8 ms·

Do features like Chrome Remote Desktop give anyone else goosebumps? I love that Chrome automatically updates with security and performance updates. But an IT p

Do features like Chrome Remote Desktop give anyone else goosebumps? I love that Chrome automatically updates with security and performance updates. But an IT professional and someone who is security conscious, it's concerning that users' web browsers automatically install new attack vectors. I'm sure the NSA, every other three letter agency, and skillful botnet programmers and hackers are just tickled that Chrome is opening up new avenues for infection. Here's the how-to if you have some spare Google account credentials: 1. Install Chrome and sign in with target's credentials 2. Enable Chrome extension sync 3. Install Chrome remote access extension 4. Wait 5. ??? 6. Profit! Welp, at least Chrome for Windows has group policies to control (some) of this, but the policies often lag behind the new features. Chrome for Linux users? I guess they're SOL. Hope your company's administrators have init.d locked down or something to prevent Chrome from installing its hooks into your system during a regular apt-get/yum update. Edited in P.S.: Google, are you there? Are you listening? As a system administrator, what would tickle me would be the ability to freeze the attack surface area of user's machines. i.e.: they can't install new extensions and apps, they won't have any features that add new remote access features enabled, etc. I would like to be able to say, "I trust my ability to lock down Google Chrome 37", configure that, and not have to worry about an automatic update annihilating my security policies. Finally, automatic extension updates give me the creeps. At any moment, bam, suddenly my users' harmless extension is now owned by Shady Joe's Botnets 'R' Us, and their passwords, web traffic, and safety is compromised.

