Figure 2 - uploaded by Stefan Frei
Content may be subject to copyright.
Upgrade dynamics of major versions of Internet Explorer (IE7), Firefox (FF2), Opera (OP9), and Safari (SF3) from Jan 2007 to Jun 2008. The plot shows the usage share of the latest major version within each browser type.
Source publication
The Web browser Insecurity Iceberg represents the number of Internet users at risk because they don’t use the latest most secure Web browsers and plug-ins to surf the Web. This paper has quantified the visible portion of the Insecurity Iceberg (above the waterline) using passive evaluation techniques - which amounted to more than 600 million users...
Similar publications
In recent years, attacks targeting web browsers and their plugins have become a prevalent threat. Attackers deploy web pages that contain exploit code, typically written in HTML and JavaScript, and use them to compromise unsuspecting victims. Initially, static techniques, such as signature-based detection, were adequate to identify such attacks. Th...
Citations
... gov/glossary/term/vulnerability), a (software) vulnerability is a "weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source." Each year, a tremendous number of Internet users are exposed at great risk due to a laziness of applying security patches on their software systems [9]. Publicly available but not patched vulnerabilities create high alert because those security risks offer invaders the power to have complete control for the system. ...
... For example, there are large-scale web client flaws, composed of 15% common vulnerabilities and exposures (CVE), found in repository reports [46]. Moreover, 45% of internet users used outdated browsers with security problems [47]. ...
Internet of things (IoT) is a technology that enables our daily life objects to connect on the Internet and to send and receive data for a meaningful purpose. In recent years, IoT has led to many revolutions in almost every sector of our society. Nevertheless, security threats to IoT devices and networks are relentlessly disruptive, because of the proliferation of Internet technologies. Phishing is one of the most prevalent threats to all Internet users, in which attackers aim to fraudulently extract sensitive information of a user or system, using fictitious emails, websites, etc. With the rapid increase in IoT devices, attackers are targeting IoT devices such as security cameras, smart cars, etc., and perpetrating phishing attacks to gain control over such vulnerable devices for malicious purposes. In recent decades, such scams have been spreading, and they have become increasingly advanced over time. By following this trend, in this paper, we propose a threat modelling approach to identify and mitigate the cyber-threats that can cause phishing attacks. We considered two significant IoT use cases, i.e., smart autonomous vehicular system and smart home. The proposed work is carried out by applying the STRIDE threat modelling approach to both use cases, to disclose all the potential threats that may cause a phishing attack. The proposed threat modelling approach can support the IoT researchers, engineers, and IoT cyber-security policymakers in securing and protecting the potential threats in IoT devices and systems in the early design stages, to ensure the secure deployment of IoT devices in critical infrastructures.
... For example, spyware was reportedly installed in a hospital system via an employee's personal Webmail account and sent the attacker more than 1,000 screen captures, containing financial and other confidential information, before being discovered [Mcm09b]. Having a backdoor Trojan, keystroke logger, or other type of malware present on a client, runs counter to protecting the security and privacy of public cloud services, as well as other Internet-facing public services being accessed [Fre08,MRG10]. ...
The article is devoted to the analysis of theoretical and practical aspects of technology of cloud computing, revealing of the main problems of providing information security of various models of cloud services and models of deployment of cloud environments, as well as the choice of methods for providing security of data processing and methods for improving the safety of cloud computing. Object of research - information security technology cloud computing. The purpose of the work is to analyze the theoretical and practical aspects of information security technology of cloud computing, determination of their principles and perspectives. Methods of research - analysis, synthesis, generalization, systematization, graphic. One of the main approaches to the implementation of cloud infrastructure is the virtualization technology - the provision of computing resources abstracted from their real hardware implementation. With the increase in the degree of cloud computing technology openness, the flexibility of its operation and the universality of access, the security of the system decreases and requires more complicated methods of ensuring its security. The cloud computing system can be exposed to several types of security threats, including threats to the integrity, privacy and availability of its resources, data, and virtual infrastructure. The construction of the cloud computing security system requires taking into account the model of its deployment (private, public or hybrid cloud) and the differences in the levels of control and access for user and provider in different cloud service models (IaaS, PaaS, SaaS). The most effective and thus universal way of ensuring data protection in the cloud, as well as its confidentiality and integrity, is to use the data encryption at the file level when transmitting over information networks and when storing inside the cloud. IT-administrators and users can partially regain control over the security of their data, using securitybased solutions based on data encryption. Using the appropriate encryption methods prevents unauthorized access to data, regardless of where they are located, in the process of transmitting or storing it in the cloud, and allowing organizations to take advantage of cloud computing without compromising or minimizing risk. KEYWORDS: CLOUD COMPUTING, CLOUD SERVICES, INFORMATION SECURITY.
