38

Is it in general a security problem not to update your browser. Firefox constantly prompts me to update my browser, but how dangerous is it to not update?

As part of this question, I would like to know what that problem exactly is. What are the risks of not updating your browser? What exactly could happen?

  • 29
    In fact you should update every piece of software that comes in contact with the internet. – user10008 Sep 17 '14 at 23:24
  • 7
    Every piece of software. – Steve Dodier-Lazaro Sep 18 '14 at 8:07
  • 4
    The better question is... why wouldn't you? In fact, with recent browsers they will do the work for you. – Camilo Martin Sep 18 '14 at 8:36
  • 1
    @user10008 I'd add: Not only the ones that come in contact with the Internet, but all software. A big example is Adobe Acrobat Reader (reading offline-transmitted rogue PDF files) – Adi Sep 18 '14 at 9:28
  • 6
    As far as "why wouldn't you"... Browser updates have a bad track record of not displaying sites that would display before. Usually it's the web developer's problem, but that's of little consolation to the business worker (or home user) that has bills due but suddenly can't do their banking after the browser auto-updates. – Brian Knoblauch Sep 18 '14 at 20:08
69

Because there are security vulnerabilities found in software all the time. These vulnerabilities are sometimes publicly disclosed, sometimes not. Either way, as developers find or find out about them they patch them. Running old versions of browsers leaves you vulnerable to malicious websites trying to infect your computer.

Below are links to web pages listing vulnerabilities that have been fixed in relatively recent versions of the 3 most popular browsers.

Microsoft Internet Explorer

Mozilla Firefox

Google Chrome

All browsers are going to have bugs, and all of them will have vulnerabilities. But staying on top of known vulnerabilities can help prevent attackers from gaining access to your system.

Edit

Thanks to kirb for these extra links to up-to-date blogs of browser security updates

IEBlog
Google Chrome Releases

  • 3
    To some some detail, I used to work in the infosec department for a large organization. We had computers get infected with malware periodically, and it was almost ALWAYS through the browser. It was usually in ad networks (which is another reason to block ads). A user was innocently surfing legitimate websites which would have an ad from a legit ad network. The legit ad network has been resold to someone else, who sold to someone else, etc. Somewhere down the line there's a oage in an iframe loading a hostile ActiveX control that will exploit an unpatched browser. So yes, patch your browsers. – PopularIsn'tRight Sep 19 '14 at 20:16
  • @user10008 -1 for the links, I don't think they add anything relevant to the answer. – William Edwards Sep 20 '14 at 13:57
  • 2
    @WilliamDavidEdwards Adding Links (and other types of references) is considered a good practice, and required for scientific work. Anyone can claim anything on the internet. – user10008 Sep 20 '14 at 19:27
  • 1
    IE and Chrome have blogs where patched vulnerabilities are disclosed similar to the Firefox link; IEBlog and Google Chrome Releases. – kirb Sep 21 '14 at 12:05
  • @user10008 scientific work takes a lot more, and for this question you'd be having to prove that the cost of updating one's browser is worth the benefits in general. That's a tougher answer (think about the So long and no thanks for the externalities kind of work). – Steve Dodier-Lazaro Sep 21 '14 at 22:01
23

I'm really just repeating other answers but let's try to explain it using a metaphor. A computer program is a long description of how the computer must behave, based on what information it is given. A browser program is given some instructions by a Web server program and draws a Web page for you to use. It then tells the Web server which next page it would like to visit, and so on.

We developers make many mistakes when writing programs. We sometimes forget some edge cases, in which case our programs will behave erratically and possibly cause damage. Sometimes, specific instructions allow to bypass a verification we make, for instance allowing someone to modify settings in your browser or to cause a download without you approving. In short, mistakes are exploited in any imaginable way.

In other cases, programs behave so erratically that they start writing garbage on top of their own list of instructions (like a child would draw on top of your shopping list). Attackers are very good at finding those cases (which we call exploits), and guiding the browsers to write very specific things (the payload) on top of the original instructions rather than garbage.

