The study shows IE8 and it’s new SmartScreen filter head and shoulders above all other browsers. “Socially engineered malware,” as they put it, is arguably the most important form of malware these days. We’ve reported on it many times in the last year. The basic idea is that the user is enticed into visiting a web site and downloading malware believing it to be something else. The study was funded by Microsoft but the methodology was designed and the tests executed by NSS Labs.
The recent generation of web browsers has approached this problem with reputation services, just as they have with phishing. Just as phishing sites are often initially blocked by browsers (“…this is a reported phishing web site”) based partly on blacklists of domains and IP addresses, so are malware sites being blocked.
NSS Labs’ tests came up with these results overall:
| Browser | Malware Catch Rate |
|---|---|
| IE8 (RC1) | 69% |
| Firefox 3.07 | 30% |
| Safari v3 | 24% |
| Chrome 1.0.154 | 16% |
| Opera 9.84 | 5% |
| IE7 | 4% |
Results like these can change over time as companies change priorities and find new sources of reputation data. It’s clear, for example, that Opera and Microsoft with IE7 aren’t even trying very hard to find malware. It’s also true that tests for phishing sites could find very different results. In fact, phishing is all those two browsers may be looking for, and they may find what malware they find by sheer coincidence. Finally, it’s likely that Microsoft was interested in such testing because they had been working hard on improving detection of such sites.
The other important take-away from this is that even the best numbers from IE8 are low. Protection such as this is a good defense-in-depth measure, but it’s no substitute for a good anti-malware program and other protections, such as least-privileged access.
