Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Chrome Microsoft Bug Security

Microsoft Chastises Google Over Chrome Security (pcmag.com) 111

An anonymous reader quotes PCMag: In a Wednesday blog post, Redmond examined Google's browser security and took the opportunity to throw some shade at Chrome's security philosophy, while also touting the benefits of its own Edge browser. The post, written by Microsoft security team member Jordan Rabet, noted that Google's Chrome browser uses "sandboxing" and isolation techniques designed to contain any malicious code. Nevertheless, Microsoft still managed to find a security hole in Chrome that could be used to execute malicious code on the browser.

The bug involved a Javascript engine in Chrome. Microsoft notified Google about the problem, which was patched last month. The company even received a $7,500 reward for finding the flaw. However, Microsoft made sure to point out that its own Edge browser was protected from the same kind of security threat. It also criticized Google for the way it handled the patching process. Prior to the patch's official rollout, the source code for the fix was made public on GitHub, a software collaboration site that hosts computer code. That meant attentive hackers could have learned about the vulnerability before the patch was pushed out to customers, Microsoft claimed. "In this specific case, the stable channel of Chrome remained vulnerable for nearly a month," the blog post said. "That is more than enough time for an attacker to exploit it."

In the past Google has also disclosed vulnerabilities found in Microsoft products -- including Edge.
This discussion has been archived. No new comments can be posted.

Microsoft Chastises Google Over Chrome Security

Comments Filter:
  • Really? (Score:5, Insightful)

    by Anonymous Coward on Sunday October 22, 2017 @02:18AM (#55412269)

    Do we point out Microsoft's long and illustrious history of ignoring critical security flaws now or...

    Do we just point out Chrome isn't crashing computers with their security updates, thus training their users to turn off automatic updates?

    I know, I know, its not the same thing exactly. But you know what they say about people in glass houses.

    • Re:Really? (Score:5, Insightful)

      by dreamchaser ( 49529 ) on Sunday October 22, 2017 @03:39AM (#55412371) Homepage Journal

      I would actually prefer that the major players all try to keep each other honest.

      • Re:Really? (Score:4, Insightful)

        by geekmux ( 1040042 ) on Sunday October 22, 2017 @05:19AM (#55412487)

        I would actually prefer that the major players all try to keep each other honest.

        Being honest is one thing, which I do appreciate.

        That said, Microsoft doesn't have the right to bash a garage-band IoT maker about security flaws response.

        • Re:Really? (Score:5, Insightful)

          by dreamchaser ( 49529 ) on Sunday October 22, 2017 @07:17AM (#55412655) Homepage Journal

          I would actually prefer that the major players all try to keep each other honest.

          Being honest is one thing, which I do appreciate.

          That said, Microsoft doesn't have the right to bash a garage-band IoT maker about security flaws response.

          Everyone, from the lone user to a mega-corporation, has the right to call out security flaws on anyone who exposes others to risk.

          • I would actually prefer that the major players all try to keep each other honest.

            Being honest is one thing, which I do appreciate.

            That said, Microsoft doesn't have the right to bash a garage-band IoT maker about security flaws response.

            Everyone, from the lone user to a mega-corporation, has the right to call out security flaws on anyone who exposes others to risk.

            I was more intending to highlight the fucking irony of Microsoft doing so. As others have said, those in glass houses...

      • Re:Really? (Score:4, Insightful)

        by Dutch Gun ( 899105 ) on Sunday October 22, 2017 @11:52AM (#55413425)

        Agreed. In addition, I'd definitely recommend reading the original Microsoft blog post. [microsoft.com] It's actually not nearly so flame-bait-ish as the breathless headlines and summary imply. It's a fascinating piece of technical detective work, and I think that, while they obviously use this as good propaganda to promote their own technology, the issues they presented seem fair to me.

        They also gave Google kudos where that was deserved, but that doesn't make for very good headlines. For instance:

        This kind of attack drives our commitment to keep on making our products secure on all fronts. With Microsoft Edge, we continue to both improve the isolation technology and to make arbitrary code execution difficult to achieve in the first place. For their part, Google is working on a site isolation feature which, once complete, should make Chrome more resilient to this kind of RCE attack by guaranteeing that any given renderer process can only ever interact with a single origin. A highly experimental version of this site isolation feature can be enabled by users through the chrome://flags interface.

        And consider this:

        Servicing security fixes is an important part of the process and, to Google’s credit, their turnaround was impressive: the bug fix was committed just four days after the initial report, and the fixed build was released three days after that. However, it’s important to note that the source code for the fix was made available publicly on Github before being pushed to customers. Although the fix for this issue does not immediately give away the underlying vulnerability, other cases can be less subtle.

        Note that they don't actually blame open source. That would be foolish, as they're embracing it more and more themselves.

        Some Microsoft Edge components, such as Chakra, are also open source. Because we believe that it’s important to ship fixes to customers before making them public knowledge, we only update the Chakra git repository after the patch has shipped.

        • by epine ( 68316 )

          They also gave Google kudos where that was deserved, but that doesn't make for very good headlines.

          Empirically, one can only conclude that nerds like headlines and summaries that suck moonshite, it's what gives our puny, breathless existence meaning and purpose.

          I tend to judge by the worse thing a person or organization won't fix. Unicode is beyond annoying, but the weedy quality of story summaries here (not all of them, but a sizeable proportion) is far and away the worst thing Slashdot won't fix.

          Yet Slas

          • by tlhIngan ( 30335 )

            Unicode is beyond annoying

            /. has supported Unicode for over a decade now (it was implemented as part of Slashdot.jp, for obvious reasons).