When this happens, developers figure it out sooner or later (often months/years later), and they improve the program's source code by removing the ambiguities or errors that allowed exploitation. They then release a new version that is no longer vulnerable.

When you use an old version of some software, it means that it is vulnerable to known and well-documented exploits, so anyone with a bit of wit can exploit your software and damage your computer and your data. In particular, Web browsers are constantly exposed to information from unknown third parties which may be malicious.

Web servers can be owned by mafias seeking to make money by installing malware on any computer passing by (that tracks your online banking, steals files that look like they contain financial information or passwords, track you online to serve you ads, make you solve CAPTCHAs on behalf of spamming bots or use your computer's resources to send spam).

Other attackers even break into legitimate servers and then add malware onto them, so even visiting a perfectly reputable website such as YouTube or Facebook can lead to malware. The very best defense you have against this is to not be vulnerable to the well-known ways in which your browser can be exploited, by updating it.

6

Well the whole point of updating/patching anything is to fix known vulnerabilities. Any bugs/vulnerabilities found in the version of firefox you're running could be exploitable. Updating your browser will modify how the browser works and result in those vulnerabilities being no longer exploitable. It's really as simple as that.

Updating can also introduce new vulnerabilities, but being a new version knowledge of new vulnerabilities is likely low, until it's been out for a while and people find some, then developers release a new patch and the cycle repeats its self.

Updates also often include performance increases as well, so faster operation, sleeker design, or various other user experience enhancements.

  • Could you give examples of what exactly could happen? How common are these security holes? – Thomas Sep 17 '14 at 18:10
  • 2
    They are extremely common. We all make mistakes when programming, and browsers contain millions of lines of code (instructions manually typed by programmers). Software engineers estimate you should expect 10 to 50 errors per 1000 lines of code, which gives tens of thousands of unknown errors in any browser. – Steve Dodier-Lazaro Sep 17 '14 at 20:25
5

There are two main reasons for creating a new version of a program: (in this case a browser)

  • To add new features (eg. viewing a video in the browser).
  • To fix a problem, which may be:
    • A minor issue (such as cmd-L not opening a new window when no window is available)
    • A big issue (eg. a malicious web page can read data from other requests [1] )

Some changes are a bit harder to classify (improving performance is a bugfix or a feature?)

Most of the big issues are security issues solving some kind of vulnerability. A modern browser is as complex as an OS, it's extremely hard not to have errors.

There are also new features improving security that don't involve a vulnerability (but you should try to adopt).

Some programs (eg. a postcard creator) it's not so critical to have the latest version. Mainly because you only use it with trusted files (those you have created) so the risk of getting infected through it is quite low.

On the other hand, web browsers are used everyday to visit lots of untrusted sites. And by untrusted I really mean it. If you are a heavy internet user, it's very strange that you don't visit a website that could compromised for a few weeks. The online newspaper you read? Guess what can be done within its ad network. When you searched X on Google? That search result could have been an exploit, etc, etc.

There are many evil guys trying to infect you (and mainly through your browser or one of its plugins). Sometimes they attempt a single vuulnerability, others they try as much as they can (an exploit kit), attempting whatever that could allow them to control your machine.

As the web browsers are updated as soon as they know about the bug -and succeed on fixing it- (sometimes they discover it first, sometimes it had been abused for a long time before that), if you keep it updated it's much harder to compromise you, as an attacker would need a bug without a fix (called a 0-day). However, using an old version means that you are also vulnerable to all the problems fixed after that version, for which the exploit in most cases was not even written before it was solved! (cf. Microsoft Security Intelligence Report 16, page 24 and MSIR 15) Non-updated systems are many times more likely to get infected.

Mozilla Firefox releases a new version every six weeks (plus whenever a security problem forces a new one). If you want to keep the browser updated but are not interested in less important changes (such as toolbar changes), you can run an Extended Support Release, which is supported for 54 weeks (although you can still get a new version with minor fixes every six weeks, plus the when-needed security updates).

Many other vendors also provide LTS (Long Term Support) versions of their programs, to which they apply security fixes (only), even though it's not the latest one. For instance Debian supports (ie. fixes the old versions they are shipping) their packages -although they are a distributor- for ~3 years, and Red Hat Enterprise Linux provides support for 13 years.

