Microsoft Chastises Google Over Chrome Security (pcmag.com)

An anonymous reader quotes PCMag: In a Wednesday blog post, Redmond examined Google's browser security and took the opportunity to throw some shade at Chrome's security philosophy, while also touting the benefits of its own Edge browser. The post, written by Microsoft security team member Jordan Rabet, noted that Google's Chrome browser uses "sandboxing" and isolation techniques designed to contain any malicious code. Nevertheless, Microsoft still managed to find a security hole in Chrome that could be used to execute malicious code on the browser.

The bug involved a Javascript engine in Chrome. Microsoft notified Google about the problem, which was patched last month. The company even received a $7,500 reward for finding the flaw. However, Microsoft made sure to point out that its own Edge browser was protected from the same kind of security threat. It also criticized Google for the way it handled the patching process. Prior to the patch's official rollout, the source code for the fix was made public on GitHub, a software collaboration site that hosts computer code. That meant attentive hackers could have learned about the vulnerability before the patch was pushed out to customers, Microsoft claimed. "In this specific case, the stable channel of Chrome remained vulnerable for nearly a month," the blog post said. "That is more than enough time for an attacker to exploit it."
In the past Google has also disclosed vulnerabilities found in Microsoft products -- including Edge.

Comments

Really?

[Anonymous Coward]

Do we point out Microsoft's long and illustrious history of ignoring critical security flaws now or...

Do we just point out Chrome isn't crashing computers with their security updates, thus training their users to turn off automatic updates?

I know, I know, its not the same thing exactly. But you know what they say about people in glass houses.

Re:Really?

[dreamchaser]

I would actually prefer that the major players all try to keep each other honest.

Re:Really?

[geekmux]

I would actually prefer that the major players all try to keep each other honest.

Being honest is one thing, which I do appreciate.

That said, Microsoft doesn't have the right to bash a garage-band IoT maker about security flaws response.

Re:Really?

[dreamchaser]

I would actually prefer that the major players all try to keep each other honest.

Being honest is one thing, which I do appreciate.

That said, Microsoft doesn't have the right to bash a garage-band IoT maker about security flaws response.

Everyone, from the lone user to a mega-corporation, has the right to call out security flaws on anyone who exposes others to risk.

Re:Really?

[Dutch Gun]

Agreed. In addition, I'd definitely recommend reading the original Microsoft blog post. It's actually not nearly so flame-bait-ish as the breathless headlines and summary imply. It's a fascinating piece of technical detective work, and I think that, while they obviously use this as good propaganda to promote their own technology, the issues they presented seem fair to me.

They also gave Google kudos where that was deserved, but that doesn't make for very good headlines. For instance:

This kind of attack drives our commitment to keep on making our products secure on all fronts. With Microsoft Edge, we continue to both improve the isolation technology and to make arbitrary code execution difficult to achieve in the first place. For their part, Google is working on a site isolation feature which, once complete, should make Chrome more resilient to this kind of RCE attack by guaranteeing that any given renderer process can only ever interact with a single origin. A highly experimental version of this site isolation feature can be enabled by users through the chrome://flags interface.

And consider this:

Servicing security fixes is an important part of the process and, to Google’s credit, their turnaround was impressive: the bug fix was committed just four days after the initial report, and the fixed build was released three days after that. However, it’s important to note that the source code for the fix was made available publicly on Github before being pushed to customers. Although the fix for this issue does not immediately give away the underlying vulnerability, other cases can be less subtle.

Note that they don't actually blame open source. That would be foolish, as they're embracing it more and more themselves.

Some Microsoft Edge components, such as Chakra, are also open source. Because we believe that it’s important to ship fixes to customers before making them public knowledge, we only update the Chakra git repository after the patch has shipped.

Damn Google!

[thegarbz]

I don't know of any other company that has a monthly release cycle for security updates, even for zero day bugs! Google you are evil, you should be like Micros... oh.

I hope they enter a pissing contest...

[aepervius]

...Trying to outdo each other at finding browser vulnerabilities. Outcome : both browser become more secure.

Re:Pot criticises kettle

[Billly Gates]

IE 6 was made 17 years ago.

Disclaimer I am using Chrome so I am not drinking the coolaid.

MS changed to being secure in 2004 with the famous Bill Gates memo. IE 8 matched Chrome 1.0 with kernel level sandboxing in %appdata/lowrights and per threading process since 2009. Firefox just matched IE 8's security this year which is why I dumped it for Chrome in 2011 after the 4.0 fiasco.

IE 9 started the change to standards with hardware acceleration and IE 11/Edge are fully 100% W3C compliant. Infact I think IE 10 is W3C compliant too and no longer sucked but was a bit behind Chrome and Firefox at the time.

Anyway I welcome the rapid improvement to security and standards compliance for both. Where Edge sucks is it is more of a mobile browser than a desktop and had issues crashing during the initial Windows 10 build 204100 release 2015. But that is my take.

Re:The failure of open source security

[Anonymous Coward]

In a professional setting, updates are tested on a test server to make sure they don't break anything before they are applied to production servers. And the moment they are applied is planned carefully. Auto update is irrelevant there, what is relevant is that Euqifax didn't handle their environment like a professional should.