5 ms·

I love Chrome, but the one big -- and really nasty -- surprise for me was that it has IE-style (i.e. invisible, exploitable, in the wild) security vulnerabiliti

by seldo 16y ago

I love Chrome, but the one big -- and really nasty -- surprise for me was that it has IE-style (i.e. invisible, exploitable, in the wild) security vulnerabilities. I've used Firefox since the very earliest betas and it has never, ever been exploited to infect my machine. Sure, it's had big holes, but I've never seen them widely deployed in the wild. I ran without antivirus software from 2003, because it just wasn't necessary. Chrome, on the other hand, has been clearly and unambiguously the only possible vector for three separate, massive viral infections on my machine in the last 6 months, infections severe enough to take out my entire OS and require a reinstall[1]. Sure, in two cases they were viruses delivered by ad networks on sites that I probably shouldn't have been visiting -- but one was just a rogue ad hit while browsing Twitpic. Now I run Antivirus software again, and every couple of weeks a compromised ad network -- even on quite reputable sites -- will trigger an alert and automatic cleaning. For some sites I switch back to Firefox. Chrome's amazing performance has to come from somewhere, and my impression is that that boost comes because it runs "closer to the metal", i.e. fewer layers of virtual machines and sandboxes. But that design decision has drawbacks, and one of them seems to be security. [1] Infection details: Chrome running on Windows XP (first two times) and Windows 7 (final time). I didn't do forensics on the actual vector, but all three times rogue Java applications started up and then installed additional infections, which appeared within seconds of the first attack, making it hard to say which virus was the first to break in.

mootothemax 16y ago
Surely, given your description and timeframes, the most likely vector is Flash, not Chrome?
- nodata 16y ago
  Does Chrome bundle Flash and handle updates itself? Would be interested to compare the lag if that were true.
  - thezilch 16y ago
    Chrome, itself, bundles and releases updated, Flash builds. The latest vulnerability-fix release of Flash was released to Chrome users before even Adobe made it public for download, for other [browser] flavors.
- drivebyacct2 16y ago
  His post explicitly mentions Java. Seeing as how some 99% of users run Flash, and 100% of Chrome users are guaranteed on the latest version... I find it hard to fault chrome/flash integration. Its all good for the user, it can be disabled, and they've just added clikc-to-enable for plugins!! (Which also greatly increases its flash stability in linux, yay!)
  - mootothemax 16y ago
    His post explicitly mentions Java. Not at the time of my comment it didn't ;) Seeing as how some 99% of users run Flash, and 100% of Chrome users are guaranteed on the latest version... I find it hard to fault chrome/flash integration Go back over the last 12 months - are you honestly trying to tell me that there were no ad networks serving ads containing Flash exploits? And that's only one area they appear. Edit: I'm not ignoring Chrome's Flash integration, but you have to remember that was only released at the end of June: http://techcrunch.com/2010/06/25/google-chrome-flash/ http://techcrunch.com/2010/06/25/google-chrome-flash/
    - drivebyacct2 16y ago
      "Go back over the last 12 months - are you honestly trying to tell me that there were no ad networks serving ads containing Flash exploits? And that's only one area they appear." You're missing the point. Considering that nearly everyone has flash, most people don't update it, and Chrome forces you to always have the latest security patches (AND it can be disabled AND it can be click-to-enable plugin), they're protecting users, literally as much as possible. It's certainly better than the Firefox model which is what it's being compared to...
    - drivebyacct2 16y ago
      Haha. This makes this humorous topic even funnier: http://www.techi.com/2010/12/one-small-step-for-flash-one-decently-sized-leap-for-chrome/ http://www.techi.com/2010/12/one-small-step-for-flash-one-de...
mattparcher 16y ago
I accidentally down-voted you. My apologies — your contribution is genuinely helpful.
thezilch 16y ago
No offence, but FUD? What _exactly_ has allowed you to assert that Chrome is up there with IE vulnerabilities and that Firefox can be cleansed of having been exploited. Chrome doesn't have "the best" sandboxing?
drivebyacct2 16y ago
Excuse me, but WTH? I had to go to my browser to make sure the HN app wasn't lying... but all of your complaint boils down to an unproven, nontechnical anecdotal indictment that even at best, still crumples with the clencher... The vulnerability was in Java, making Firefox just as vulnerable, and Chrome's flash integration* is brilliant unless you think all, most or really even more than a few Flash users are actually up to date. I can't count how many Windows computers I've been on recently where both the Flash and Java were significantly out of date and were un-updatable due to a lack of admin permissions. Is this post a joke and something is flying over my head? Since when did such unsubstantiated junk as "fewer layers of virtual machines" and the notion that Chrome wasn't fesigned with security in mind become acceptable here? * for those that don't know, chrome bundles flash and keeps it always up to date.
- seldo 16y ago
  I tried to make clear that this is my personal experience and impressions, not a declaration of fact: "seems to have", "my impression", etc.. I should have gone further and said "this happens to me, has anybody else had this problem?" My apologies. However, and however anecdotal the evidence, the vulnerability was in the browser -- Chrome is what allowed the Java applet to run without my consent. Firefox, visiting the very same sites over the same period was not affected, nor at any other time in the past 8 years of using it. That was my point.
ErrantX 16y ago
Sounds likely Java was the attack vector, it quite often is. From a professional perspective; Chrome is probably on a par with Firefox (which has had some really nasty exploits recall), possibly better. Not that it matters. You were infected due to "driving dangerously", which is what will happen. I'm going to throw this out there but you would have had similar issues on any other browser. (you will often get an "AV hit" on reputable sites where ads try to set a tracking cookie - there is nothing inherently dangerous about that, just annoyance and the fact they are trying to track you :) I'm going to guess that is what you are seeing)
blasdel 16y ago
So go to chrome://plugins/ and disable the Java plugin!

