IE unsafe for three-quarters of 2006

Internet Explorer was unsafe to use for over three-quarters of the year, according to a security researcher.

Research carried out by Brian Krebs found that for 284 days in 2006, Microsoft's browser remained unpatched.

"For a total 284 days in 2006 (or more than nine months out of the year), exploit code for known, unpatched critical flaws in pre-IE7 versions of the browser was publicly available on the internet," he said on his blog.

"Likewise, there were at least 98 days last year in which no software fixes from Microsoft were available to fix IE flaws that criminals were actively using to steal personal and financial data from users."

He said there were ten cases last year where instructions detailing how to leverage "critical" vulnerabilities in IE were published online before Microsoft had a patch to fix them.

He said the situation contrasted with that of Firefox where this browser experienced a single period lasting just nine days last year in which exploit code for a serious security hole was posted online before Mozilla shipped a patch to remedy the problem.

Krebs said criminals specialising in internet fraud continued to ply much of their trade with the aid of security flaws in the Microsoft browser last year. In late December 2005, experts tracked organised criminals hacking into sites and seeding them with code that installed password-stealing spyware on machines used by anyone who merely visited the sites with IE.

"Microsoft initially downplayed the severity of the attacks, until it became clear that the threat was fairly widespread and that thousands of customers had already been attacked in the span of a few days," said Krebs. "The threat was seen as so severe that a large number of security experts urged users to download and install a patch produced by a third party until Microsoft developed an official fix."

Email to a friend

Print this page