Google has been attacked by many biggie giants to which Google has responded in some way or the other. Yet again Google was needled, this time by an independent security testing lab, NSS Labs who awarded Microsoft’s Internet Explorer 9 with top marks for its socially engineered malware stoppage ability. Google like in every other case did hit back. The search engine giant said that the report was made after consideration of just 2% of malicious code which could be found over the net.
The stats were out through “Trends in Circumventing Web-Malware Detection,” which is a recent report from Google. The data compiled here was a result of four years of effort which was collected to come up with its Safe Browsing initiative. Google claims that its Safe Browsing API does provide a list which gets blocked. This list is a collection of those URLs which are known-bad or suspected ones, linking to either phishing or malware attacks. For the stats, it said that the results here has been saving more than 400 million people on a daily basis with almost 3 million malware warnings. It even added that this compilation has been used by Chrome, Safari and Firefox.
This report from Google was an answer to NSS Labs report wherein five browsers were tested for socially engineered malware stoppage ability. It however concluded reporting that IE9 has an almost cent percent threat blocking ability, quickly and successfully. IE9 was followed by Chrome who was rated with 13.2%. Firefox and Safari were at par and had 7.6%. With 6.1%, Opera was at the last rank in the report.
There was an acknowledgement from Google researchers for the socially engineered malware, wherein they said that these malwares are dangerous and are on the rise in terms of volume. Explaining this malware problem, they said that a malware distribution mechanism is a trick which works by tricking a user to install this malware. Usually the malware is faked as a browser plug-in or an antivirus product. The acknowledgement came from Niels Provos and Lucas Ballard who have co-authored Google report. They are working in the Google Security Team and had blogged in a post. In the blog post, they even said that the growth of these socially engineered malware should be kept in mind which was not noted in NSS Labs report.
It was said that the report has its basis basically on drive-by downloads as it was considered as the most common attack vendor. In case of drive-by downloads, there was an installation of malware by the malicious pages which is done after the vulnerabilities in a plug-in or browser is exploited. It was added that the latest vulnerabilities are usually attacked by the attackers which is easier for them to attack without being detected. However, it was quoted by the researchers that “a prominent exception is the MDAC vulnerability which is present in most exploit kits.”
NSS Labs might have predicted this criticism from the search engine giant and had noted in their report that Google needs to add protection to Chrome which would help them against socially engineered malware.