No more browser exploits?

Jun 25, 2007 08:40 GMT  ·  By

Internet browsers are one of the main traditional vectors of attack for the Windows platform. And of course that due to the prevalence of Internet Explorer, as it is intimately connected with Windows, the browser is also one of the principal avenues of attack for the operating system. This status quo has extended over time to encompass IE's rival solution from the Mozilla Foundation, Firefox. Apple's Safari availability on Windows Vista and Windows XP, and the vulnerability hunt which ensued, came to further prove the risk associated with the browsers.

This is why Symantec has revealed the introduction of a new technology code-named Canary, designed to bulletproof the browsers by closing down the vulnerability window. Although Microsoft has gone to great lengths to add extensive security mitigations to Internet Explorer 7 and Windows Vista, neither IE7 nor the operating system are foolproof or perfect. Vulnerabilities will continue to impact both applications and here is where Canary will kick in.

Typically, between the moment when a vulnerability is disclosed and when the vendor manages to produce a security patch, the users face the maximum level of risk. Canary will shut down the attack window for Internet Explorer until Microsoft will have updates in place. The new security technology from the Cupertino based company will be an integer part of Norton Internet Security 2008, and will safeguard IE.

Canary will work in parallel with the browser making use of the known Internet Explorer vulnerabilities. In this context, Symantec will be able to answer IE vulnerabilities faster than Microsoft, and almost concomitantly with the threat environment. Armed with the IE vulnerability signatures, Canary will block exploits long before Microsoft will update the browser. Symantec revealed that it is currently focusing exclusively on Internet Explorer, but that it will also provide support for Firefox and Safari in the future. Codename Canary is scheduled for availability in August or September concomitantly with Norton Antivirus 2008, Norton Internet Security 2008, and Norton 360 2.0.