Tag Archives: Chrome browser security
thechromesource Daily: Links for 2/25/11
Posted on 25. Feb, 2011 by Daniel Cawrey. 
0 Comments
How does the Chrome browser acting more like an OS affect security concerns for users?
Here is a guide to 7 Chrome annoyances and how to fix them.
The Beta Channel has been updated with stability fixes.
Rumors of a Samsung Google TV are cropping up again; the fact that it doesn’t use an Intel chip seems to be a sticking point.
Google is declaring war on content farms with its latest update to their search algorithm.
Capsicum Offers Better Chrome Security, More Robust Development
Posted on 16. Aug, 2010 by Daniel Cawrey. 0 Comments
At the USENIX security conference held in Washington, DC last week, a group of researchers presented a new sandbox framework for lightweight operating systems called Capsicum. Developed by the University of Cambridge with a grant from Google, Capsicum will help to better protect Unix-derived systems as well as Chrome browser and Chrome OS.
Essentially, what this provides is a better framework for developers because they don’t have to spend so much time with security delegation in their own web applications.
“In order to protect user data from malicious JavaScript, Flash, etc., the Chromium web browser is decomposed into several OS processes. Some of these processes handle content from untrusted sources, but their access to user data is restricted using DAC or MAC mechanism (the process is sandboxed). These mechanisms vary by platform, but all require a significant amount of programmer effort. Our analysis shows significant vulnerabilities in all of these sandbox models due to inherent flaws or incorrect use”, they write in their paper.
“Privilege separation is a pattern that has been adopted for applications such as OpenSSH, Apple’s SecurityServer, and, more recently, Google’s Chromium web browser. Compartmentalisation is enforced using various access control techniques, but only with significant programmer effort.”
“Capsicum addresses these problems by introducing new (and complementary) security primitives to support compartmentalisation: capability mode and capabilities”.
The UNIX-compliant FreeBSD 9 will integrate Capsicum when it is released. Capsicum features are even expected to hit the Chromium browser at some point for testing; at USENIX the researchers showed off a version of Chromium with the framework installed.
Seeing that the research was supported by Google and will be included into operating systems, it’s safe to say that Capsicum will also be a part of Chrome, further reducing the amount of coding developers have to do in order to allow webapps to be secure. Instead, Chrome will be able to handle all of the different requests that come to it via the web, and act accordingly.
The complete Capsicum paper is located here. Cambridge also has a site devoted to the topic.
Google Ups the Reward For Chromium Security Fixes
Posted on 20. Jul, 2010 by Daniel Cawrey. 2 Comments
For the past six months, those who have been able to find a flaw in Chromium were awarded cash prizes for doing so. Now that this program has been ongoing for some time, the Chromium team has decided increase the amount given out for the most critical of flaws found, moving from $1,337 to $3,133.70. Most awards will remain at the $500 level, depending on the published severity guidelines.
The Chromium project has lead to Chrome being one of the most secure browsers on the market. The annual conference where researchers try to compromise browsers and other computer platforms, Pwn2Own, had no takers for Chrome browser this year. It could be because Chrome is still the newcomer on the market. Nevertheless all of the other major browsers ended up getting hacked at Pwn2Own.
It’s unknown whether or not the decision from the Chromium team relates to Mozilla recently raising their Security Bug Bounty Program award up from $500 to $3,000. With that being said, moving the amount just above Mozilla’s while keeping the cachet of the original award may mean something when thinking about Firefox versus Chrome: actions speak louder than words.
Reports of Trojan as a Chrome Extension Emerge
Posted on 20. Apr, 2010 by Daniel Cawrey. 1 Comments
There is a reason why Google has set up their own extension site, where they make sure that they do a security review of each “plug-in” that is submitted for their browser to check potential security problems. As more people use Chrome browser, the threat of malicious software increases. Think of the problems that Internet Explorer has had to deal with in the past. Because of those headaches, Google has tried really hard to start initiatives to thwart security issues in their own browser ecosystem before it gets too big.
The easiest way to obtain access to Chrome? One is through Flash, but Google has decided to add that as an integrated feature. Another way is through extensions. That’s why it’s a big deal when the Romanian antivirus company BitDefender reports that an extension now exists that has intentions on exploiting a user’s system, typical of a trojan virus.
The Malware City blog by BitDefender describes the situation whereby a user gets an email to download a Chrome extension that has not-so-good intentions. The user is led to a site that looks the same as the official Google extension site, but the URL is not the same, something akin to phishing. They also talk about the fact that some of the more savvy users will know that an extension will come as an install file with a .crx extension, as opposed to this malicious extension that has an .exe extension.
Herein lays the problem with extensions. Everyone must realize that the only place to install an extension is from Google’s official extension site. At the beginning of 2010, McAfee released a report that reiterated this point: the problem is that now the Chrome platform is reaching a stage of major adoption – starting with the browser. Fortunately Google has set up an extension site where we know we can get added functions to our browser without the worry that they will totally screw up our system.
