settings in that profile, then add websites to the profile. You could therefore control multiple things through the profiles. Cant do it with firefox. The noscript only covers js, so if you wanted to block cookies as well, youd have to create a completely seperate database of sites.

          • by Zancarius (414244)

            On firefox? Cant do it without the plugin! Furthermore, IEs feature is a part of a security profiles feature which included a huge number of site features you could turn off, including many others like cookies. You would create a series of profiles, and then establish certain settings in that profile, then add websites to the profile. You could therefore control multiple things through the profiles. Cant do it with firefox.

            While NoScript may only work with scripts, they're the most fundamental cause of mali

            • Plugins and cookies are a huge problem. Cookies are a major privacy concern, and plugins well just depends on how much you trust the external plugin. Given that the js engine is loaded with security problems, its likely that java and flash are too. You really just want to block all of this out by default and allow certain websites to run them as needed. My policy would be to havea default security profile that allows no cookies, no plugins and no js, and then allow only certain websites to run the js. Javas

              • by swillden (191260)

                Plugins and cookies are a huge problem. Cookies are a major privacy concern, and plugins well just depends on how much you trust the external plugin.

                NoScript blocks plugins as well, including Java, Flash, Silverlight, etc. And it blocks XSS attacks, even for pages you are allowing to run JS.

                It doesn't block cookies, but there are other tools for that. And cookies aren't really that significant anyway, especially if you disable third-party cookies and configure FF to lose them every time the browser is closed.

              • by Zancarius (414244)

                and plugins well just depends on how much you trust the external plugin.

                You eventually have to trust someone, somewhere. Be it MS or the individual responsible for NoScript. Schneier wrote an interesting piece [schneier.com] on countering "trusting trust."

                Given that the js engine is loaded with security problems, its likely that java and flash are too

                Likely that Flash is to? There have been far more zero day exploits in Flash than have been present in Mozilla's JS engine that were widely and actively exploited. Worse, Ad

          • This was by design. Everything which could be moved to a plugin was. Of course, some things have slipped back into the browser, but the idea was to cut down the bloat.

            • Turning off scripts, plugins, and cookies is NON OPTIONAL. That its not including by default in firefox really shows a lack of concern for encouraging people to follow good security practices. Plus as I said, you need to block not only scripts, but plugins and cookies too! Its better to do this with a security profiles feature, and to allow websites to be added to one of many security profiles. i mean, IE of all things had these features. 10 years ago. And firefox doesnt. Thats defective by design. Its real

          • by Itninja (937614)
            Who said anything about 'turning off' scripts? I want to be able to whitelist sites I trust and reject all other scripts from being run. Since many legit sites use scripts, people have to leave script-execution enabled all the time in IE.
  • Not surprising... (Score:3, Insightful)

    by nebaz (453974) on Friday August 21, 2009 @06:43PM (#29151697)

    This just means that malware writers understand that Internet Explorer has more vulnerabilities to exploit, so they don't use it themselves.

  • by joeflies (529536) on Friday August 21, 2009 @06:43PM (#29151701)

    Actually the article says 46% Firefox and 26% Opera. Did the submitter really need to round the numbers for the article summary, when more accurate numbers would be more meaningful?

    If it was really 50%/25%, I'd suspect a low sample size, i.e. 1 IE user, 2 Firefox users, and 1 Opera user.

    • by gmuslera (3436)
      You should count Safari, browsers with fake identification, IE versions that are still believed to be mostly safe, and suicidal maniacs.
      • Re: (Score:3, Insightful)

        by Barny (103770)

        What? All in the same group? Thats a bit harsh on the suicidal maniacs out there don't yathink?

        I think a better summery stat would have been that "of the top 3 browsers, over 70% of malware writers steer clear of IE".

        Also, anyone wonder if the remaining 28% or so of IE users are using it just to test their exploits?

    • by Looce (1062620) *

      46% Firefox and 26% Opera could just as well mean 23 Firefox users and 13 Opera users.

      And what's this anyway about using percent? Let's all start using parts per million! :)

    • Actually the article says 46% Firefox and 26% Opera. Did the submitter really need to round the numbers for the article summary, when more accurate numbers would be more meaningful?

      If it was really 50%/25%, I'd suspect a low sample size, i.e. 1 IE user, 2 Firefox users, and 1 Opera user.

      Roughly 79.365 % of statistical references contain serious flaws.

      If their uncertainty would be +- 5%, they should round their numbers to reflect that (50% and 25%). Alternatively they could say "(46 +- 5)%"

      Your heuristic is faulty, it is a human flaw often exploited by marketeers and politicians. If they price an item at 236 instead of 200 or 250, you have the impression that it must be a very competitive price, not something they chose arbitrarily.

  • by peipas (809350) on Friday August 21, 2009 @06:43PM (#29151703)

    The guy who took the phone off my lap on the train uses Firefox as well. Right?

    What's next, golfers prefer cars that cost more than $100,000?

    Give me a break.

  • Most computer skilled people prefer those same browsers. Its what I've got open at this moment, FF and Chrome.
    • by peipas (809350)

      I have to ask, why are you using Firefox and Chrome at the same time? I could see Firefox and IE if the latter were open for an IE-only site, though those who know use IE Tab [mozilla.org] with Firefox. But Firefox and Chrome??

