Firefox holes patched as browser becomes bigger target

Stan Beer
Tuesday, 06 June 2006 10:26

Your IT - Home IT

Those of us who received our automatic security updates for the Mozilla Firefox browser last week have received a stark reminder that, when it comes to software and the web, the level of vulnerability rises in proportion to the size of the target. The fact that most of us Firefox users are now running Firefox 1.5.0.4, as a result of the need to fix 12 flaws, five of which were critical, is proof enough of that.

For years, Microsoft's detractors have been pummelling the company mercilessly for being such a hackable target. Meanwhile, Apple and the various flavours of Unix and Linux got off scot free. It is true that more vulnerabilities are probably discovered in Windows daily than in a whole year in Mac OSX. However, not even Mac and Linux users can dispute the fact that to a large degree, until relatively recently, virus writers have largely ignored them, preferring to go after their favourite sport Windows.

Now that the Mac platform looks like going through a renaissance, virus writers are starting to refocus their gaze.

To a degree, the same thing holds true for the browser space. In the early part of this decade, like the vast majority of users I used Internet Explorer, thinking that it wasn't such a bad browser by the standards of that time. With a user base of 90 percent plus to target, vulnerability seekers had a field day with IE. Then along came Firefox. It was newer, more advanced, faster, and had added functionality that the dated IE couldn't match. However, FF had a negligible user base, it was not worth targeting for virus writers, so nobody bothered to look too hard for vulnerabilities.

Now, IE has a user base which is dropping toward the 80%, while FF is climbing toward a 15% market share. Guess what? All of a sudden a bunch of new FF vulnerabilities surface. Unless Microsoft can halt the advance of FF with IE7, Mozilla is going to grab an even bigger market share. As the target grows, just watch the vulnerabilities bubble to surface at ahn increaing rate.