3 ms·

> Chrome + AdBlock Plus by itself typically prevents repeat malware cleanups. That's interesting because Chrome is installed as the user (and so writable by th

by nodata 15y ago

> Chrome + AdBlock Plus by itself typically prevents repeat malware cleanups. That's interesting because Chrome is installed as the user (and so writable by the user), not as admin (like everything else). Chrome should be easier to infect. Got any numbers?

thaumaturgy 15y ago
No, unfortunately. :-( One of my 2012 projects is to build us a system that can keep track of all this stuff so I can publicly provide real data on what we see instead of winging it. Web-wise, there seems to be two primary sources of infection: malicious ads on legitimate websites, and poisoned search results. (Compromised websites were all set to be a strong third source, but Wordpress cleaned up its act and we haven't seen as much of that this year.) AB+ takes care of the ads, which seems to be the biggest source of infections. Chrome seems to be pretty resilient to direct attacks against the browser so far, if statements from people at CanSecWest are anything to go by. (With at least one known exception [1].) We make guesses about the source of the infection based on the type of infection, what we find in which temp folders, and the client's browsing history -- if they're OK with us looking into that. edit: I should explain that we've seen the same results from Firefox w/ AB+. [1]: http://www.geek.com/articles/geek-pick/googles-chrome-browser-has-finally-been-hacked-2011059/ http://www.geek.com/articles/geek-pick/googles-chrome-browse...
- kijin 15y ago
  Thanks for the info. I use AdBlock Plus and I love it too. On a related note, what do you think about NoScript? Does it really help prevent attacks these days, or are NoScript users just being paranoid? I use NoScript with AdBlock Plus, but so many websites rely on JS these days, it gets annoying pretty quickly.
  - rkudeshi 15y ago
    I wanted to love NoScript, but it broke too many web pages. Trying Ghostery now, seems much more user-friendly.
    - RexRollman 15y ago
      I've tried to leave NoScript a month ago but there are too many asshole website developers out there. But your recommendation is a good one, as I've heard nothing but good things about Ghostery.
  - thaumaturgy 15y ago
    Based on what little I've seen of compromised websites being used to attack visitors, Javascript has been involved in every single case. It might not necessarily be a JS-based exploit, but JS is used to load the actual exploit into the page. But, I'm really not a domain expert on this. I follow things like Sucuri's blog and get maybe a few calls a year from someone with a compromised website, so it's possible that there's a more common attack method that I don't know about. Yeah, I'd love to love and recommend NoScript, but I just can't. JS is becoming too integral to too many websites these days, for everything from navigation to contact forms, and it looks like that's going to be the trend forever at this point. FWIW, I don't think a single one of our clients uses NoScript, so good browser + AB+ + good antivirus software seems to be doing the trick so far.
- justinschuh 15y ago
  Chrome's sandbox has an extremely solid design and implementation. It's far more robust than anything else available, and we have yet to see an attack in the wild that can bypass it. Our big remaining weak spot is NPAPI--because plugins can't be sandboxed without completely rewriting their platform layer. Using AdBlock addresses this weakness by preventing plugin content from loading. You can achieve the same effect by turning on click-to-play or plugin blocking. The linked video from VUPEN doesn't actually show a Chrome hack. It's a Flash exploit, which affects any browser with Flash installed (including about 98% of desktop browsers). We've been working for almost two years on developing a fully sandboxed Flash implementation, and expect to ship it to all platforms early next year. It's taken so long because sandboxing a large existing application is a huge engineering effort--particularly when you have such a long compatibility matrix. FWIW, the custom PDF reader we ship has always been fully sandboxed, just like all normal web content in Chrome. Currently, the only Chrome platform with a fully sandboxed Flash is ChromeOS, because we had to rewrite the platform layer from scratch anyway (and did not implement several Flash features initially). The Windows version of Chrome also has a sandbox of a sort; it runs Flash in low-integrity mode (just like IE on Vista+). This is nowhere near as strong as the real Chrome sandbox, but we were able to implement it relatively quickly as a stopgap measure. The shipping Mac and Linux versions have no Flash sandbox right now.
  - thaumaturgy 15y ago
    Thank you for helping to build such a solid browser. We love it, and our clients love it, and we love working on a first-time client's machine and seeing that they're already using it. :-)
deleted 15y ago
[deleted]
RexRollman 15y ago
Google has a Chrome For Business page where you can get a .msi file that is installed outside of the user's home directory. You can get it here: http://www.google.com/chrome/intl/en/business/ http://www.google.com/chrome/intl/en/business/

