How Your Old Browser Threatens Your Security

05 October 2011 | 11:20 AM ET | Sue Marquette Poremba, SecurityNewsDaily Contributor

The Netscape Web browser, circa 1995.
CREDIT: AOL Inc.

For most of us, the Web browser is the first application we use when we turn on a computer. It's how we check email, read the news, chat with friends and do just about everything.

What many users don't realize, however, is that the Web browser is the most important security defense our computers have — and yet 60 percent of the browsers accessing the Internet today are outdated. An outdated browser ends up impacting everyone's security, privacy and performance.

To help users understand the importance of the browser you use, the Online Trust Alliance (OTA), a Web-industry trade group based in Bellevue, Wash., that promotes security and trust in online marketing and commerce, recently unveiled the "Why Your Browser Matters" initiative.

"The 'Why Your Browser Matters' initiative provides users overall recommendations to upgrade their out-of-date and legacy browsers for a more safe, more private and more compelling online experience," said Craig Spiezle, executive director of OTA. "The Initiative is all about communicating with computer users to make them realize that an updated Web browser is one of the most important security steps you can take. It's as important as running anti-virus/anti-malware software."

Spiezle is quick to point out that while there is no magic bullet when it comes to computer security, the browser is on the front line of defense because it is used so frequently.

"Modern browsers detect malicious websites and phishing URLs, analyze downloads and support a broad suite of privacy features," Spiezle said. "It's critical to have these at your disposal when it comes to protecting yourself online, as well as protecting your machine in general."

How new browsers protect you

Modern browsers try to provide security for users in three different ways, explained Roger Thompson, chief emerging threats researcher for ICSA Labs in Mechanicsburg, Pa.

For example, said Thompson, all modern browsers have "blacklists" of known malware sites and try to prevent users from visiting them. This method works well if the malicious sites are well-known, but online criminals try to move websites around by changing domain names and IP addresses faster than security researchers can update the blacklists — so sometimes this doesn't work.

Some browsers, such as Google Chrome, also run applets and executable code in a "sandbox," meaning that the code and applets can't affect other parts of the browser or the operating system. Again, this doesn't always work.

And all modern browsers have a somewhat regular patch cycle, in which developers fix vulnerabilities to prevent direct attacks.

A good illustration of how a browser can act as the first line of defense is with regard to shortened URLs, or Web addresses.

URL-shortening services such as bit.ly, tinyurl.com or is.gd are handy to use when including links in instant messages, text messages or Twitter posts. Unfortunately, URL shorteners also mask the actual URLs they lead to, and give no warning that links might be drive-by downloads or exploits waiting for unsuspecting victims.

Fortunately, some enterprising software developers have created a way to find out where you're going.

"There are plug-ins available for Chrome and Firefox that will automatically expand short URLs to their actual address when viewing pages containing such links," said Harry Sverdlove, chief technology officer of Bit9, a Web security company in Waltham, Mass. "These are useful when using Facebook or Twitter from a browser, common places where malicious links are hiding in short URLs."

How to protect yourself

As Thompson pointed out, browser vendors are good about providing updates and patches that improve security by fixing vulnerabilities that bad guys exploit. But after that, it's up to the user himself to take action by actually downloading the updates, or upgrading the browser to the latest version.

You can check the version number of your browser by going to the Help button on your browser's menu and checking the “About” section. (On a Mac, click the name of the application next to the apple icon in the upper left of the screen.) Often, the "about" pop-up window will prompt you to check where there might be updates available.

For those who use Internet Explorer, Spiezle has this important piece of advice: "If it says Internet Explorer 6 ... run, do not walk to the nearest free download of Internet Explorer 9."

(If you're still running Windows XP, update to Internet Explorer 8, the latest version you can install.)

Internet Explorer 6 has been the target of a number of malicious attacks over the past decade; newer versions of Internet Explorer are much more secure.

Does it matter which browser you use? Spiezle and Thompson disagree on that question.

While Thompson said that today's browser upgrades have leveled the playing field when it comes to security, Spiezle pointed out that there still are differences among them, and each user has to assess which is best for his own uses.

"You need to look at not only the security features, but also privacy features, as well as support for the latest technologies," Spiezle said.

Would you like to subscribe to our weekly newsletters?