isaacdl 12y ago
I tend to agree with you. But in your hypothetical case, what's different about a someone (the NSA, etc) installing Chrome and enabling the RA extension vs just installing another remote access tool?
- thefreeman 12y ago
  Well in the second scenario, they would hypothetically still need to infect you with the RAT. In his scenario, you're already installed version of Chrome will infect you without your knowledge when it silently syncs the new Remote Desktop extension into your existing installation. Obviously if they have your Google credentials you are in a world of trouble, and I have no doubt if a 3 letter agency wanted to infect me they could, but the scenario he brings up is still troublesome and not at all restricted to highly technical attackers.
  - comex 12y ago
    Judging from this help page[1], you have to actually install Chrome Remote Desktop on the computer to be controlled - it won't just silently install.
    - thefreeman 12y ago
      I think you meant to link here: https://support.google.com/chrome/answer/1649523?hl=en https://support.google.com/chrome/answer/1649523?hl=en I see what you are saying. But the help page basically describes the steps to install a chrome extension. It doesn't say that this extension is specifically prevented from syncing like other extensions. It mentions an authorization dialogue on first run, but it is unclear whether that is the first run per account or the first run per installation of the extension. I would actually lean towards the latter, as it is in line with extension syncing behavior I have seen in the past. Usually when I am on a new setup of Chrome, and extensions sync and install, they do pop up some sort of installation or setup window notifying you. So there may indeed be no issue at all.
      - AaronFriel 12y ago
        Is the user prompted to understand how the extension can affect them, when it was installed, and where it is syncing from? To put it another way: if I am a regular end-user and Chrome pops up a dialog asking me to allow the official sounding "Google Remote Desktop App", then why wouldn't I? That doesn't sound scary at all - it's from Google!
      - yohui 12y ago
        Why are we guessing when you can just install Chrome Remote Desktop and try it out? I've used Chrome Remote Desktop, and the speculation in this thread about automatic extension sync is absolutely baseless: you need someone at the keyboard to actually install the remote desktop features, the extension by itself is not enough. Is this really the state of HN discussion? It's great that a Google engineer was able to chime in and dispel the wild fears (thanks Sergey), but it shouldn't have been necessary in the first place.
  - 12y ago
- ossreality 12y ago
  Yeah, this is a silly paranoid comment.
Shebanator 12y ago
If you have the target's credentials and access to their machine, then this extension is the least of the target's problems.
- nmjohn 12y ago
  You misunderstand, with this simply having the target's credentials is enough to give you access to the machine, that is the scary part!
- e12e 12y ago
  Target's google authentication. The user might be using chrome (signed in with google) on a machine that is otherwise used with other authentication domains, and maybe a different (eg: local) email provider. This is why I like Firefox sync much better: they actually support running your own sync server. So you can have your cake and eat it too.
SergeyUlanov 12y ago
Hello, I'm one of the engineers on the team. Extension sync doesn't automatically enable remote access to your machine. User must explicitly enable access on each machine that needs to be accessible (and to do that the user must be administrator). Also the remoting service needs to be installed separately from chrome - it's not part of the extension. It's not possible to package native binaries with chrome apps/extensions, by design (except for NPAPI plugins, but extensions with NPAPI plugins are not synced and NPAPI support is being removed from Chrome). On Linux you can disable automatic update both chrome and CRD. Just set repo_reenable_on_distupgrade to false in /etc/default/google-chrome and /etc/default/chrome-remote-desktop
- e12e 12y ago
  Great to hear back from the team. Do you know if we can expect better stability from this than from hangouts? I'm thinking of: https://code.google.com/p/chromium/issues/detail?id=363358 https://code.google.com/p/chromium/issues/detail?id=363358 which I had the displeasure to run into last time I had a conference call scheduled. Now, I don't fault the hangouts team for encountering a bug -- but it's frustrating (perhaps doubly so for Debian/stable users) when something like hangouts stops working -- and that without there being any obvious reason (eg: new features, important fixes) for why something that used to work, suddenly stop working.
- AaronFriel 12y ago
  If I could still edit it, I would correct my post to say that a user that has not activated remote desktop does have to enable it manually. But there is still no way to control Chrome's surface area in the future, and features like this give me the heebie-jeebies. Two things: 1. Users that have already enable Chrome Remote Desktop don't need to authorize the set of computers that can access it remotely. You authorize one endpoint, but not the other. And since Chrome will occasionally install new extensions and apps in its regular updates, there's no notification for a lay user to know why they got "Chrome Remote Desktop". For that matter, anyone with access to a Google account can leverage one Chrome sync feature to gain access to others (mainly: from an extensions into completely owning their machine), allowing them to leverage Google account access into a much greater vulnerability on remote physical machines. Passwords, open tabs, history, form data, credit card information. Let me walk you through this. Alice is using her computer at work. Eve has obtained Alice's credentials, and sets up a Chrome account on a machine and enables full sync, and installs the Chrome Remote Desktop extension on her computer. Alice sees a new extension appear on her computer. Why is it there? Alice is never informed, and Google adds new apps and extensions with updates occasionally, so Alice proceeds to install Chrome Remote Desktop. Why not? Chrome seemed to think it was safe to put on her front page or in her app bar. Eve can pin it to her bookmark bar with a title like "Connect from home!", or even install multiple bookmarks to do this: "Connect from home" "now today" "with Google Chrome" "Remote Desktop!" Now it's just a matter of time. Eve could also use her access to the account to synchronize new extensions silently and in the background, allowing them to siphon off passwords and credit card numbers, even if Alice disallowed those items from synchronizing. Extensions are simply too powerful and the automatic update feature makes every extension from a third party developer a ticking time bomb. 2. You don't really offer a great way of blocking increases to the attack surface area of Chrome. You offer a way to totally turn off all Google Chrome automatic updates, but woe is the administrator that tries to use your policy tools to lock down Chrome. As Chrome is becoming an operating system unto itself, I find myself at a loss to understand why policies for this new operating system lag behind. Your suggestion doesn't prevent Chrome from automatically updating or synchronizing new extensions, and doesn't provide the average user with protection from a hijacked Chrome account. Disabling Chrome's automatic updates, if anything, makes them less secure. No, what I want is the ability to lock Chrome's surface area to a particular version, not lock Chrome to the version itself. I want to see ways to limit my liability as an administrator to what I know and understand - and the Chrome team seems to think they know better than I do how to keep lay users safe. I disagree - given the fact that me, the security paranoid user, has already been bit by Chrome's security policies, I have no hope that they will avoid the same fate.
j_s 12y ago
The technical part of the problem is relying on a commercial 3rd party for authentication. This enables nation-state-level access based on the current laws of the land (the non-technical part of the problem).
- serf 12y ago
  that's exactly the problem I thought of. Remote admin programs with any centralized profiles/accounts are pretty problematic, more so if they don't allow alternative login schemes. (Teamviewer, for example, offers password/key/pin OR login.)
btgeekboy 12y ago
Chrome Remote Desktop operates very similarly to LogMeIn, GoToMyPC, etc, in that there's two components: a server, and a client. The server is installed as a standard application on the target machine, completely separate from Chrome. The client is implemented as a Chrome Extension, while competitors use things that don't work on Chromebooks (e.g. Java). Signing into a target's Google Account won't give you full, unfettered access to their PCs that have the server explicitly installed on them; you must also have a PIN that must be entered before every remote desktop session.
- hnarn 12y ago
  I would appreciate something more advanced than a PIN though. I currently use TeamViewer and I use unique, randomly generated passwords for each node. Downgrading to 4-6 digits doesn't feel very comfortable. Or perhaps Google could make sure that the PIN also requires a second two part authentication. I mean, the account should already be protected by that in theory, but if someone stumbles upon an active session and the PIN is lying around, at least they'll be stopped by the two part auth.

