Microsoft Internet Explorer 8 Beta 2 will put a bull’s-eye on malicious sites courtesy of the new SmartScreen Filter.
The feature, revealed July 2, is an answer to the blacklisting features built into Firefox 3 and Opera 9.5, and builds on the Phishing Filter introduced in IE 7 with, among other things, anti-malware support and new heuristic detection capabilities to block known bad sites. Security has been a key battleground between Microsoft’s Internet Explorer, Mozilla’s Firefox and other browsers. In addition to blocking bad sites, the filter also protects users who click on a link leading to a download on a rogue site by interrupting the download with a warning, according to Microsoft.
When it comes to thwarting XSS (cross-site scripting), Microsoft has added a filter that uses a heuristics-based approach to sanitize injected scripts.
“The XSS Filter operates as an IE 8 component with visibility into all requests [and] responses flowing through the browser,” David Ross, a security software engineer at Microsoft, said in a blog post. “When the filter discovers likely XSS in a cross-site request, it identifies and neuters the attack if it is replayed in the server’s response. Users are not presented with questions they are unable to answer-IE simply blocks the malicious script from executing.”
The new version of the browser also includes DEP/NX Memory Protection, turned on by default in IE 8 for users of Windows Server 2008, Windows Vista Service Pack 1 and Windows XP SP3, as well as a feature called Per-Site ActiveX, which serves as a defense mechanism to help prevent malicious repurposing of ActiveX controls.
Other features have been added to help developers build safer mashups for IE 8, such as support for HTML5 cross-document messaging. IE 8 Beta 2 is slated to be released in August.