... While this methodology provides the scalability property and thus it is undoubtedly valuable to provide a solid knowledge about the browser marketplace, it presents important limitations in the accessibility and targeting capabilities since (i) it is accessible to just few companies with capacity to monitor thousands of websites and (ii) its passive nature prevents targeted monitoring campaigns for specific geographical areas or browser ids/versions. In addition to commercial solutions, there are academic works that analyze the browsers' marketplace with a focus on security [8], [9]. However these works do not develop any specific technique to collect browser information, instead they use logs from Google, which is obviously proprietary and not accessible. ...
In this paper we present a novel active measurement methodology for monitoring the browser market landscape. It leverages the display ads delivered through online advertising campaigns to collect the browser brand and version of the device receiving the ad. While providing a similar accuracy to traditional techniques based on passive measurements, our methodology offers some advantages: (i) a lower entry barrier for researchers and practitioners interested in measuring the browser marketplace; (ii) it allows targeted measurements, which can be useful to fix biases in the data sample or to analyze specific aspects of the browser market. We analyze the performance, accuracy, and capabilities of our methodology through real experiments that overall produced more than 6M measurements.
... For example, spyware was reportedly installed in a hospital system via an employee's personal Webmail account and sent the attacker more than 1,000 screen captures, containing financial and other confidential information, before being discovered [Mcm09b]. Having a backdoor Trojan, keystroke logger, or other type of malware running on a client does not bode well for the security of cloud or other Web-based services it accesses [Fre08,MRG10]. As part of the overall security architecture for cloud computing, organizations need to review existing measures and employ additional ones, if necessary, to secure the client side. ...
Cloud computing can and does mean different things to different people. The common characteristics most interpretations share are on-demand scalability of highly available and reliable pooled computing resources, secure access to metered services from nearly anywhere, and displacement of data and services from inside to outside the organization. While aspects of these characteristics have been realized to a certain extent, cloud computing remains a work in progress. This publication provides an overview of the security and privacy challenges pertinent to public cloud computing and points out considerations organizations should take when outsourcing data, applications, and infrastructure to a public cloud environment.
... Drive-by-download attacks are one of the most pervasive threats on the web, and past measurements have found millions of malicious web pages [3, 32]. In addition, studies have shown that a large portion of the online population uses software that is vulnerable to the exploits used in drive-by-download attacks [12]. A primary line of defense against drive-by-download attacks consists of detecting web pages that perform such attacks and publishing their addresses on blacklists. ...
High-interaction honeyclients are the tools of choice to detect malicious web pages that launch drive-by-download attacks. Unfortunately, the approach used by these tools, which, in most cases, is to identify the side-effects of a successful attack rather than the attack itself, leaves open the possibility for malicious pages to perform evasion techniques that allow one to execute an attack without detection or to behave in a benign way when being analyzed. In this paper, we examine the security model that high-interaction honeyclients use and evaluate their weaknesses in practice. We introduce and discuss a number of possible attacks, and we test them against several popular, well-known high-interaction honeyclients. Our attacks evade the detection of these tools, while successfully attacking regular visitors of malicious web pages.
... Several factors have contributed to making drive-by-download attacks very effective. First, vulnerabilities in web clients are widespread (in 2008, such vulnerabilities constituted almost 15% of the reports in the CVE repository [18]), and vulnerable web clients are commonly used (about 45% of Internet users use an outdated browser [8]). Second, attack techniques to reliably exploit web client vulnerabilities are well-documented [4,333435 . ...
JavaScript is a browser scripting language that allows developers to create sophisticated client-side interfaces for web applications. However, JavaScript code is also used to carry out attacks against the user's browser and its extensions. These attacks usually result in the download of additional malware that takes complete control of the victim's platform, and are, therefore, called "drive-by downloads." Unfortunately, the dynamic nature of the JavaScript language and its tight integration with the browser make it difficult to detect and block malicious JavaScript code. This paper presents a novel approach to the detection and analysis of malicious JavaScript code. Our approach combines anomaly detection with emulation to automatically identify malicious JavaScript code and to support its analysis. We developed a system that uses a number of features and machine-learning techniques to establish the characteristics of normal JavaScript code. Then, during detection, the system is able to identify anomalous JavaScript code by emulating its behavior and comparing it to the established profiles. In addition to identifying malicious code, the system is able to support the analysis of obfuscated code and to generate detection signatures for signature-based systems. The system has been made publicly available and has been used by thousands of analysts.
... Our global scale measurements of Web browsers in use [1] from mid 2008 found that 45.2% of Internet users were not using the latest Web browser version when visiting Google Web servers. If people keep using an outdated Web browser version with known vulnerabilities, they can easily fall victim to any of the millions of malicious Websites that execute drive-by downloads to infect the visitor's computer with malware. ...
