Is Mozilla Firefox 3.6 The Answer To IE 6 To Protect Against Aurora?

Alan Bentley

Alan Bentley, 29/01/2010, posted in "Analysis"

Alan Bentley is Senior Vice President of International Sales at Lumension Security. In this role, he is responsible for overseeing and driving sales and marketing efforts in Asia Pacific ...more info

Alan Bentley is Senior Vice President of International Sales at Lumension Security. In this role, he is responsible for overseeing and driving sales and marketing efforts in Asia Pacific and EMEA. An industry veteran with over 10 years experience in the IT security industry, Alan is responsible for leading teams in EMEA and APAC and elevating brand awareness, thought leadership and increasing market penetration to drive growth in the respective markets. Prior to Lumension, Alan held executive management roles in security organisations based across the UK including Global Secure Systems and Ellipse Distribution. Prior to entering the security industry, Alan held sales roles for MAN Roland, a German based company in the printing industry and Hanson, a UK company in the construction industry. Alan holds a degree from Brunel University with a BA (Hons) in European Business Studies. He also completed his PGCE at Roehampton Institute. ...less info

• 
• 

• Tweet
• Email

• Tweet
• Email

As reports break that three U.S. oil companies, ExxonMobil, Marathon Oil and ConocoPhilips, have been targeted by a new sophisticated type of cyber attack that could be originating from China, it has also been discovered by McAfee that a previously unknown flaw in Microsoft’s Internet Explorer has been used in these attacks.

With the every increasing vulnerability of IE, Alan Bentley, VP of Vulnerability Management, businesses should consider the security benefits of Mozilla Firefox as a preferred default browser.

Is it entirely coincidental that Mozilla released Firefox 3.6 on 21 January – the same day that Microsoft announced their out-of-band patch to the so-called Google Attack/Aurora exploit /IE zero-day. Perhaps fortuitous is a better way of putting it.

Of the many mitigation strategies suggested to IE users before their system is patched, the soundest one is to ‘Remove Internet Explorer as the default browser if a secondary browser is available’. Firefox with NoScript is a good alternative to the MS IE hegemony and any organisation wanting to limit a substantial security hole in their security posture is advised to get rid of IE6 in a safe, orderly and proficient manner.

After news of the Google attack broke, several European governments, including France and Germany, recommended that users get off Internet Explorer (as yet, the UK government has declined to go down this route). This resulted in a huge spike in downloads for Firefox and Opera.

So how will IE users benefit from the latest version of Firefox? Most importantly, from a security perspective, it has expanded on the ability to check for updates to Adobe Flash Player; Firefox 3.6 now scans a system for any insecure plug-ins and, if found, it will now prompt the user to apply the patch via a one-click interface.

Another major improvement comes with the Component Directory Lockdown, which locks out Firefox add-ons without explicit user permission. In addition, Mozilla has made several improvements to the TraceMonkey JavaScript engine for improved/faster video performance, along with many other tweaks.

Today, the bottom line for IE users is whether it’s time to move to a new default browser.