isaacdl 12y ago

I tend to agree with you. But in your hypothetical case, what's different about a someone (the NSA, etc) installing Chrome and enabling the RA extension vs just installing another remote access tool?

thefreeman 12y ago
Well in the second scenario, they would hypothetically still need to infect you with the RAT. In his scenario, you're already installed version of Chrome will infect you without your knowledge when it silently syncs the new Remote Desktop extension into your existing installation. Obviously if they have your Google credentials you are in a world of trouble, and I have no doubt if a 3 letter agency wanted to infect me they could, but the scenario he brings up is still troublesome and not at all restricted to highly technical attackers.
- comex 12y ago
  Judging from this help page[1], you have to actually install Chrome Remote Desktop on the computer to be controlled - it won't just silently install.
  - thefreeman 12y ago
    I think you meant to link here: https://support.google.com/chrome/answer/1649523?hl=en https://support.google.com/chrome/answer/1649523?hl=en I see what you are saying. But the help page basically describes the steps to install a chrome extension. It doesn't say that this extension is specifically prevented from syncing like other extensions. It mentions an authorization dialogue on first run, but it is unclear whether that is the first run per account or the first run per installation of the extension. I would actually lean towards the latter, as it is in line with extension syncing behavior I have seen in the past. Usually when I am on a new setup of Chrome, and extensions sync and install, they do pop up some sort of installation or setup window notifying you. So there may indeed be no issue at all.
    - AaronFriel 12y ago
      Is the user prompted to understand how the extension can affect them, when it was installed, and where it is syncing from? To put it another way: if I am a regular end-user and Chrome pops up a dialog asking me to allow the official sounding "Google Remote Desktop App", then why wouldn't I? That doesn't sound scary at all - it's from Google!
    - yohui 12y ago
      Why are we guessing when you can just install Chrome Remote Desktop and try it out? I've used Chrome Remote Desktop, and the speculation in this thread about automatic extension sync is absolutely baseless: you need someone at the keyboard to actually install the remote desktop features, the extension by itself is not enough. Is this really the state of HN discussion? It's great that a Google engineer was able to chime in and dispel the wild fears (thanks Sergey), but it shouldn't have been necessary in the first place.
- 12y ago
ossreality 12y ago
Yeah, this is a silly paranoid comment.

Shebanator 12y ago

If you have the target's credentials and access to their machine, then this extension is the least of the target's problems.

nmjohn 12y ago
You misunderstand, with this simply having the target's credentials is enough to give you access to the machine, that is the scary part!
e12e 12y ago
Target's google authentication. The user might be using chrome (signed in with google) on a machine that is otherwise used with other authentication domains, and maybe a different (eg: local) email provider. This is why I like Firefox sync much better: they actually support running your own sync server. So you can have your cake and eat it too.

SergeyUlanov 12y ago

Hello, I'm one of the engineers on the team. Extension sync doesn't automatically enable remote access to your machine. User must explicitly enable access on each machine that needs to be accessible (and to do that the user must be administrator). Also the remoting service needs to be installed separately from chrome - it's not part of the extension. It's not possible to package native binaries with chrome apps/extensions, by design (except for NPAPI plugins, but extensions with NPAPI plugins are not synced and NPAPI support is being removed from Chrome). On Linux you can disable automatic update both chrome and CRD. Just set repo_reenable_on_distupgrade to false in /etc/default/google-chrome and /etc/default/chrome-remote-desktop

