Microsoft Security Flaws Renew Calls For Alternative Web Browsers

A pair of virus attacks exploiting its vulnerabilities has led security experts to recommend that Web surfers consider such alternatives as Mozilla and Opera.

Continuing to use Internet Explorer is "like playing the lottery," said Johannes B. Ullrich, chief technology officer of the nonprofit SANS Internet Security Center.

The respected research center is among security groups recommending other browsers as long as a key vulnerability in IE remains unfixed, leaving it capable of running malicious code that's been hidden at a number of popular Web sites.

Microsoft issued software Friday that, while not fixing the vulnerability entirely, disables a hacker's ability to deliver malicious code with it. SANS announced no immediate change to its recommendation.

Last week, a computer virus designed to steal valuable information as Web users typed it into their computers --passwords and the like -- spread through a new technique that converted popular Web sites into virus transmitters.

And this week, researchers discovered another password-stealing program hidden behind pop-up ads.

Microsoft was still working to fix a lingering vulnerability from last week's virus, and while a repair for the flaw enabling this week's Trojan infection was issued in April, many users had yet to patch their systems.

IE is a frequent target for hacking because of its popularity; WebSideStory says 95 percent of surfers use it globally. The browser is closely integrated with Microsoft's Windows operating system and Outlook e-mail program, creating more room for programming error and making solutions more difficult.

Though many of IE's functions are not unique, IE tends to be more permissive in running code -- flexibility that helps Web developers create fancy features but allows hackers to more easily find weaknesses.

A major Windows XP upgrade, known as a service pack, is due out this summer and would plugs some holes in IE. Last week's outbreak would not have occurred had those software plugs been installed, said Gary Schare, a Microsoft security director.

Microsoft also is developing a specific fix for the new vulnerability, but Schare said testing takes time. He called it premature for independent security experts to recommend that people explore alternatives.

Even if those recommendations were heeded, it's highly unlikely Microsoft could be unseated as top dog in the browser business. After all, IE comes with Windows computers. The Justice Department, after initially suing to force Microsoft to uncouple the browser from its operating systems, later backed down.

Many users don't care enough or know how to find other browsers, most of which are free or ad-supported. Opera Software ASA, which offers the No. 3 browser for Windows, saw no significant change in downloads this week. Downloads of Mozilla doubled, but the increase is not nearly enough to significantly change its market share.

"It's not that consumers are so loyal to Microsoft, but more they are apathetic," said Geoff Johnston, an analyst with WebSideStory, which tracks browser usage. "With it, there really is a cost to switching."

Users who install alternatives will find that some Web sites simply won't work. Movielink says its online movies need technology specific to IE, and America Online shuns its own Mozilla-based Netscape browsers for new conferencing tools.

Browser-integrated toolbars from search leader Google Inc. and others are only available for Internet Explorer.

Many sites work on alternatives but display items incorrectly, often because developers fail to test on them.

"All they know is it looks good to them ... on their own browser, and their own browser is most probably Internet Explorer," said Jakob Nielsen, a Web design expert with Nielsen Norman Group.

Ken Godskind, vice president of marketing at the Internet monitoring firm AlertSite, uses the Mozilla browser partly because of security concerns, but he accepts having to run IE now and then.

"Rarely are you going to go someplace where you're going to avoid Microsoft technology," he said.

But sites have gotten better about designing for other browsers, said Porter Glendinning, an Internet consultant who promotes adherence to Web standards. Until recently, he said, banking applications rarely worked on anything else.

And leading Web application developers, including Opera, Apple Computer and Macromedia, are collaborating on better plug-in technology to rival Microsoft's.

Opera's Christen Krogh said users would get the same functionality no matter their browser.

Mark Rasch, chief security counsel for Solutionary, favors alternatives ``if for no reason other than to create heterogeneity, which dulls the impact of any single virus attack.

But alternatives can become targets, too, as more people use them, said Chris Kraft, senior security analyst at Sophos.

A better solution is to reconsider whether browsers ought to have evolved into Swiss Army knives of the Internet -- a development that can, and has, backfired on users.

These Web browsers have advanced over time to be extremely rich in terms of content, how they deliver content, Kraft said. "What's the compromise between a rich experience and creating a toolbox for the general malicious community?"

Copyright © 2004 The Associated Press. All rights reserved. The information contained in the AP News report may not be published, broadcast, rewritten or redistributed without the prior written authority of The Associated Press.