Safari's Security Reputation Takes a Beating

CIO —

Apple's Safari browser has taken some shots lately over its security capabilities compared to those of other popular browsers—but this doesn't mean Safari is a sieve.

Last week, Charlie Miller, former winner at the PWN2OWN hacking contest, told our sister publication Computerworld that Safari will probably be the first to fall at this year's event. Miller won $10,000 for breaking into an Apple laptop through Safari in just a few minutes last year. Miller cites Safari's user-friendly controls, such as handling all kinds of file formats, as opportunities for bugs to get into the system.

[Safari 4 beta roared out of the gate last week but still has a long way to go in the enterprise, CIO reports. | Find out everything you ever wanted to know about browser security for Safari, Internet Explorer, Firefox, Opera and Chrome.]

Safari also finished last among other popular browsers (Internet Explorer, Firefox, Chrome and Opera) in a recent side-by-side security comparison conducted by lab testers at our sister publication InfoWorld. While Safari had the best anti-phishing filtering and pop-up blocking and does a good job at blocking unwanted cookies, it doesn't have things like security zones and the ability to turn off add-ons.

"In general, Apple does not have a great track record in the security of its code, and Safari follows that tradition," says Gartner's John Pescatore. "What I look at most for Gartner clients is the enterprise-security features and capabilities, and that is where Apple is well behind Mozilla and Microsoft."

But don't let fear cause you to abandon Safari. The vast majority of security breaches are caused, coincidently, by you. End users continue to fall for the fake anti-virus scam—"you've been infected; download this anti-virus program"—or download something from an unfamiliar browser. And no browser can protect against such folly.

Technically speaking, the most secure browser is Internet Explorer even though it's the only browser that supports ActiveX, which is a way malicious exploits get into a system . Yet Internet Explorer is the most hacked browser in the world. That's because hackers target computers for cash, and so it makes little sense to go after Safari given its tiny market share. In a recent Forrester survey of 50,000 enterprise users, Internet Explorer boasted 78 percent market share compared to Safari's paltry 1.4 percent.

"Safari users still benefit a good deal from security by obscurity," Pescatore says. "However, that should never be the main strategy. Safari users should make sure they push out the patches as quickly as possible, and have strong web security gateway approaches to limit the exposure."