      • Re: (Score:1, Interesting)

        by Anonymous Coward
        I like using Chrome to watch flash video and I usually use Firefox for web surfing. FF loves to hoard memory watching videos but Chrome doesn't seem to have many problems with it.
        • by hodet (620484)
          can't have all that porn slowing you down huh....
          • If you are watching your pr0n in a web browser, you're doing it wrong (in a related statistic, 98% of people foolish enough to use a browser as a pr0n front end us IE)
  • by Idimmu Xul (204345) on Friday August 21, 2009 @06:45PM (#29151723) Homepage Journal

    What does this article even mean?

    Tech savvy IT security enthusiasts prefer alternative browsers to Internet Explorer?
    Criminals prefer Firefox?
    Firefox users have criminal tendancies?
    Firefox encourages exploitation of inferior browsers?

    Or, Internet Explorer sucks.

    What.

  • Fireofx is that good (Score:3, Informative)

    by Dayofswords (1548243) on Friday August 21, 2009 @06:47PM (#29151751)
    computer people use Firefox because they know its good, others use IE because its all they know that exists
  • Of course they use non-IE browsers; they probably either spend considerable time exploiting IE, or at least are aware that IE is often exploited. I'm sure criminals who break into houses through open or poorly secured windows have wrought iron bars on all of their own.
  • Dubious logic? (Score:5, Insightful)

    by Johnny Loves Linux (1147635) on Friday August 21, 2009 @06:50PM (#29151769)

    Interestingly, Opera, which by some measures has only a 2 per cent market share, ranked second among the kit operators, with 26 per cent. "I think that's probably because operators have a familiarity with the web threat landscape," Royal told The Register, suggesting that many black-hat hackers take a security-through-obscurity approach to making sure they themselves don't get hit. "It makes them wary of using mainstream browsers."

    Huh, and here I was thinking that maybe, just maybe, these hackers knew the security history of the various browsers and knew that Opera had a better security history than Internet Explorer?

    • Re: (Score:3, Insightful)

      by Runaway1956 (1322357)

      An alternative conclusion could be, since Opera rules the market share in countries that use the cyrillic alphabet, most criminals are from Eastern Europe and Russia.

      Still dubious logic, but hey, it's as good as the author's dubious logic!

  • by DigiShaman (671371) on Friday August 21, 2009 @06:52PM (#29151787) Homepage

    One out of two criminals agree. Certifiably badass!

  • by Anonymous Coward on Friday August 21, 2009 @06:53PM (#29151799)
    Wow! No wonder it is so difficult to make money publishing on the Internet. Even an ad that goes away after a timeout, or can be skipped with a single click, creates angst amongst those who hold that information wants to be free. /. editors don't accept stories that include links to content behind paywalls, even if the information is really relevant to the /. community. Post a link to an article requiring registration and someone will copy the article and paste it as a comment (which seems like a pretty clear copyright violation). And now warnings are being given because someone out there is actually paying for the content that /. readers want to look at. Go ahead and mod this down troll/flamebait/overrated...but dang this obsession with not having to pay for any content, either in terms of dollars, registration, some time, or an extra mouse click, seems to be, well, obsessive!
    • Re: (Score:3, Insightful)

      by falckon (1015637)

      That may be so, but do you really think the value of that extra click is worth anything from a /. reader with this mindset. Next thing you know you'll be suggesting they should follow some of the ad links on the site, or buy some of the site's affiliate's products. This may even be enforced by having your affiliates track when each user visits their site or fills out some survey. Nevertheless, no matter what you do, people who believe that the web should be free will continue to believe so.

      There's also a gr

  • Maybe so (Score:5, Insightful)

    by mysidia (191772) on Friday August 21, 2009 @06:55PM (#29151821)

    I'm reminded of an old observation: whenever ice cream sales rise, so do shark attacks. So does eating ice cream cause sharks to attack you? No.

    The observation that more Criminals prefer Firefox over IE, doesn't associate Firefox use with criminal behavior.

    It most likely just means that there is a common occurence that causes technically savvy computer users to prefer Firefox.

    People who build malware infrastructure are technically savvy, otherwise, they would not be able to understand and defeat technical security measures.

    Non-technically savvy users often use IE because they don't understand the alternatives.

    Also, they don't understand the weaknesses in IE's security defenses, the technical advantages of using Firefox (or Chrome) over IE, or the basic security principle that installing and using less-popular software (alternatives to the most popular option) means there are fewer people interested in devising a way to attack your software.

    Eg Opera is not a very ripe target that hackers are highly interested in attacking, because it has so few users, it's a low value target.

  • by EkriirkE (1075937) on Friday August 21, 2009 @06:58PM (#29151853) Homepage
    Are we now to be harassed if badged-mongoloids see us on the internet and its not a blue "e" icon?
    Akin to this previous /. story [slashdot.org] where one of them saw a student using a CLI
    • Hilariously, that story was just as hyperbolic as the idea cops would harass people for using firefox. That kid was a accused of trafficking in stolen goods among many other things, I believe the fact that he used a CLI just was an example of his technical competence.