However, although you phrased the question in a generic way, you were probably wondering however why Firefox had to update to Firefox 32.0.1 (12 September 2014) just a few days after installing Firefox 32.0 (2 September 2014). This is not constantly, though as last update was on July.

The explanation is -as always- in the release notes https://www.mozilla.org/en-US/firefox/32.0.1/releasenotes/ where we can that although Firefox 32 fixed some security issues, Firefox 32.0.1 was not due to discovery of new vulnerabilities, but because Firefox 32 "failed" on computers with multiple graphics cards (one of those non-security major issues).

32.0.1 - Stability issues for computers with multiple graphics cards

32.0.1 - Mixed content icon may be incorrectly displayed instead of lock icon for SSL sites

32.0.1 - WebRTC: setRemoteDescription() silently fails if no success callback is specified

So, as an exception to the general advice, updating to Firefox 32.0.1 if you are running Firefox 32.0 is not a pressing issue unless you use multiple graphic cards (or using Android). But when 32.0.2 appears, updating to it may be. You must be very careful each time about what exactly changed if you want to keep running non-latest versions of your browser (and safe).

If you are dealing with a single computer, updating probably takes less time than figuring it out ☺ (and we should be grateful to the last generation of auto-updaters for making them so seamless)

4

Here is a link to Firefox's security update notes:

Security Advisories

You can see by the number of fixes, and especially those marked "critical," that by not updating you would invite significant risk.

4

Shortest answer, read the Firefox changelog for a release and witness why. You can find it @

https://www.mozilla.org/en-US/firefox/releases/

For all the specific releases. Just click on one of the release numbers.

1

All software has bugs. Updates help to resolve those bugs.

When it comes to browsers, bugs can mean that malware can infect your browser, or even your machine. Worst case? An attacker can learn your banking details and empty your account.

  • Could you give examples of what exactly could happen? How common are these security holes? – Thomas Sep 17 '14 at 18:10
  • 2
    When you visit a web page, it hosts malware somewhere on the page. Your browser downloads the content and processes it, but it exploits a bug in your browser. In the background, it installs a keylogger. Now everything you type is sent to an attacker. These holes are common. Raz has a nice list. – schroeder Sep 17 '14 at 18:14
0

When you visit a web page, it hosts malware somewhere on the page. Your browser downloads the content and processes it, exploits some code in your browser, giving it access to your computer. It installs a mail server and starts sending spam - thousands of messages every few minutes.

Didn't you notice your system has slowed down, and/or your hard drive is working hard?

You visit a web page, it hosts malware somewhere on the page. Your browser downloads the content and processes it, and this time it harvests all the contacts in your Address Book, also looking for usernames (ie, your email account username and more) and the word 'Password' in all your messages. If it finds a any, it sends it 'home'. Now someone can run one of the programs widely available that tries the found username and pw on dozens of sites.

You visit a web page, it hosts malware somewhere on the page. Your browser downloads the content and processes it, and this time it looks for credit card and banking info...

0

It's because of a category of vulnerabilities known as client-side vulnerabilities. Over the period of time, servers have got more secure, so cyber crooks, instead of focussing on servers these days, focus on client-side security bugs. When it comes to browsers, these bugs are mostly used after free bugs (specially in Internet Explorer which has changed recently thanks to incorporation of more protections against these bugs).

There is software known as "exploit kits" (for example, Blackhole, Sweet Orange, and Stuxnet) which have a multiple of client-side exploits ready to fire hosted on a website. Once you visit the website with your not updated browser (or Java :D), boom they have access to all your credentials.

  • 2
    Can you prove the exploitation of client-side vulns is a consequence of improvements in server security? Owning clients is profitable regardless of whether you can own servers, as they get you different types of data and capabilities as an attacker. E.g., CAPTCHA solvers, dynamic IP bots for DDoS, human profiles for targeted advertising, and so on. – Steve Dodier-Lazaro Sep 17 '14 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.