by seldo 16y ago

mootothemax 16y ago

Surely, given your description and timeframes, the most likely vector is Flash, not Chrome?

nodata 16y ago
Does Chrome bundle Flash and handle updates itself? Would be interested to compare the lag if that were true.
- thezilch 16y ago
  Chrome, itself, bundles and releases updated, Flash builds. The latest vulnerability-fix release of Flash was released to Chrome users before even Adobe made it public for download, for other [browser] flavors.
drivebyacct2 16y ago
His post explicitly mentions Java. Seeing as how some 99% of users run Flash, and 100% of Chrome users are guaranteed on the latest version... I find it hard to fault chrome/flash integration. Its all good for the user, it can be disabled, and they've just added clikc-to-enable for plugins!! (Which also greatly increases its flash stability in linux, yay!)
- mootothemax 16y ago
  His post explicitly mentions Java. Not at the time of my comment it didn't ;) Seeing as how some 99% of users run Flash, and 100% of Chrome users are guaranteed on the latest version... I find it hard to fault chrome/flash integration Go back over the last 12 months - are you honestly trying to tell me that there were no ad networks serving ads containing Flash exploits? And that's only one area they appear. Edit: I'm not ignoring Chrome's Flash integration, but you have to remember that was only released at the end of June: http://techcrunch.com/2010/06/25/google-chrome-flash/ http://techcrunch.com/2010/06/25/google-chrome-flash/
  - drivebyacct2 16y ago
    "Go back over the last 12 months - are you honestly trying to tell me that there were no ad networks serving ads containing Flash exploits? And that's only one area they appear." You're missing the point. Considering that nearly everyone has flash, most people don't update it, and Chrome forces you to always have the latest security patches (AND it can be disabled AND it can be click-to-enable plugin), they're protecting users, literally as much as possible. It's certainly better than the Firefox model which is what it's being compared to...
  - drivebyacct2 16y ago
    Haha. This makes this humorous topic even funnier: http://www.techi.com/2010/12/one-small-step-for-flash-one-decently-sized-leap-for-chrome/ http://www.techi.com/2010/12/one-small-step-for-flash-one-de...

mattparcher 16y ago

I accidentally down-voted you. My apologies — your contribution is genuinely helpful.

thezilch 16y ago

No offence, but FUD? What _exactly_ has allowed you to assert that Chrome is up there with IE vulnerabilities and that Firefox can be cleansed of having been exploited. Chrome doesn't have "the best" sandboxing?

drivebyacct2 16y ago

Excuse me, but WTH? I had to go to my browser to make sure the HN app wasn't lying... but all of your complaint boils down to an unproven, nontechnical anecdotal indictment that even at best, still crumples with the clencher... The vulnerability was in Java, making Firefox just as vulnerable, and Chrome's flash integration* is brilliant unless you think all, most or really even more than a few Flash users are actually up to date. I can't count how many Windows computers I've been on recently where both the Flash and Java were significantly out of date and were un-updatable due to a lack of admin permissions. Is this post a joke and something is flying over my head? Since when did such unsubstantiated junk as "fewer layers of virtual machines" and the notion that Chrome wasn't fesigned with security in mind become acceptable here? * for those that don't know, chrome bundles flash and keeps it always up to date.

seldo 16y ago
I tried to make clear that this is my personal experience and impressions, not a declaration of fact: "seems to have", "my impression", etc.. I should have gone further and said "this happens to me, has anybody else had this problem?" My apologies. However, and however anecdotal the evidence, the vulnerability was in the browser -- Chrome is what allowed the Java applet to run without my consent. Firefox, visiting the very same sites over the same period was not affected, nor at any other time in the past 8 years of using it. That was my point.

ErrantX 16y ago

Sounds likely Java was the attack vector, it quite often is. From a professional perspective; Chrome is probably on a par with Firefox (which has had some really nasty exploits recall), possibly better. Not that it matters. You were infected due to "driving dangerously", which is what will happen. I'm going to throw this out there but you would have had similar issues on any other browser. (you will often get an "AV hit" on reputable sites where ads try to set a tracking cookie - there is nothing inherently dangerous about that, just annoyance and the fact they are trying to track you :) I'm going to guess that is what you are seeing)

blasdel 16y ago

So go to chrome://plugins/ and disable the Java plugin!