5 ms·

The Advanced Persistent Threat You Have: Google Chrome [pdf]

42 points by epsylon 11y ago

epsylon 11y ago
"Making of" paper is here: http://www.netsq.com/Documents/MakingOfGoogleAPT.pdf http://www.netsq.com/Documents/MakingOfGoogleAPT.pdf
xpaulbettsx 11y ago
I can't read through the pages and pages of grandstanding in this PDF, does this at all have some sort of escape of a security boundary, or is it just "I found a weird way to hack myself"?
- exelius 11y ago
  It's not about hacking; it's about threat modeling using a widespread and well-understood implementation that behaves similarly in many ways to a real threat. Basically, if your APT identification tech can't detect Google Chrome updates being pushed out over your network, you won't be able to detect real malicious actors. A true threat would act in a very similar way, except the payload would be more malicious than Chrome updates. It's an interesting thought experiment; but no, there are no concrete conclusions.
- bcoates 11y ago
  If you're running Chrome, you've let all the people who can update Chrome into your system. If your security software hasn't detected this, it's snakeoil and won't detect more serious threats either.
irickt 11y ago
The paper is dated 18-Apr-2012
deleted 11y ago
[deleted]
- thesteamboat 11y ago
  The author is not saying Google Chrome is a security risk -- he's saying that malware has goals and behavior similar to Google's software updater. > Here are just some of the reasons Google’s software update system can serve as a model APT. (1) There is a bootstrapping program, GoogleSoftwareUpdateAgent, buried deeply in a user’s home directory. Few people know it is there, even fewer probably know when it becomes active. It neither requests permission to modify your system nor notifies you when it does. (2) Detailed analysis of this bootstrapping program cannot reveal what it may do because actual actions (via programs & scripts in this case) are only received from the Internet at runtime. (3) A critical executable (one you trust with your passwords for many important network services) will be modified. The paper then goes on to argue that this is a useful test case for people trying to detect when malware has modified their system, and what it has modified. The paper does not discuss the security strengths or flaws of Chromium itself --- that discussion is completely tangential to the paper.
RachelF 11y ago
Others are dumping Chrome for similar reasons: http://www.extremetech.com/computing/210576-why-im-dumping-google-chrome http://www.extremetech.com/computing/210576-why-im-dumping-g...
skybrian 11y ago
This seems like a good paper that isn't actually about something wrong with Chrome. It's about what security tools need to do to track auto-updating software.
sjg007 11y ago
Presumably Chrome and its updater are digitally signed... not that that stops malware but at least it is another layer.
dkokelley 11y ago
I found the paper very eye-opening, but perhaps I missed the "moral" of the story. I understand that Google's auto updater can behave similarly to a malicious utility by an APT, but what recourse or mitigation techniques are available? According to the paper, each step individually is indistinguishable from benign activity. Techniques for identifying the end result of the activity and flagging it as suspicious are omitted (or perhaps I missed them).
NickHaflinger 11y ago
total FUD .. nothing gets updated here unless I want it to. And why isn't the Microsoft software updater or your AV updater considered an equal threat. Who paid for this 'study'.
deleted 11y ago
[deleted]

42 points by epsylon 11y ago

"Making of" paper is here: http://www.netsq.com/Documents/MakingOfGoogleAPT.pdf http://www.netsq.com/Documents/MakingOfGoogleAPT.pdf

xpaulbettsx 11y ago

I can't read through the pages and pages of grandstanding in this PDF, does this at all have some sort of escape of a security boundary, or is it just "I found a weird way to hack myself"?

exelius 11y ago
It's not about hacking; it's about threat modeling using a widespread and well-understood implementation that behaves similarly in many ways to a real threat. Basically, if your APT identification tech can't detect Google Chrome updates being pushed out over your network, you won't be able to detect real malicious actors. A true threat would act in a very similar way, except the payload would be more malicious than Chrome updates. It's an interesting thought experiment; but no, there are no concrete conclusions.
bcoates 11y ago
If you're running Chrome, you've let all the people who can update Chrome into your system. If your security software hasn't detected this, it's snakeoil and won't detect more serious threats either.

irickt 11y ago

The paper is dated 18-Apr-2012

deleted 11y ago

[deleted]

thesteamboat 11y ago
The author is not saying Google Chrome is a security risk -- he's saying that malware has goals and behavior similar to Google's software updater. > Here are just some of the reasons Google’s software update system can serve as a model APT. (1) There is a bootstrapping program, GoogleSoftwareUpdateAgent, buried deeply in a user’s home directory. Few people know it is there, even fewer probably know when it becomes active. It neither requests permission to modify your system nor notifies you when it does. (2) Detailed analysis of this bootstrapping program cannot reveal what it may do because actual actions (via programs & scripts in this case) are only received from the Internet at runtime. (3) A critical executable (one you trust with your passwords for many important network services) will be modified. The paper then goes on to argue that this is a useful test case for people trying to detect when malware has modified their system, and what it has modified. The paper does not discuss the security strengths or flaws of Chromium itself --- that discussion is completely tangential to the paper.

RachelF 11y ago

Others are dumping Chrome for similar reasons: http://www.extremetech.com/computing/210576-why-im-dumping-google-chrome http://www.extremetech.com/computing/210576-why-im-dumping-g...

skybrian 11y ago

This seems like a good paper that isn't actually about something wrong with Chrome. It's about what security tools need to do to track auto-updating software.

sjg007 11y ago

Presumably Chrome and its updater are digitally signed... not that that stops malware but at least it is another layer.

dkokelley 11y ago

I found the paper very eye-opening, but perhaps I missed the "moral" of the story. I understand that Google's auto updater can behave similarly to a malicious utility by an APT, but what recourse or mitigation techniques are available? According to the paper, each step individually is indistinguishable from benign activity. Techniques for identifying the end result of the activity and flagging it as suspicious are omitted (or perhaps I missed them).

NickHaflinger 11y ago

total FUD .. nothing gets updated here unless I want it to. And why isn't the Microsoft software updater or your AV updater considered an equal threat. Who paid for this 'study'.

deleted 11y ago

[deleted]