| Name | Description | Actions | On |
|---|
“The browser is the most dangerous application,” says Christoph Fischer, an expert in IT security from Karlsruhe. Browser programs are indispensable for depicting internet pages on the computer, but are anchored deep into the operating system. At the same time they make direct contact with the chaotic realm of the internet. That makes them an inviting target for the ill-intentioned.
Adding to the problem is the increasing complexity of browsers, Fischer notes. All modern browsers include embedded support programs and languages like Java, Java Script, Flash, and ActiveX. This is a result of the trend toward more colourful web sites loaded down with animated “do-dads.” Without the corresponding plug-ins, the pages cannot be properly depicted with the browser.
This “featuritis” has made no friends at the German Federal Agency for Information Technology (BSI) in Bonn.
Frank W Felzmann, the division head for IT safety in operating systems, says, “That makes the browser easier to attack.” Every program has weak points that can be exploited once they are discovered. Among other problems, this means that market leader Microsoft has “grave security problems with its older browsers,” Fischer feels.
Even the Firefox browser from the Mozilla Foundation, developed as a stripped down counterpart to Microsoft’s Internet Explorer (IE), now features numerous add-ons. These helper programs allow the browser to be customized to meet personal preferences.
BSI expert Felzmann estimates that the current version of IE has more weak spots than Firefox. Yet this has cost IE many users. “That makes Firefox more interesting for attackers, since they react to the market share,” Felzmann explains. “Attackers will go after the browser that is most widespread.” The new IE 7, expected on the market in the second half of this year, may well become a prime target for so-called malware authors.
Microsoft has recognized, however, that “significant investments in security are a constant necessity,” explains Andreas Schoenberger, the company’s marketing manager in Munich. Dangers through phishing must be taken just as seriously as viruses and worms. The new IE 7 browser will therefore also offer both an anti-spyware function and a “phishing filter.” This involves tests to prevent attacks luring online banking users into revealing their access data.
The first step in the process is a comparison of the web site being visited with a local list of recognized genuine sites. Another step involves checking the site for characteristics typical of phishing sites. Finally a comparison is made against a constantly updated online service from Microsoft, which notes “good” and “bad” sites. If a phishing alarm is triggered, then the surfer is provided a warning or the page is blocked.
BSI expert Felzmann warns against overconfidence. The new IE 7, whose beta version is already available, has not been written completely from scratch. “Parts of earlier versions were used, and these contain some security holes.” Moreover, protection based on a list of banned sites is a “cat-and-mouse game,” since new phishing sites appear on the web constantly.
IT expert Christoph Fischer points out that this process also involves certain privacy risks. Microsoft is ultimately being informed about visited web sites in real time, which not all internet users may appreciate. Fischer also complains about the lack of transparency for the browsers. Certain functions can in fact be turned off, but “Which users know about it? They are too complex for normal users to master.”
As a result, many simply ignore security issues “because they’re annoying.” The IT expert also implores surfers to take basic precautionary measures, regardless of which browser they use. This includes switching off browser features like ActiveX and Java Script, which can be used to sneak in spy programs. The automatic downloading of plug-ins should also be deactivated.
Alongside the regular update of the operating system, virus protection program and firewalls, Felzmann also advises surfers to be vigilant about security threats and to approach unknown web sites with caution. The consequences of security gaps are not clear to everyone, Christoph Fischer adds: “Millions of people are spied on every day by spyware. They’re standing buck naked on the web.”
INFO BOX: Create separate user profile for surfing. Computer users should create a user profile with restricted access rights to be used when web surfing, advises Frank W. Felzmann from the German Federal Agency for Information Technology (BSI) in Bonn. Most users foolishly surf using their administrator account. That allows any malware that sneaks onto the machine to gain full control of it.  Â
By Felix Rehwald,Â
  Â
