Application Security: seven Security suggestions for Microsoft IE9

Can Microsoft improve IE Security through the following seven suggestions?

Sandbox Technology

Microsoft can improve the security of IE9 by adopting sandbox technology (such as Google Chrome. IE9 has a similar "protection mode", but its original design is not for security. Said Aaron Portnoy, leader of TippingPoint security research team.

Non-process plug-in

"Running as many third-party non-process plug-ins as possible is of great benefit to IE Security ." "If a process plug-in is running, attackers can use known or unknown technologies to bypass an anti-attack technology called exploit mitigations. DEP and ASLR are examples of this technology ."

Memory Address randomization

By randomizing the memory addresses used by common features, attackers will need a lot of time to identify and reuse the vulnerability code, said Rick Moy, president of the NSS lab.

Redirect jump

"Drive-by downloads uses multiple redirection to confuse credibility systems (such as IE's SmartScreen and Google's SafeBrowsing) and brings users to a useless page, "Only one continuous redirect can greatly improve the credibility of the system," said Moy of the NSS lab."

Content Security Policy

With the content security policy, Microsoft can provide more protection for users and defend against cross-site scripting and Click jacking attacks. Mozilla has studied this feature in its Firefox browser.

Login plug-in

Moy indicates that he hopes that users can distinguish between plug-ins. "The combination of code hash/whitelist technology and reputation technology helps potential users understand who has compiled and packaged applications and what their records are ." He said.

Plug-in security API (a function)

"Browsers should play a leading role in preventing plug-ins from memory attacks, such as buffer overflow and heap injection," Moy said. "From this perspective, browsers should not provide direct access to memory, secure APIs should be provided, but there is still a long way to go in reducing attacks."