Symantec: Mozilla browsers more vulnerable than IE

Summary:Update: Security firm casts doubts on Mozilla's security, but admits that Internet Explorer is the only browser widely exploited by hackers today

Mozilla Web browsers are currently potentially more vulnerable to attack than Microsoft's Internet Explorer (IE), according to a Symantec report out on Monday; the same report also found that today's hackers are still focusing their efforts on IE.

Mozilla browsers, such as the popular Firefox, have typically been seen as more secure than IE, which has suffered many security problems in the past. Mitchell Baker, president and chief lizard wrangler of the Mozilla Foundation, insisted earlier this year that Mozilla browsers were fundamentally more secure than IE, and would not face as many problems as IE even as their marker share grows. But Symantec's Internet Security Threat Report Volume VIII  contains data for the first six months of this year that may contradict this perception.

According to the report, 25 vendor-confirmed vulnerabilities were disclosed for the Mozilla browsers during the first half of 2005, "the most of any browser studied". Eighteen of these were classified as high severity.

"During the same period, 13 vendor-confirmed vulnerabilities were disclosed for IE, eight of which were high severity," according to the report.

The average severity rating of the vulnerabilities associated with both Internet Explorer and Mozilla browsers in this period was classified as "high", which Symantec defined as "resulting in a compromise of the entire system if exploited".

Symantec reported that the gap between vulnerabilities being reported and exploit code being released has dropped to six days on average. However, it's not clear from the report how quickly Microsoft and Mozilla released patches for their respective vulnerabilities, or how many of the vulnerabilities were targeted by hackers, though Microsoft only generally releases patches on a monthly basis.

Symantec admitted that "at the time of writing, no widespread exploitation of any browser except Microsoft Internet Explorer has occurred", but added that it "expects this to change as alternative browsers become increasingly widely deployed."

The Mozilla Foundation had not responded to requests for comment at the time of writing.

The report also highlighted a trend away from the focus of security being on "servers, firewalls, and other systems with external exposure". Instead, "client-side systems — primarily end-user systems — [are] becoming increasingly prominent targets of malicious activity".

Web browser vulnerabilities are becoming a preferred entry point into systems, according to the report.

The report also highlighted the trend of hackers operating for financial gain rather than recognition, increased potential exposure of confidential information, and a "dramatic increase in malicious code variants".

Update: After this story was published, Mozilla responded to Symantec's claims and defended its security record. Click here to read more.

Topics: Security

About

Tom is a technology reporter for ZDNet.com, writing about all manner of security and open-source issues.Tom had various jobs after leaving university, including working for a company that hired out computers as props for films and television, and a role turning the entire back catalogue of a publisher into e-books.Tom eventually found tha... Full Bio

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.