Linked by fran on Mon 6th Dec 2010 23:54 UTC
Privacy, Security, Encryption "As browser-based exploits and specifically JavaScript malware have shouldered their way to the top of the list of threats, browser vendors have been scrambling to find effective defenses to protect users. Few have been forthcoming, but Microsoft Research has developed a new tool called Zozzle that can be deployed in the browser and can detect JavaScript-based malware at a very high effectiveness rate."
Order by: Score:
Comment by fran
by fran on Tue 7th Dec 2010 12:00 UTC
fran
Member since:
2010-08-06

Whats the chance we'll be seeing this plugin on other browers?

There's also a Firefox a plugin called No-Script.
But some websites need javascript to function correctly.

Reply Score: 1

Nice effort but
by vodoomoth on Tue 7th Dec 2010 13:34 UTC
vodoomoth
Member since:
2010-03-30

I started pondering over the true interest of their work when I saw this:


Zozzle is designed to perform static analysis of JavaScript code on a given site and quickly determine whether the code is malicious and includes an exploit. In order to be effective, the tool must be trained to recognize the elements that are common to malicious JavaScript, and the researchers behind it stress that it works best on de-obfuscated code

Seems like a lost battle, just like it is as to the desktop virus battle.

Reply Score: 2

"A fraction of 1%"
by Almafeta on Tue 7th Dec 2010 18:12 UTC
Almafeta
Member since:
2007-02-22

In the paper linked to in the article above, Microsoft Research claims a false positive rate at "a fraction of 1%".

Unfortunately, without knowing exactly what fraction of 1% they're talking about, we won't know whether the average user sees a false positive every few minutes, every few hours, or every few days...

Reply Score: 2