Is Internet Explorer 9 King of Malware Fighters?

Share it on Twitter  
Share it on Facebook  
Share it on Linked in  

It's not even out of beta yet, but Microsoft is touting test results that show Internet Explorer 9 (IE 9) blocks socially-engineered malware significantly better than any other browser, including IE 8.

However, Microsoft's (NASDAQ: MSFT) claims have also come under attack from at least one competitor who says the tests didn't measure many other security areas such as blocking vulnerabilities in plug-ins.

"NSS Labs, an independent, information security research and testing organization, released a report that shows Internet Explorer is the industry leader in protecting users against malware, with Internet Explorer 9 blocking an outstanding 99 percent and Internet Explorer 8 blocking 90 percent of socially-engineered malware," a Microsoft spokesperson said in an email to InternetNews.com.

Microsoft credits its SmartScreen URL filtering technology for the performance of its two browsers versus the competition.

The testing was performed for 11 straight days (24-hours a day) and consisted of more than 39 test runs against a constantly refreshed set of malware URLs, according to the report. The test report is available at NSS Labs' site.

What has caused some controversy, though, is how much better Microsoft's IE 8 and IE 9 did in the testing compared to competing browsers – particularly since Microsoft funded the tests.

For instance, Firefox only caught 19 percent of socially-engineered malware, while Apple's (NASDAQ: AAPL) Safari caught 11 percent, and Google's (NASDAQ: GOOG) Chrome only intercepted 3 percent. Opera, the report said, caught none of the attack URLs.

"These sponsored tests are limited in their sole focus on socially-engineered malware, while excluding vulnerabilities in plug-ins or browsers themselves," a Google spokesperson said in an e-mail to InternetNews.com.

"Google Chrome was built with security in mind from the beginning and emphasizes protection of users from drive-by downloads and plug-in vulnerabilities," the Google spokesperson added.

The report, in fact, does have a disclaimer to that effect – but it's a footnote, literally.

"This study does not evaluate browser security related to vulnerabilities in plug-ins or the browsers themselves," the footnote said.

The report does argue that socially-engineered malware – which uses trickery to get the user to perform some function necessary to enable the attack to progress – is a growing problem.

"Socially-engineered malware attacks pose a significant risk to individuals and organizations by threatening to compromise, damage, or acquire sensitive personal and corporate information; statistics from 2008 and 2009 show that this trend is increasing at a rapid rate," the report said.

Microsoft also defended paying for the testing.

"The test is conducted independently by NSS; it is commissioned by the product team to independently measure the protection of SmartScreen," the Microsoft spokesperson said.

As for why IE 9 even outperforms its older sibling – IE 8 – Microsoft and the report claim it's largely due to a new facility in IE 9 called the "SmartScreen application reputation system." It tracks the "reputation" of file downloads based on a database of applications in the cloud and helps the user decide whether or not to allow the downloads.

IE 9 began beta testing in September, and is scheduled for release sometime next year.

NSS Labs conducted the tests in September. The firm has previously done two other tests on socially-engineered malware performance, although IE 8 was the only Microsoft browser tested. In fact, in both of those tests, IE 8 also finished well ahead of competing browsers.

Stuart J. Johnston is a contributing writer at InternetNews.com, the news service of Internet.com, the network for technology professionals. Follow him on Twitter @stuartj1000.

Keep up with browser security news. Follow eSecurityPlanet on Twitter: @eSecurityP.