Firefox 4 slips out ahead of tomorrow's official release
By Donald Melanson posted Mar 21st 2011 5:20PM

The official launch day may still be tomorrow, but those not willing to wait can now grab the final version of Firefox 4 for Windows, Mac OS X or Linux straight from Mozilla's FTP server. That follows a last minute RC2 revision that was just released on Saturday, which has presumably been all but unchanged for the now final version. Hit up the appropriate link below to start downloading -- just try to act a little bit surprised if anyone tells you about it tomorrow.

Social-engineering attacks, like tricking a user into running a malicious program, are far more common than attacks on security vulnerabilities. Application Reputation in IE9 helps protect users from these socially engineered malware attacks. This post offers details about real-world attacks and how these protections work.

For context, recent studies show that despite the headlines that exploits of software vulnerabilities get, people browsing the Web are more likely to face a socially engineered attack.
.....

Through the SmartScreen Filter, IE has been effective at blocking socially engineered malware attacks and malicious downloads – IE blocks between 2 and 5 million attacks a day for IE8 and IE9 customers. Since the release of IE8, SmartScreen has blocked more than 1.5 billion attempted malware attacks. IE is still the only major production browser to offer this kind of protection from socially engineered malware. From our experience operating these services at scale, we have found that 1 out of every 14 programs downloaded is later confirmed as malware.

......

This new layer of protection is called SmartScreen Application Reputation. When it comes to program downloads, other browsers today either warn on every file or don’t warn at all. Neither of these approaches helps the user make a better decision. Application Reputation also addresses a limitation present in all block-based approaches that happens at the beginning of new attacks, before a Web site or program has been identified as malicious.


Let’s look at how the feature protected actual IE9 users from one particular attack. The figure shows the download traffic of a very large-scale malware attack (hundreds of thousands of downloads). Application Reputation warned IE9 users about this malicious program from the very moment it hit the Web at Hour 0:



Traditional block-based protection (URL-blocking as well as anti-virus) came in after Hour 11, well after the attack had passed its active period. The download warning within IE about the lack of an application reputation was the only defense that users had. 99% of IE9 users who clicked to download this malicious program chose to delete or not run the program from the Application Reputation unknown program warning


In this attack, IE9 Application Reputation interrupted the deception of the attack (which was otherwise very convincing) and most users were able to make a great decision on their own. This outcome is exactly why we built SmartScreen Application Reputation into IE9. 99% of users were able to avoid the infection.

From looking at IE9 usage data, starting from the IE9 beta, we see two main patterns:

Dramatic reduction in malware infections for IE9 users

Users are choosing to delete or not run malware 95% of the time from the new Application Reputation warnings
We estimate that Application Reputation will prevent more than 20 Million additional infections per month (on top of existing SmartScreen URL reputation blocks)
Streamlined experience that warns only when the risk is high

Because programs and publishers can now establish a reputation, 90% of program downloads no longer show browser security warnings when users have SmartScreen enabled
From our data, the typical user will only see 2 warnings per year
On any given day, clicking through the “unknown warning” carries a risk between 25% and 70% of malware infection

Because programs and publishers can now establish a reputation, 90% of program downloads no longer show browser security warnings when users have SmartScreen enabled