by nodata 15y ago

thaumaturgy 15y ago

No, unfortunately. :-( One of my 2012 projects is to build us a system that can keep track of all this stuff so I can publicly provide real data on what we see instead of winging it. Web-wise, there seems to be two primary sources of infection: malicious ads on legitimate websites, and poisoned search results. (Compromised websites were all set to be a strong third source, but Wordpress cleaned up its act and we haven't seen as much of that this year.) AB+ takes care of the ads, which seems to be the biggest source of infections. Chrome seems to be pretty resilient to direct attacks against the browser so far, if statements from people at CanSecWest are anything to go by. (With at least one known exception [1].) We make guesses about the source of the infection based on the type of infection, what we find in which temp folders, and the client's browsing history -- if they're OK with us looking into that. edit: I should explain that we've seen the same results from Firefox w/ AB+. [1]: http://www.geek.com/articles/geek-pick/googles-chrome-browser-has-finally-been-hacked-2011059/ http://www.geek.com/articles/geek-pick/googles-chrome-browse...

kijin 15y ago
Thanks for the info. I use AdBlock Plus and I love it too. On a related note, what do you think about NoScript? Does it really help prevent attacks these days, or are NoScript users just being paranoid? I use NoScript with AdBlock Plus, but so many websites rely on JS these days, it gets annoying pretty quickly.
- rkudeshi 15y ago
  I wanted to love NoScript, but it broke too many web pages. Trying Ghostery now, seems much more user-friendly.
  - RexRollman 15y ago
    I've tried to leave NoScript a month ago but there are too many asshole website developers out there. But your recommendation is a good one, as I've heard nothing but good things about Ghostery.
- thaumaturgy 15y ago
  Based on what little I've seen of compromised websites being used to attack visitors, Javascript has been involved in every single case. It might not necessarily be a JS-based exploit, but JS is used to load the actual exploit into the page. But, I'm really not a domain expert on this. I follow things like Sucuri's blog and get maybe a few calls a year from someone with a compromised website, so it's possible that there's a more common attack method that I don't know about. Yeah, I'd love to love and recommend NoScript, but I just can't. JS is becoming too integral to too many websites these days, for everything from navigation to contact forms, and it looks like that's going to be the trend forever at this point. FWIW, I don't think a single one of our clients uses NoScript, so good browser + AB+ + good antivirus software seems to be doing the trick so far.
justinschuh 15y ago
Chrome's sandbox has an extremely solid design and implementation. It's far more robust than anything else available, and we have yet to see an attack in the wild that can bypass it. Our big remaining weak spot is NPAPI--because plugins can't be sandboxed without completely rewriting their platform layer. Using AdBlock addresses this weakness by preventing plugin content from loading. You can achieve the same effect by turning on click-to-play or plugin blocking. The linked video from VUPEN doesn't actually show a Chrome hack. It's a Flash exploit, which affects any browser with Flash installed (including about 98% of desktop browsers). We've been working for almost two years on developing a fully sandboxed Flash implementation, and expect to ship it to all platforms early next year. It's taken so long because sandboxing a large existing application is a huge engineering effort--particularly when you have such a long compatibility matrix. FWIW, the custom PDF reader we ship has always been fully sandboxed, just like all normal web content in Chrome. Currently, the only Chrome platform with a fully sandboxed Flash is ChromeOS, because we had to rewrite the platform layer from scratch anyway (and did not implement several Flash features initially). The Windows version of Chrome also has a sandbox of a sort; it runs Flash in low-integrity mode (just like IE on Vista+). This is nowhere near as strong as the real Chrome sandbox, but we were able to implement it relatively quickly as a stopgap measure. The shipping Mac and Linux versions have no Flash sandbox right now.
- thaumaturgy 15y ago
  Thank you for helping to build such a solid browser. We love it, and our clients love it, and we love working on a first-time client's machine and seeing that they're already using it. :-)

deleted 15y ago

[deleted]

RexRollman 15y ago

Google has a Chrome For Business page where you can get a .msi file that is installed outside of the user's home directory. You can get it here: http://www.google.com/chrome/intl/en/business/ http://www.google.com/chrome/intl/en/business/