  • by vistapwns (1103935) on Friday August 21, 2009 @07:04PM (#29151883)
    IE's lack of security being a reason for this. This is not true of recent versions of IE, and in fact, IE is sandboxed in recent versions of Windows, unlike FF and Opera. The Pwn2Own hacker winner rated it at 9/10 in security, and so on. I highly doubt this has anything to do with real security, more like hackers are faddish gullable kids who believe the "IE is teh insecure!" hype that the typical slashdotter believes. Ya mod me down, I don't care.
  • How many firefox/opera users are criminals? Probably a tiny, tiny percentage. Unless you count copyright violation, in which case everyone is guilty.

  • So what is the IE %? (Score:4, Interesting)

    by neonprimetime (528653) on Friday August 21, 2009 @07:15PM (#29151967) Homepage
    If FireFox 46, Opera 26, that is 72. does that mean IE is close to 28? or are there other browsers that take up the rest ... the story seemed to lack that info?
  • like any 733t H@ck3r would use Internet Explorer, and risk being kicked out of their group.

    Did you check to see if they were even using Windows? Chances are if not then IE isn't even available to them, but Firefox and Opera are. Maybe that is because Firefox and Opera are cross platform and IE isn't (except for a Mac OSX port that is fugly, but then why install IE for OSX when Safari is way better?) available on Linux, BSD Unix, etc.

  • opera in russia (Score:5, Interesting)

    by shird (566377) on Friday August 21, 2009 @07:49PM (#29152221) Homepage Journal

    I'm surprised Opera isn't more represented, given the number of Russian cyber-crimminals. Opera is quite widely used in Russia. Opera once did a random street sampling in the eastern bloc after Google's video of asking people "What is a browser" in New York Square (to which people replied "Google" or "Yahoo" etc). They found most people knew what it was and majority used Opera:
    http://my.opera.com/haavard/blog/2009/06/25/what-is-a-browser-russian-edition [opera.com]

    Which goes to show, those technically minded use Opera, which helps support my claims it is the better browser (for IT guys at least)

    • > Google's video of asking people "What is a browser" in New York Square (to
      > which people replied "Google" or "Yahoo" etc).

      When the correct answer, of course, is "An animal that browses, such as a goat or deer."

    • by shird (566377)

      Also from that link is these stats:
      http://gs.statcounter.com/#browser-RU-monthly-200901-200906 [statcounter.com]

      as you can see, in Soviet Russia, Opera browses you.

    • Re: (Score:3, Funny)

      by mqduck (232646)

      I'm a big fan of Firefox and prefer it to Opera, but I'm glad it's around. I once saw a forum thread somewhere about why the world needs Opera - to which someone replied: "so Firefox has somewhere to steal features from".

  • Not saying that all Russians are criminals, but there's a big population there, and yes there are many cybercriminals.... this might explain somewhat the Opera numbers.

  • No really? Probably they don't want their precious botnets be taken over and used "by proxy" (in both senses, actually...).

  • How do they test their activex exploits without using IE?
  • Water is wet, the sky is blue and we're all getting older.
  • Just for the record: "1 in 4 hackers use Opera" story is based on total global sample of 15 hackers... :-)
    • by sznupi (719324)

      And you think it's not representative only for Opera...why exactly?

      • by rbb (18825)
        I don't think any conclusions based on such a small sample group can be called representative, it's not specifically something either in favour or against Opera.

        The fact that people who run drive-by exploit sites use Opera or Firefox didn't surprise me much, I just wish they'd picked a larger sample group :)
        • by sznupi (719324)

          OK, that's better - it's just that your first post named the story like it's presenting, on flawed method, supposedly huge popularity of Opera (accidentally, that might be somewhat correct - Opera has 40% in Russia, not much less in Ukraine; still, methodology is bogus)

          • Re: (Score:3, Insightful)

            by rbb (18825)
            I think drawing any conclusions based 51 exploit-kit using hackers, from which only 15 IP addresses and browsers could be determined using a forged referer field [computerworld.com], is a prime example of bogus methodology ;)
  • I've always wondered if someone could make a browser just for hacking. Like display POST data in plain text and let you modify javascript commands and change true to false and send invalid form data anyway, etc. That would be so unbelievably valuable but as far as I know, it doesn't exist. Is that isn't feasible and why has nobody ever done it?! Are rendering engines and javascript engines that hard to write from scratch? Wouldn't hackers just copy and modify existing engines?
  • In other news, car thieves prefer exotic sports cars.
  • ...a guy by the name of Massad Ayoob wrote a book called "The Truth About Self-Protection." (http://www.amazon.com/Truth-About-Self-Protection/dp/0553195190) I recommend it highly, as one of the things he did was go over to the local prison and ask career criminals how they would go about protecting themselves from the same sort of people.
    It's quite instructive.

  • Criminals prefer cars to bicycles. Some even prefer the internet to the telephone. Most importantly they prefer the night to the day, as they are seedy folk after all.

Facts are stubborn, but statistics are more pliable.

Working...