Slashdot Mirror
MS Finds Security Flaw In Google Chrome Frame
Christmas Shopping writes with this excerpt from Kaspersky Labs' threatpost: "Back in September, when Google launched the Google Chome Frame plug-in for Internet Explorer users, Microsoft immediately warned that the move would increase the attack surface and make IE users less secure. Now comes word that a security researcher in the Microsoft Vulnerability Research (MSVR) has discovered a 'high risk' security vulnerability that could allow an attacker to bypass cross-origin protections."
"Google has hurried out a patch," he adds.
MS Finds Security Flaw In Google Chrome Frame
Timothy, you owe me a new Transformers t-shirt. I just spat coffee all over myself.
I am willing to bet good money that Microsoft formed a team responsible for finding bugs in Google frame just to discredit them.
It may be 7 digits, but at least it's a semiprime
And not wait another week until it's patch-Tuesday.
Not a good day for google...first a OS that can only run web apps...completely rejected by the community...& now this...
MS has security researchers ?
Don't they have anything better to do than nitpick with an addon that 0.001% of the user base has ?
Come on !
The Cloud - because you don't care if your apps and data are up in the air.
Internet Explorer less secure? This is really possible?
Religion: The greatest weapon of mass destruction of all time
Anything that helps this product improve ultimately helps that adoption of HTML5. Thank you, Microsoft! ;)
Now, can you please fix the sanitiser in the IE8 output encoding?
So quick to point out mistakes in others software, but so slow to fix your own.
Finally had enough. Come see us over at https://soylentnews.org/
Google makes IE less secure, users switch to real Chrome, google (somehow) profits!
... the ``glass house'' security team. Stones complimentary from the house.
they can see the wood for the trees
who didn't see this coming? :)
Does MSIE suffer from this exploit?
The Chrome Frame was never a good idea for security. By making it opt-in for sites, like an other plugin, it dramatically increased the attack surface of IE. Now any attacker can exploit holes in IE, holes in the frame, or holes coming from the interactions between the two. If you want the features of the Chrome Frame in a more secure package, use Chrome.
I am TheRaven on Soylent News
Not only does this unholy merge of browsers increase the surface area for attack (though the idea of someone from Microsoft complaining about that is highly ironic), but like other Google software it brings in the Google updater.
For example, FTA: "All users should be updated automatically,"
Google updater allows a web page to push an update on you without any notification. I don't know what the security restrictions on that are, but I can't see what advantage that has over providing a separate update program that would justify the risks.
Google seems to be in the same state of denial about secure design that Microsoft was in in 1997. Let's hope they catch on... Microsoft really never has recovered from that era.
Once we end all of this open standards silliness, and get you to do your internet business with safe, secure ActiveX and .Net, security woes will be a thing of the past!
of course competitors software gets more scrutiny than their own... it was their reverse engineering team (later to be dubbed MSVR) that noticed a bug when they were ripping it apart.....
We have early word that the security vulnerability goes by the name "Internet Explorer". Details are thin at this time, but we'll have more as the story develops. Janet, back to you in the studio.
So Microsoft found a security problem in another company's software? Damn... maybe 2012 *is* real! The end is nigh!
Scientia est Potentia
Microsoft didn't make any noise about this at all. The only reason you know MS discovered it was because google credited them in the update. So what exactly would shutting up do? Would you prefer them not to have told google at all perhaps?
The search technology company has shipped a new version of the Google Chrome Frame (version 4.0.245.1) with a patch for the vulnerability.
Case closed.
Makes you wish IE flaws were so short-lived.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
"...a security researcher in the Microsoft Vulnerability Research"
Well at least they realise that Chrome is a vulnerability to Microsoft. Sadly for them, I doubt this announcement will stop the profit leak.
about removing the log from your own eye before removing the mote from your neighbours eye.
Why can't vendors implement their own Patch Tuesdays? That is, Microsoft would release patches any time, and large vendors would simply allow them to accrue until their internal "Patch Tuesday" came around, at which time they'd test and apply the patches.
