Over the years web browser have become much more secure. All modern browsers are now pretty well protected against most types of attacks and fixes are released promptly after a new vulnerability is discovered. Browser vendors like Google even offers cash prizes to those who reports security holes in their Chrome browser.
So where do we find most of the threats against browser users today? Anyone remember the Flashback trojan which infected over 600,000 Macs? How did it infect them? The Java plug-in was called from a web page and loaded a special Java applet that exploited a bug, gaining access to the system. And how is Java connected to your browser? It’s runs as a so plug-in which most often is installed separately but with access to the browser itself through a plugin API. Nothing the browser vendor does can circumvent the fact that this access to the user can represent a threat, and a threat that can only be identified and fixed by whoever wrote and published the plug-in or extension.
Now picture a browser with multiple plug-ins – Java, Flash, PDF reader, QuickTime, Silverlight and a bunch of extensions you can easily pick up and install, and you’ll see just how much plug-ins and extensions increase your so called attack surface. While browser vendors are under heavy scrutiny to write secure code, plug-in and extension developers do not seem to be put through the motions in the same way, and many of them have mediocre security records (to put it nicely).
The great thing about compromising a plug-in or extension is that you can target multiple platforms in one go. Compromise Flash and you have a barn door open into a bunch of browsers and the platform they run on, and you can wreck a lot of havoc before it’s discovered, *if* it is discovered that is.
Plug-ins and extensions lack behind browsers as far as security goes and their often frequent automatic updates adds to the threat they represent. Some of these buggers are updated as often as once a month making it really difficult to keep track of development and security implications. In most cases frequent updates is a good thing making sure bugs are fixed and security is increased, but with plug-ins and extensions it also complicates matters and make it hard for the user to know where they are at as far as security goes. Most people think that as long as their plug-ins and extensions are installed through a familiar trusted vendor like Google or Mozilla they will be safe and do not pay much attention to the security risk. This is not the case.
You don’t have to look very long and hard to find studies about how big a problem browser plug-ins and extensions are. A study from 2011 study found that 94% of Adobe Shockwave, 70% of Java, 65% of Adobe Reader, and 42% of QuickTime installations in the enterprise were out-of-date. Although very frequent updates is a threat in itself keeping them around for too long is even worse. You simply can’t win.
Some will claim that browser plug-ins and even extensions should be on their way out. Plug-ins are still often necessary (Flash and Adobe) but companies like Google and Mozilla are working on solutions that would make many of them obsolete. The old plug-in API’s are also being phased out. As for extensions they are still very much alive and kicking and being put out there by anyone who can put together some pieces of code and think they have found a need they would like to fulfill. There are also those who would like to see a browser that does it all without needing to expose the user to the threat plug-ins and extensions represent. Personally I would welcome such a browser, but for the extension addicts it may be a step back, but one worth taking if you care about your security and privacy.
