Microsoft IE 7.0 Tops List of Antiphishing Tools

Internet Explorer 7.0’s antiphishing security is superior to any of its rivals, the first significant study to rate this element of browser security has concluded.

The tests by U.S. Microsoft consultants 3Sharp pitted a range of browser plug-ins for antiphishing security against the phishing filter, in beta three of IE 7.0, finding the Microsoft technology to be the most effective.

Each of seven filters—from eBay, Earthlink, GeoTrust, Google, Netcraft, McAfee Site Advisor and Netscape—were tested on 100 known phishing sites, and 500 legitimate sites, to gauge how well the different systems could distinguish friend from foe. Each was then rated on a scale from zero (defined as no antiphishing capability) to a maximum score of 200.

The final “accuracy” score took into account both detection rates as well as the number of false positives. The results found Microsoft’s browser to lead the pack in most aspects of detection.

IE 7.0 ended up with a score of 172, only four ahead Netcraft’s toolbar, which scored 168. Google/Firefox was a distant third with 106, eBay fourth at 92, Earthlink ScamBlocker fifth with 76, GeoTrust Trustwatch sixth with 67, Netscape 8.1 seventh with 56, and McAfee SiteAdvisor coming in last place with an almost useless 3.

Breaking down the scores, GeoTrust had the highest catch rate, 99 percent, but was marked down heavily because the software only warned users, and did not automatically block access to problem sites as did its rivals.

According to the report’s authors, this is deficient because it gives users too much discretion. GeoTrust also had a high rate of false positives, mislabeling a third of legitimate sites as suspect. IE 7.0’s catch rate was second at 89 percent, with Netcraft’s third at 84 percent.

Google’s Toolbar was the only one of the technologies to integrate with Mozilla’s Firefox, and it proved to be a modest performer. Equally, this used version 1.5’s “Safe Browsing” plug-in, which will be superseded by integrated antiphishing in the forthcoming version 2.0 of the browser.

The excellent showing accorded to Microsoft’s browser does need to be put into context—the study was commissioned by Microsoft.

Nevertheless, 3Sharp comes up with the interesting and valid observation that antiphishing systems built on databases of problem and legitimate sites need to complement this by employing heuristics. Phishing evolves rapidly, so databases built from honeypot data quickly date.

The full report, Gone Phishing: Evaluating Antiphishing Tools for Windows, can be downloaded here.

-John E. Dunn, Techworld.com (London)

Related Links:

• Microsoft Releases Near-Complete IE7 Browser

• Symantec Spotlights Mac Phishing Threat

• Microsoft Nets Phishing Filter Technology

This article is posted on our Microsoft Informer page. For more news on the Redmond, Wash.-based powerhouse, keep checking in.

Check out our CIO News Alerts and Tech Informer pages for more updated news coverage.