... In June 2008, we found the Mozilla Firefox Web browser to have the most effective update mechanism of any popular browser [4]. However, throughout June 2008, at most 83% [1] of all active Mozilla Firefox users were using the latest Mozilla Firefox version. We were wondering if one cannot do even better than Mozilla Firefox by deploying a different update mechanism in a Web browser. ...
... After publication of our browser study [1] in July 2008, we got many write-ins of users explaining to us why they prefer not to update their Web browser. Some users simply don't want to update because updating can be very inconvenient. ...
We analyze the effectiveness of different Web browser update mechanisms on various operating systems; from Google Chrome’s
silent update mechanism to Opera’s update requiring a full re-installation. We use anonymized logs from Google’s world wide
distributed Web servers. An analysis of the logged HTTP user-agent strings that Web browsers report when requesting any Web
page is used to measure the daily browser version shares in active use. To the best of our knowledge, this is the first global
scale measurement of Web browser update effectiveness comparing four different Web browser update strategies including Google
Chrome. Our measurements prove that silent updates and little dependency on the underlying operating system are most effective
to get users of Web browsers to surf the Web with the latest browser version.
... A total of 291 unique malicious URLs, about 0.12%, were identified. Results of the monthly inspection of these URLs are shown in Figure 6 (Note that no monthly scan was conducted in May 2008). Over the eight month period, no increasing nor decreasing trend can be detected. ...
... None of the pages that were detected as part of this study successfully attacked a patched system. But even with patching being a good defensive strategy, it assumes that users do patch, which is not a given [40]. In addition, even patched systems can be at risk if a zero-day attack appears which continued to happen throughout 2008 and as recently as December 15th 2008 [41]. ...
Client-side attacks have become an increasing problem on the Internet today. Malicious web pages launch so-called drive-by-download attacks that are capable to gain complete control of a user's machine by merely having that user visit a malicious web page. Criminals that are behind the majority of these malicious web pages are highly sensitive to location, language and economic trends to increase their return on investment. In this paper, a comprehensive measurement study of malicious web servers on the .nz domain is presented. The risk of drive-by-download attacks has been compared with other domains showing no elevated risk for the .nz domain. However, a comprehensive assessment of the .nz domain showed the existence of malicious web pages across a variety of types of web pages. Blacklisting services showed limited success to protect against such malicious web pages. This is primarily attributed to the highly dynamic nature of malicious web pages. Over a period of eight months, the .nz domain was monitored and continuous shifting of malicious behavior of web pages has been observed. The rates observed show that on average 50% of malicious URLs identified change monthly. The rates pose a challenge to blacklisting services as well as a risk to end users with rapid dissemination of zero-day attacks. Frequent scans of the web are required to obtain a good up-to-date view of the threat landscape.
... [25] and OpenSocial [40] ). All the while, Web security remains weak, as seen in the popular press [27, 60, 72, 52, 78, 79, 103] and published technical surveys [33, 101]. All trends spell potential for Web attackers, who see a growing population of victims using browsers and Web sites with unpatched security holes. ...
Sometimes Web sites fail in the worst ways. They can reveal private data that can never be retracted [60, 72, 78, 79]. Or they can succumb to vandalism, and subsequently show corrupt data to users [27]. Blame can fall on the off-the-shelf software that runs the site (e.g., the operating system, the application libraries, the Web server, etc.), but more frequently (as in the above references), the custom application code is the guilty party. Unfortunately, the custom code behind many Web sites is difficult to secure and audit, due to large and rapidly-changing trusted computing bases (TCBs). A promising approach to reducing TCBs for Web sites is decentralized information flow control (DIFC) [21, 69, 113]. DIFC allows the split of a Web application into two types of components: those inside the TCB (trusted), and those without (untrusted). The untrusted components are large, change frequently, and do most of the computation. Even if buggy, they cannot move data contrary to security policy. Trusted components are much smaller, and configure the Web site's security policies. They need only change when the policy changes, and not when new features are introduced. Bugs in the trusted code can lead to compromise, but the trusted code is smaller and therefore easier to audit. The drawback of DIFC, up to now, is that the approach requires a major shift in how programmers develop applications and thus remains inaccessible to programmers using today's proven programming abstractions. This thesis proposes a new DIFC system, Flume, that brings DIFC controls to the operating systems and programming languages in wide use today. Its key contributions are: (1) a simplified DIFC model with provable security guarantees; (2) a new primitive called endpoints that bridges the gap between the Flume DIFC model and standard operating systems interfaces; (3) an implementation at user-level on Linux; and (4) success in securing a popular preexisting Web application (MoinMoin Wiki).
