Slashdot Mirror
Microsoft Chastises Google Over Chrome Security (pcmag.com)
An anonymous reader quotes PCMag:
In a Wednesday blog post, Redmond examined Google's browser security and took the opportunity to throw some shade at Chrome's security philosophy, while also touting the benefits of its own Edge browser. The post, written by Microsoft security team member Jordan Rabet, noted that Google's Chrome browser uses "sandboxing" and isolation techniques designed to contain any malicious code. Nevertheless, Microsoft still managed to find a security hole in Chrome that could be used to execute malicious code on the browser.
The bug involved a Javascript engine in Chrome. Microsoft notified Google about the problem, which was patched last month. The company even received a $7,500 reward for finding the flaw. However, Microsoft made sure to point out that its own Edge browser was protected from the same kind of security threat. It also criticized Google for the way it handled the patching process. Prior to the patch's official rollout, the source code for the fix was made public on GitHub, a software collaboration site that hosts computer code. That meant attentive hackers could have learned about the vulnerability before the patch was pushed out to customers, Microsoft claimed. "In this specific case, the stable channel of Chrome remained vulnerable for nearly a month," the blog post said. "That is more than enough time for an attacker to exploit it."
In the past Google has also disclosed vulnerabilities found in Microsoft products -- including Edge.
The bug involved a Javascript engine in Chrome. Microsoft notified Google about the problem, which was patched last month. The company even received a $7,500 reward for finding the flaw. However, Microsoft made sure to point out that its own Edge browser was protected from the same kind of security threat. It also criticized Google for the way it handled the patching process. Prior to the patch's official rollout, the source code for the fix was made public on GitHub, a software collaboration site that hosts computer code. That meant attentive hackers could have learned about the vulnerability before the patch was pushed out to customers, Microsoft claimed. "In this specific case, the stable channel of Chrome remained vulnerable for nearly a month," the blog post said. "That is more than enough time for an attacker to exploit it."
In the past Google has also disclosed vulnerabilities found in Microsoft products -- including Edge.
Do we point out Microsoft's long and illustrious history of ignoring critical security flaws now or...
Do we just point out Chrome isn't crashing computers with their security updates, thus training their users to turn off automatic updates?
I know, I know, its not the same thing exactly. But you know what they say about people in glass houses.
Good has some really good programmers, and so does Microsoft. In the past they were even more impressive.
But both of them are now process driven companies, primarily focused on not overturning the boat, and the result is code that follows process. As long as process is followed, you don't have to worry about whether you did a good job or not. Just go home at the end of the day. That is the mentality of the vast majority of mediocre programmers at both companies.
"First they came for the slanderers and i said nothing."
Bugs happen. What has me worried is a month long waiting time between security fix in public facing repository and release. This pretty much asks for exploitation even by not very skilled "hackers" as interested parties have lots of time to prepare viable exploit based on provided regression tests.
I don't know of any other company that has a monthly release cycle for security updates, even for zero day bugs! Google you are evil, you should be like Micros... oh.
...Trying to outdo each other at finding browser vulnerabilities. Outcome : both browser become more secure.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
I mean.. seriously?
I don't read AC
Well this was covered recently
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
IE 6 was made 17 years ago.
Disclaimer I am using Chrome so I am not drinking the coolaid.
MS changed to being secure in 2004 with the famous Bill Gates memo. IE 8 matched Chrome 1.0 with kernel level sandboxing in %appdata/lowrights and per threading process since 2009. Firefox just matched IE 8's security this year which is why I dumped it for Chrome in 2011 after the 4.0 fiasco.
IE 9 started the change to standards with hardware acceleration and IE 11/Edge are fully 100% W3C compliant. Infact I think IE 10 is W3C compliant too and no longer sucked but was a bit behind Chrome and Firefox at the time.
Anyway I welcome the rapid improvement to security and standards compliance for both. Where Edge sucks is it is more of a mobile browser than a desktop and had issues crashing during the initial Windows 10 build 204100 release 2015. But that is my take.
http://saveie6.com/
In a professional setting, updates are tested on a test server to make sure they don't break anything before they are applied to production servers. And the moment they are applied is planned carefully. Auto update is irrelevant there, what is relevant is that Euqifax didn't handle their environment like a professional should.
I wrote about this:
http://robert.ocallahan.org/20...
Summary: In practice, attackers can leverage arbitrary-write bugs to produce the same-origin violations Microsoft warns about without requiring RCE, completely bypassing the CFI mitigations Microsoft is touting here.
MS changed to being all spyware, all the time with Windows 10.
An OS which spies on you is the diametric opposite of security.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
"we set out to examine Google’s Chrome web browser .. is having a strong sandboxing model sufficient to make a browser secure?" Jordan Rabet Microsoft Offensive Security Research team
That's a bit rich coming from Microsoft. Security resides in the Operating not in the Browser. Chrome wouldn't need sandboxing if the underlying Operating System did its job. That is isolate one processes memory from the other. Something the WinTEL platform seem unable to do despite numerous iterations of the x86 processor.
I love how the original "research" article tried to spin defects in the underlying Operating System into, it's somehow the fault of sandboxing in Chrome. Sandboxing, OSR, RCE, CFG, ACG, LPAC, WDAG, all designed to protect the underlying Operating System from the browser. Microsoft, the company that fights malware with self-serving adverts masquerading as technical research.
Anonymous Coward: 'Was demonstrated once more by the Equifax mega breach.'
The Equifax mega breach demonstrated what happens when a company with an annual turnover of US$ 3.1 billion, uses software on an Internet facing machine without testing it for security vulnerabilities. In fact they didn't even have a patch strategy in place or even know who was responsible for implementing such patches.