Microsoft trumpets security additons in upcoming IE8

Slates anti-malware, cross-site scripting defenses in August's IE8 Beta 2

Microsoft Wednesday outlined new security features it will add to Internet Explorer (IE) next month, including anti-malware protection to match tools similar to those offer by its rivals and a filter the company said would block most cross-site scripting attacks.

Internet Explorer 8 Beta 2, which Microsoft has slated for release sometime in August, will include two new security tools, said Austin Wilson, the director of Windows client product management.

One, dubbed "SmartScreen Filter" by Microsoft, adds malware blocking to the anti-phishing protection already embedded in IE7. The new feature, which will resemble the defenses already used by rival browsers Firefox 3.0 and Opera 9.5, will warn users when they're about to visit a site known or suspected of spreading malicious code and then block any download from that site.

Unlike Mozilla's Firefox, however, which retrieves a blacklist several times daily, then stores it locally to compare against URLs, IE8 will dynamically determine whether the site is potentially dangerous by pinging remote servers each time a user tries to reach a page.

Microsoft will use multiple third-party sources to compose the blacklists for both phishing and malware-hosting sites, said Wilson, and will also draw on data gathered by Windows Defender, the company's free anti-spyware tool. Wilson would not disclose the third-party information providers, however.

"We get the data feeds, and update our lists multiple times a day," he said. "And IE8 makes the call to the URL reputation service servers, and if it's a phishing or malware site, the browser navigates away from the page and displays a warning."

He denied that the process would have a noticeable impact on IE8's performance. "Our choice was to make sure that the user has the most recent data possible," he said. "We do an asynchronous call, so the page rendering takes place while the call is made to the reputation servers."

Also to debut next month in IE8 Beta 2 is an integrated filter that Microsoft said would prevent most cross-site scripting attacks. "Today, the end user can be doing all the right things, checking the URL to make sure it's legitimate, only going to trusted sites, but because of vulnerabilities on the Web server side, they can still be compromised," said Wilson, referring to cross-site scripting attacks, which are most commonly used by identity thieves and have been on the upswing.

"When IE8 sees a cross-site scripting attack, it stops that script from being reflected to the server, and stops the attack at the client," Wilson added.

IE8 will have the cross-site scripting filter enabled by default, and will not need to deal with pop-up warnings or other dialogs, added David Ross, a security software engineer at Microsoft. "When the filter discovers likely XSS in a cross-site request, it identifies and neuters the attack if it is replayed in the server's response," said Ross in a technical posting to the IE team's blog today.

Cross-site scripting is sometimes referred to by the abbreviation XSS.

Ross, however, acknowledged that IE8's cross-site scripting filter won't completely protect users. "The XSS [cross-site scripting] Filter defends against the most common XSS attacks but it is not, and will never be, an XSS panacea," Ross said.

John Pescatore, a Gartner research fellow and analyst, applauded Microsoft's plans. "It's good to see these kinds of things built into the browser," said Pescatore, adding that the two new features take different approaches against security problems on the Web.

The SmartScreen Filter, Pescatore argued, is the "more reactive part" of the IE8 security upgrade. "You really have to protect the browser user against himself," he said, and one way is to block users from straying into dangerous places.

The concept behind the cross-site scripting filter, however, and IE8's planned support for protocols designed to make inter-site communications more secure, is similar to the tools Microsoft and Hewlett-Packard Co. unveiled last week to help Web site developers and administrators secure their sites against SQL injection attacks. "You can't build everything into the browser," Pescatore said. "The browser has to be the thing that tries to protect the user, but it can't make up for all the Web security vulnerabilities."

IE8 Beta 2 will ship next month, Microsoft's Wilson confirmed today, although he declined to set a more specific date.

Beta 1, which launched four months ago, can be downloaded from Microsoft's Web site.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Show Comments


James Cook University - Master of Data Science Online Course

Learn more >


Sansai 6-Outlet Power Board + 4-Port USB Charging Station

Learn more >



Back To Business Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?