e12e 12y ago
Great to hear back from the team. Do you know if we can expect better stability from this than from hangouts? I'm thinking of: https://code.google.com/p/chromium/issues/detail?id=363358 https://code.google.com/p/chromium/issues/detail?id=363358 which I had the displeasure to run into last time I had a conference call scheduled. Now, I don't fault the hangouts team for encountering a bug -- but it's frustrating (perhaps doubly so for Debian/stable users) when something like hangouts stops working -- and that without there being any obvious reason (eg: new features, important fixes) for why something that used to work, suddenly stop working.
AaronFriel 12y ago
If I could still edit it, I would correct my post to say that a user that has not activated remote desktop does have to enable it manually. But there is still no way to control Chrome's surface area in the future, and features like this give me the heebie-jeebies. Two things: 1. Users that have already enable Chrome Remote Desktop don't need to authorize the set of computers that can access it remotely. You authorize one endpoint, but not the other. And since Chrome will occasionally install new extensions and apps in its regular updates, there's no notification for a lay user to know why they got "Chrome Remote Desktop". For that matter, anyone with access to a Google account can leverage one Chrome sync feature to gain access to others (mainly: from an extensions into completely owning their machine), allowing them to leverage Google account access into a much greater vulnerability on remote physical machines. Passwords, open tabs, history, form data, credit card information. Let me walk you through this. Alice is using her computer at work. Eve has obtained Alice's credentials, and sets up a Chrome account on a machine and enables full sync, and installs the Chrome Remote Desktop extension on her computer. Alice sees a new extension appear on her computer. Why is it there? Alice is never informed, and Google adds new apps and extensions with updates occasionally, so Alice proceeds to install Chrome Remote Desktop. Why not? Chrome seemed to think it was safe to put on her front page or in her app bar. Eve can pin it to her bookmark bar with a title like "Connect from home!", or even install multiple bookmarks to do this: "Connect from home" "now today" "with Google Chrome" "Remote Desktop!" Now it's just a matter of time. Eve could also use her access to the account to synchronize new extensions silently and in the background, allowing them to siphon off passwords and credit card numbers, even if Alice disallowed those items from synchronizing. Extensions are simply too powerful and the automatic update feature makes every extension from a third party developer a ticking time bomb. 2. You don't really offer a great way of blocking increases to the attack surface area of Chrome. You offer a way to totally turn off all Google Chrome automatic updates, but woe is the administrator that tries to use your policy tools to lock down Chrome. As Chrome is becoming an operating system unto itself, I find myself at a loss to understand why policies for this new operating system lag behind. Your suggestion doesn't prevent Chrome from automatically updating or synchronizing new extensions, and doesn't provide the average user with protection from a hijacked Chrome account. Disabling Chrome's automatic updates, if anything, makes them less secure. No, what I want is the ability to lock Chrome's surface area to a particular version, not lock Chrome to the version itself. I want to see ways to limit my liability as an administrator to what I know and understand - and the Chrome team seems to think they know better than I do how to keep lay users safe. I disagree - given the fact that me, the security paranoid user, has already been bit by Chrome's security policies, I have no hope that they will avoid the same fate.

j_s 12y ago

The technical part of the problem is relying on a commercial 3rd party for authentication. This enables nation-state-level access based on the current laws of the land (the non-technical part of the problem).

serf 12y ago
that's exactly the problem I thought of. Remote admin programs with any centralized profiles/accounts are pretty problematic, more so if they don't allow alternative login schemes. (Teamviewer, for example, offers password/key/pin OR login.)

btgeekboy 12y ago

Chrome Remote Desktop operates very similarly to LogMeIn, GoToMyPC, etc, in that there's two components: a server, and a client. The server is installed as a standard application on the target machine, completely separate from Chrome. The client is implemented as a Chrome Extension, while competitors use things that don't work on Chromebooks (e.g. Java). Signing into a target's Google Account won't give you full, unfettered access to their PCs that have the server explicitly installed on them; you must also have a PIN that must be entered before every remote desktop session.

hnarn 12y ago
I would appreciate something more advanced than a PIN though. I currently use TeamViewer and I use unique, randomly generated passwords for each node. Downgrading to 4-6 digits doesn't feel very comfortable. Or perhaps Google could make sure that the PIN also requires a second two part authentication. I mean, the account should already be protected by that in theory, but if someone stumbles upon an active session and the PIN is lying around, at least they'll be stopped by the two part auth.