Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite

Assume a Windows 7 system (probably whatever home version comes with the machine), with the latest OS patches, latest IE and latest Firefox. Also assume that the user uses only Firefox for browsing, never IE, and that uninstalling IE is impossible or impractical.

In the context of "safer" usage while browsing, is it sufficient to take steps to harden Firefox, or do I also need to worry about IE?

The underlying question is: Assuming a "Joe Sixpack" home user, are there attacks that target IE that can be triggered from actions taken by a user who doesn't knowingly start IE for web browsing? (And are they mitigated by hardening such as suggested in documents like this one.)

share|improve this question

2 Answers

up vote 12 down vote

I'm guessing that uninstalling IE is impossible or impractical.

Go to Control Panel -> Uninstall a program -> Turn Windows features on or off. There you can deselect Internet Explorer.

You need to harden IE as well. An application could launch or embed an IE window that could then be used to gain control of the system. Consider this attack: an attacker serves a web page that uses a 0-day remote code execution exploit in Firefox to launch an IE window that visits a page hosting a privilege-escalation exploit in IE.

share|improve this answer
Thanks for the tip on uninstalling. (I haven't run Windows at home in years, but as the resident geek some people expect me to know how to help with stuff like this.) Are annoying things going to happen to the users computer if I uninstall IE? I suspected that IE hardening would be needed but thought I'd ask... – bstpierre Dec 16 '11 at 16:15
1  
As far as I know it mostly just removes the Internet Explorer executable, not the rendering engine, since that's used throughout the OS. I'd personally leave it installed and harden it, since then you have some control over it instead of solely relying on OS patches. But no, annoying things shouldn't happen if you remove it. – pdubs Dec 16 '11 at 16:26
The only "annoying things" that might happen is that the user won't be able to use the occasional "IE-only" website or application. Sadly, there are still some of these out there. – Iszi Dec 16 '11 at 19:49
You can also use Chrome Frame to use Chrome's engine in IE. Chrome is very likely to be the safest web browser at this time. – Derek 朕會功夫 Mar 18 '12 at 2:07
up vote 0 down vote

If you use Outlook, then yes you must update IE in order to stay secure when viewing email messages.

Microsoft Outlook, the preview pane, and when opening an email message all use a variation of Internet Explorer that are only updated when you update Internet Explorer. This is true even if you choose to install keep MS Office binaries up to date, which are also required but for different reasons.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.