Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Assume a Windows 7 system (probably whatever home version comes with the machine), with the latest OS patches, latest IE and latest Firefox. Also assume that the user uses only Firefox for browsing, never IE, and that uninstalling IE is impossible or impractical.

In the context of "safer" usage while browsing, is it sufficient to take steps to harden Firefox, or do I also need to worry about IE?

The underlying question is: Assuming a "Joe Sixpack" home user, are there attacks that target IE that can be triggered from actions taken by a user who doesn't knowingly start IE for web browsing? (And are they mitigated by hardening such as suggested in documents like this one.)

share|improve this question

3 Answers 3

I'm guessing that uninstalling IE is impossible or impractical.

Go to Control Panel -> Uninstall a program -> Turn Windows features on or off. There you can deselect Internet Explorer.

You need to harden IE as well. An application could launch or embed an IE window that could then be used to gain control of the system. Consider this attack: an attacker serves a web page that uses a 0-day remote code execution exploit in Firefox to launch an IE window that visits a page hosting a privilege-escalation exploit in IE.

share|improve this answer
    
Thanks for the tip on uninstalling. (I haven't run Windows at home in years, but as the resident geek some people expect me to know how to help with stuff like this.) Are annoying things going to happen to the users computer if I uninstall IE? I suspected that IE hardening would be needed but thought I'd ask... –  bstpierre Dec 16 '11 at 16:15
1  
As far as I know it mostly just removes the Internet Explorer executable, not the rendering engine, since that's used throughout the OS. I'd personally leave it installed and harden it, since then you have some control over it instead of solely relying on OS patches. But no, annoying things shouldn't happen if you remove it. –  pdubs Dec 16 '11 at 16:26
    
The only "annoying things" that might happen is that the user won't be able to use the occasional "IE-only" website or application. Sadly, there are still some of these out there. –  Iszi Dec 16 '11 at 19:49
    
You can also use Chrome Frame to use Chrome's engine in IE. Chrome is very likely to be the safest web browser at this time. –  Derek 朕會功夫 Mar 18 '12 at 2:07

If you use Outlook, then yes you must update IE in order to stay secure when viewing email messages.

Microsoft Outlook, the preview pane, and when opening an email message all use a variation of Internet Explorer that are only updated when you update Internet Explorer. This is true even if you choose to install keep MS Office binaries up to date, which are also required but for different reasons.

share|improve this answer

Short answer, yes.

One reason is that you're increasing your attack surface without maintaining part of it. Another is that adversaries continue to try decades-old exploits for exactly that reason. Firefox isn't a firewall or IDS/IPS designed to protect the soft insides of your system. Rich and interactive, it's designed for a pleasant experience, with sandboxing and other protections bolted on, relying on things it doesn't control like: games, plugins, the network layer (HTTP2 will blur that a little), feature development, and interactions with the OS (filled with IE libraries), etc.

@pdubs' advice to remove IE works from that perspective. Exploits often will just detect a Mozilla browser, drop a 0-day through Java/Flash/etc, then fork off with an old exploit you should have patched.

Removing IE may not remove libraries Windows needs to render HTML; default browser settings don't affect the whole-system's rendering engine. Firefox will still have all its features, and while Windows warns about untrusted downloads and privilege escalation, it's not foolproof. I've seen system compromises where IE and Firefox were configured to use system proxy settings (which is not Firefox's default setting, thanks @void_in). The problem probably came from a download that compromised one of Windows or IE, added malware to IE (if IE were hardened it should have blocked that), and then proxied both browsers under adversarial control.

Here are some things IE's Enhanced Security Configuration changes, because IE is so deeply involved with the OS:

  • Local Intranet is restricted, because it can share your credentials, affecting access to UNC shares (network and local). Standard Windows management tools are added to this zone because the browser changes actually restrict Windows management.
  • Trusted Zone is changed, affecting all applications, not just IE. Windows Update and Error Reporting are added to this zone, because now they also need additional permissions.
  • ActiveX is disabled. It blocks running programs from the web, Windows component installation, etc. This is such an important area that Microsoft additionally has "killbits" to disable specific components.
  • Scripting (not just one type) is disabled; rich Windows applications that need web scripting might not function.
  • In anticipation of future threats, changes include disabling 3rd-party plugins (the same type of thing left enabled in Firefox), installing IE and Web components on-demand, disabling the just-in-time compiler / virtual machine, media content playback, music, animations, video clips, certificate revocation, enables program identity verification, disables saving secured temporary data and clears temporary files on exit.
  • It reduces functionality that affects the Web, Web-based applications, local network, help, support, and general user assistance, because security is more important than being a browser.

    And that's just halfway down the page.

Windows Firewall can give you an idea how IE Zones interact within Windows and your network. The number of settings might help see why you want to use some lockdown tools, but realistically...

Your Joe Sixpack may be frustrated with enhanced security while still engaging in risky behavior (like an unverified codec). Defense In Depth (OWASP) here might consist of normal patching and mitigations specific to the deployment. You might keep a standard configuration, adjusting for changes, and then reimage and patch back up occasionally. The system's going to break anyway (The Inevitability of Failure...).

share|improve this answer
    
By default Firefox don't use proxy. It CAN use system proxy settings but the user need to specifically choose that. By default it is no proxy. –  void_in Mar 20 at 8:01
    
@void_in Sounds right; considered that last night. I've been using mitmproxy for so long I forgot. I'll correct that while I minimize. –  ǝɲǝɲbρɯͽ Mar 20 at 16:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.