Chrome bug no security threat, argues Google
Security company says flaw allows attackers to plant malware on Windows PCs; Google says it requires too many conditions to classify as vulnerability
Google's Chrome contains a critical vulnerability that under certain circumstances allows attackers to plant malware on a Windows PC, a security company said last week.
According to Slovenia-based Acros Security, Google would not categorize the bug as a vulnerability and instead called it a "strange behavior that [they] should consider changing."
[ Also on InfoWorld: Chrome poised to take No. 2 browser spot from Firefox. | Go deep into HTML5 programming in InfoWorld's "HTML5 Megaguide Deep Dive" PDF how-to report. Then understand the issues surrounding HTML5 today in InfoWorld's HTML5 Deep Dive PDF strategy report. | Learn how to secure your Web browsers in InfoWorld's "Web Browser Security Deep Dive" PDF guide. ]
The vulnerability, said Mitja Kolsek, Acros's CEO, is one of a string in Windows programs that relies on an attack strategy variously dubbed "DLL load hijacking," "binary planting," and "file planting."
The attack jumped into public view in August 2010 when HD Moore, the creator of the Metasploit penetration hacking toolkit and chief security officer at Rapid7, found dozens of vulnerable Windows applications. Moore's report was followed by others, including several from Kolsek and Acros.
Many Windows applications don't call DLLs, or dynamic link libraries, using a full path name, but instead use only the filename, giving hackers a way to trick an application into loading a malicious file with the same title as a required DLL. If attackers can dupe users into visiting malicious Web sites or remote shared folders, or get them to plug in a USB drive -- and in some cases con them into opening a file -- they can hijack a PC and plant malware on it.
Microsoft, for instance, has provided 17 security updates in the last 13 months to fix DLL load hijacking problems, most recently earlier this month.
The newest, however, affects Chrome, the browser that -- because of its "sandbox" technology that isolates the browser from the rest of the system -- most security experts believe is the safest of the top five.
Chrome's sandbox doesn't protect against this DLL load hijacking, said Acros in a lengthy write-up of the vulnerability.
The silver linking? Hackers have to have the stars perfectly aligned to exploit the bug, said Acros.
For the vulnerability to be exploited, Chrome must be set to use a search engine other than Google's, which is, not surprisingly, the default for Google's browser. Acros confirmed that an attack can be successfully launched against Chrome when users set Yahoo or Bing as the browser's preferred search site.
The user must have not visited a secure website -- one whose URL starts with HTTPS -- before the attack begins, added Acros, and must also be duped into trying to load a file and thus have the "Open" dialog box onscreen when the attack initiates.
That was all too much for Google.