The vulnerability that the patch fixes is often disclosed along with the patch. So by the time the vulnerability becomes public, the script kiddies are likely already exploiting the vulnerability against targets with their own patch schedules.
that MS cannot find bugs in their products if they spend all the time looking for vulnerabilities in competitors products.
You can tell WSUS to queue up and wait for approval before rolling any patches out -- the rest of us can get our patches when they're ready.
body massage!
What's "chome"? "Back in September, when Google launched the Google Chome Frame plug-in for Internet Explorer users..."
http://threatpost.com/en_us/blogs/microsoft-finds-security-flaw-google-chrome-frame-111909
original post
I wonder how much time & money they invested in finding a google bug than their own software?
My guess is more than the entire budget allowed for IE6.
... Microsoft security researcher confirms advantages of open source transparency
Perhaps MS should be more concerned about their own protocols.
"Most secure Os ever;
What ever your firewall is set to, you can get remotly smashed via IE or even via some broadcasting nbns tricks (no user interaction)
How funny."
http://g-laurent.blogspot.com/2009/11/windows-7-server-2008r2-remote-kernel.html
More likely, someone at a management meeting said "What does this mean to us?" and no one had an answer, so someone with that responsibility said "I'll form a team to go look at it." He got together with his highly paid coworkers over a 3 hour power lunch with martinis and found someone who wouldn't blink during the "I don't have funding or responsibility in this area" game, and assigned the investigation to them.
This person asked his team to conduct a technical review of the implementation, and in the process the team found a potential security risk.
That sounds more like big business operation to me, from a fortune <15 employee. Microsoft was #44 in 2008, so probably operates like big business.
Less likely is "Let's spend money on highly paid technical folks looking for ways to make a headline people will forget in a week." Possible, but less likely.
I'm sure more in Chrome will appear in upcoming months. But MS is hardly blameless in criticising another another company's security.
In the long runt his constant bitching will make both products stronger.
And this story once again proves that MS could improve its public image instantly with one simple statement. SILENCE. MS, really, hire a lawyer as your public relations advisor. A good lawyer who always tells his clients to "SHUT THE FUCK UP".
I had just about forgotten about all the bugs in MS software... and this made me remember the entire long list of highly exploitable bugs unpatched for months or even years. Great job.
Of course, if you read TFA, you'd see that it was Google who credited Microsoft with finding the issue. I saw nothing that indicates MS publicized or announced the issue in any way.
In Soviet Russia, Microsoft finds your bugs!
Seems to me that some computer desktops are starting to be a corporate warzone.
In other words: *All your desktop are belong to us*
Absolutely true. As a web-developer, let me clue you (the grandparent) in... ASP is a server side programming language used to create HTML based web pages on the fly. It is exactly the same kind of technology as PHP... it's on the server and, and the client has no knowledge of it. All it gets is HTML, and it doesn't care whether it was static or created by PHP or ASP on the fly.
And just to add to the chorus, I have viewed many a webpage that was generated by ASP using firefox.
Beware of bugs in the above code; I have only proved it correct, not tried it.
MSVR is dedicated to finding security issues in THIRD PARTY systems that are in common use today in a bid to improve the overall effective security of the windows platform.
The reason should be pretty obvious.. Whatever the source of the expliot its ALWAYS Microsofts fault even if the expliot leverages a defect in third party software not written by MS.
Whenever windows crashes its ALWAYS Microsofts fault when in reality anyone whos looked at the data knows that crashes come from poor quality of driver software MS did not write and hardware issues such as bad memory, flaky power/PSUs and poor HW design (glitching..etc)
If you look at the general quality space MS has launched a number of initiatives over the years aimed at improving third party code quality and problem detection. Most visibly the WHQL program and online crash analysis.
Now is MS going after google chrome because the two companies don't get along? .. thats quite possible. Whatever the motive there is no excuse for any company to be releasing code with security vulnerabilities.
How did MS communicate the bug to Google? .vs. patch
race.
Were they polite and inform Google so that the issue could be addressed in a timely update or was it communicated in a public way enabling hackers to race google in an exploit
Truth is stranger than fiction, but it is because Fiction is obliged to stick to possibilities; Truth isn't. Mark Twain.