Welcome to MSFN

Register now to gain access to all of our features. Once registered and logged in, you will be able to contribute to this site by submitting your own content or replying to existing content. You'll be able to customize your profile, receive reputation points as a reward for submitting content, while also communicating with other members via your own private inbox, plus much more! This message will be removed once you have signed in.


Sign in to follow this  
Followers 0
monroe

Chrome Has a Serious Security Flaw

2 posts in this topic

Just noticed this article ... I don't use Chrome or actually know that much about it ... so it might have been already mentioned in another part of the forum.

 

Chrome Has a Serious Security Flaw

 

November 19, 2015

 

http://www.foxnews.com/tech/2015/11/19/chrome-has-serious-security-flaw.html?intcmp=hpbt4

 

Since Google launched the Chrome browser in 2008, it's built a reputation for speed and security not found in other browsers. While the gap has narrowed in both those areas thanks to improvements in Firefox, and Microsoft creating the new Edge browser for Windows 10, Chrome still has the edge in hacking contests.

 

That's one reason hundreds of millions around the world have it installed on their computers and mobile gadgets. Unfortunately, a newly discovered security flaw might put that reputation in jeopardy.

 

A Chinese researcher, Guang Gong, discovered the flaw after three months of work, and built a proof-of-concept he demonstrated at the recent PacSec conference. Using a simple game app with a bit of extra code in it, he forced the phone to call out to a special server and load up a webpage in Chrome containing malicious code.

 

When the Chrome browser visited the webpage, a flaw in the JavaScript system let the page download another app that took over the Android gadget completely. That's scary, but it gets worse.

 

Usually, attacks that lead to a full takeover of an operating system require multiple flaws, a number of steps and some user input to work. This attack does it in one go, which means as soon as the user installs a modified app, or visits a malicious page, it's over.

 

The way Gong's attack works, any app could have the code calling out to a special server with a malicious page. Apps do that all the time for ads and other uses, so it wouldn't trigger any alarms in the Google Play store. That means slipping a malicious app through Google's screening just got easier.

 

It isn't just Chrome, though. Other researchers are now worried that any third-party app that includes Google's version of JavaScript will also be vulnerable.

 

Of course, the same flaw exists in the desktop version of Chrome, meaning hackers might adapt it to launch attacks against PCs and Macs. Gong says he informed Google of the flaw in August, but so far there hasn't been a fix released.

 

Fortunately, Gong hasn't released the details on the flaw, so no hackers should have it yet. Considering it took him three months to find, it will probably be a little while before anyone else figures it out.

 

Still, you don't want to rely completely on that to stay safe. Here are some things you can do.

 

Switch your mobile browser to Firefox on Android and Apple, or go back to Safari on Apple.

Be careful when clicking on links you get in email or text messages. Only click if you know where it's going and you trust the person who sent it.

Get a security app that warns you about phishing links and malicious app downloads.

...

Edited by monroe
0

Share this post


Link to post
Share on other sites

firefox user with dark skin, i am always happy with it

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.