Browser Security Test

A Year Of Bugs

Mozilla browsers

Mozilla and the family (including Firefox, Netscape Navigator and Camino browsers) display a much shorter window of opportunity for a prospective attacker. There were 56 days (15%) in 2004 when there was a publicly known remote code execution in Mozilla and no patched release. 30 days in May-June for MacOS arbitrary code execution problem only affecting MacOS users, one day in July between the public report of shell: protocol vulnerability and the fixed Mozilla/Firefox release, one day in August between the disclosure and the fix of libPNG vulnerabilities, and 24 days in October-November between the the Michal Zalewski's announcement of mangleme program and the Firefox 1.0 release incorporating the fixes for publicly announced bugs.

Mozilla is enjoying some advantages concerning the public disclosure of vulnerabilities. Security researchers seem to be more inclined to report vulnerabilities privately to the Mozilla development team rather than publish them immediately. This might be because the Mozilla project produces free open-source software, and being nice to it is considered A Good Thing, or possibly also because of Mozilla's Security Bug Bounty Program that pays 500$ to users reporting critical security bugs.

The Security Bug Bounty Program is a very sensible thing indeed since unpatched vulnerabilities are quickly gaining commercial value. As many researches note, 2004 saw a big change in the motives of computer attackers. Before, virus and worm writers did it mainly for fun and recognition. Today a successful virus is commonly used for installing backdoors on infected computers and creating so-called "botnets". A botnet is a network of compromised computers that can be remotely controlled. A botnet has a lot of exciting uses, such as setting up a distributed denial of service attack against an online business and then blackmailing the business owners, or relaying spam, or serving porn. Obviously an unpatched vulnerability that can be used to distribute a virus or install a backdoor is worth something for the people in botnet business. We have seen this trend in Internet Explorer bugs this year when at least two vulnerabilities were first seen "in the wild" rather then being discovered and reported.

In 2004 Mozilla was not targeted by malware writers, so there are no red lines in the Mozilla timelines. This might change as Mozilla software is gaining popularity. Grey lines in the table below note the dates when vulnerabilities were privately reported to Mozilla development team.