Insecurity Iceberg

A series of papers and publications exploiting the data of Google web server logs to measure the security/insecurity of global web browser population and the human dynamics behind security updates.

The Web browser Insecurity Iceberg represents the number of Internet users at risk because they don’t use the latest most secure Web browsers and plug-ins to surf the Web. This paper has quantified the visible portion of the Insecurity Iceberg (above the waterline) using passive evaluation techniques - which amounted to more than 600 million users at risk not running the latest most secure Web browser version in June 2008.

Papers & Whitepapers

4 Papers / Whitepapers

Paper (EN)

Quantification of deviations from rationality with heavy-tails in human dynamics

We study the persistence of the use of outdated Web browsers (Firefox, Opera, Chrome and Safari) after users have been prompted to perform an update.

Paper (EN)

Why Silent Updates Boost Security

Security updates don’t benefit the end user of software if the update mechanism and strategy is not effective. In this paper we analyze the effectiveness of different Web browsers update mechanisms based on massivle Google web log data.

Paper (EN)

Firefox (In)Security Update Dynamics Exposed

How (in)secure is your Internet browser? You never know. One way to know more is to look at how frequently it gets updated. With data from Google's search logs we analyze the time series of update installs to compare the security of browsers.

Paper (EN)

Understanding The Web Browser Threat

Access to Google’s global Web server logs enabled us to provide the first in-depth global perspective on the state of insecurity for Web browser technologies. Understanding the nature of the threats against Web browser and their plug-in technologies is important for continued Internet usage.

Talks & Coverage

4 Items

The Register (EN)

Easy updates best for browser patching

TheRegister | Easy update mechanisms have a far greater effect on browser patching than perceived threats or other factors, according to a new study by Google and Swiss academics.

Schneier On Security (EN)

Browser Insecurity

Schneier on Security | This excellent paper measures insecurity in the global population of browsers, using Google's web server logs

The Register (EN)

Built-in browser expiry proposed to fight botnet menace

TheRegister | Built-in browser expiry proposed to fight botnet menace: 45% fail to update surfing software.

Press (EN)

Forty Percent of Web Users Surf With Unsafe Browsers

WashingtonPost | The report concluded that Firefox users were more likely to be using the latest version because Mozilla's patch process is the quickest and most painless (no arguments there).

PUBLICATIONS

Insecurity Iceberg

Analysis of the worldwide vulnerable Web browser population based on non-personally identifiable data accumulated by Google’s search- and web-server logs from around the globe between January 2007 and June 2008.

Papers & Whitepapers

Quantification of deviations from rationality with heavy-tails in human dynamics

Why Silent Updates Boost Security

Firefox (In)Security Update Dynamics Exposed

Understanding The Web Browser Threat

Talks & Coverage

Easy updates best for browser patching

Browser Insecurity

Built-in browser expiry proposed to fight botnet menace

Forty Percent of Web Users Surf With Unsafe Browsers