            The problem has always been people who do nothing but use Unicode to abuse the site layout - there's a lot of Unicode codepoints out there and a lot of them have side effects that allow you to easily mess up websites. It's a sure sign of "Unicode is so easy let's add it" and then two days later the comment area is rendered useless because all the trolls abuse it.

            And besi

        • by pthisis ( 27352 )

          Yes. The real problem is that Microsoft is advocating for slow-rolling disclosure of security vulnerabilities by hiding patches until the stable release comes out. That's fine, it's not an insane stance, but they're presenting it as though that's obvious and noncontroversial and that there are no drawbacks to their methodology and no advantages to Google's full disclosure policy. That's where they're being disingenuous--full disclosure vs. slow disclosure is one of the more hotly debated topics in securi

    • Re: (Score:2, Troll)

      You do know IE 6 came out almost 17 years ago right?

      • You do know that the person you replied to didn't mention IE 6, right?

      • You do know IE 6 came out almost 17 years ago right?

        More importantly, how long did developers and businesses had to suffer from this garbage browser?

        • You do know IE 6 came out almost 17 years ago right?

          More importantly, how long did developers and businesses had to suffer from this garbage browser?

          My last employer still used IE 6 heavily. Actually our customers did. 1/3 of our enterprise customers still in 2017 still standardized and developed for IE 6 as the code was written between 1999 - 2004 when it had 95% marketshare and we all logically thought no changes would ever be made again since Microsoft set the standards which was common at the time.

          Due to technical debt and the importance of the apps it is impossible to ever upgrade. THey waited until 2014 to leave XP behind due to IE 6 and decided t

    • by rtb61 ( 674572 )

      How about I can uninstall chrome and gain privacy from google but I can not uninstall wildly privacy invasive elements of Windows 10 and I can not stop M$ installing what ever software they want to unless I never connect a Windows 10 computer to the internet, literally impossible and I can stop Google from install software on my computer. Google my claim a right to my privacy but M$ actually claims a right to my privacy, my PC and my internet connection, well, if I am stupid enough to run Windows 10.

      You ca

    • Do we just point out Chrome isn't crashing computers with their security updates, thus training their users to turn off automatic updates?

      Huh? You can turn off security updates in Chrome and Windows?

    • Why it hasn't been exploited yet, I don't know. But since day one the Windows Firewall lets traffic pass without notification.
      This link claims it's for Windows Product Activation https://support.microsoft.com/... [microsoft.com] and always open. When first released it was known to pass any with a license held by microsoft.

      Takes me Autoruns, and gpedit to disable the Windows firewall and defender.

    • nope, i would call this "healthy competition" as long as it results in the bug getting patched, just keep 'em hacking at each other
  • by phantomfive ( 622387 ) on Sunday October 22, 2017 @02:27AM (#55412283) Journal
    Good has some really good programmers, and so does Microsoft. In the past they were even more impressive.

    But both of them are now process driven companies, primarily focused on not overturning the boat, and the result is code that follows process. As long as process is followed, you don't have to worry about whether you did a good job or not. Just go home at the end of the day. That is the mentality of the vast majority of mediocre programmers at both companies.
    • Good has some really good programmers, and so does Microsoft. In the past they were even more impressive. But both of them are now process driven companies, primarily focused on not overturning the boat, and the result is code that follows process. As long as process is followed, you don't have to worry about whether you did a good job or not. Just go home at the end of the day. That is the mentality of the vast majority of mediocre programmers at both companies.

      Cite?

      • Which part exactly do you disagree with?
        • Which part exactly do you disagree with?

          I didn't say I disagreed (or agreed), I just asked for substantiation of your claims. Are you speaking from personal experience, having worked at Microsoft and Google? Are you relaying information from friends who work there? Do you have some other sort of basis for your claim?

          • You'll have to narrow it down a bit more, I'm not going to give you a citation for every sentence in my post. If there's something I said that seems particularly unlikely, let me know, and I will either give some evidence to support it, give it a disclaimer, or outright retract it.
            • You'll have to narrow it down a bit more, I'm not going to give you a citation for every sentence in my post. If there's something I said that seems particularly unlikely, let me know, and I will either give some evidence to support it, give it a disclaimer, or outright retract it.

              There wasn't that much in the post in question. But, here:

              But both of them are now process driven companies, primarily focused on not overturning the boat, and the result is code that follows process.

              And

              As long as process is followed, you don't have to worry about whether you did a good job or not. Just go home at the end of the day.

              And

              That is the mentality of the vast majority of mediocre programmers at both companies.

              • But both of them are now process driven companies, primarily focused on not overturning the boat, and the result is code that follows process.

                I see evidence of this in a lot of different places. For Microsoft, there is this [blogspot.com], and from what I've heard from people who worked there, it's basically like that all over Microsoft. Similarly, you can see the results in their products (that link shows an example of their processes entering the product in an obvious way). Similarly, at Google, I've talked to people who work there, and it seems about the same. Again you can see it in the output of their product (they must have some good people on the search

    • In the past they were even more impressive

      One of them, yes (hint: not MS)

  • Says it has poor cleanliness standards.

    • by Billly Gates ( 198444 ) on Sunday October 22, 2017 @03:59AM (#55412397) Journal

      IE 6 was made 17 years ago.

      Disclaimer I am using Chrome so I am not drinking the coolaid.

      MS changed to being secure in 2004 with the famous Bill Gates memo. IE 8 matched Chrome 1.0 with kernel level sandboxing in %appdata/lowrights and per threading process since 2009. Firefox just matched IE 8's security this year which is why I dumped it for Chrome in 2011 after the 4.0 fiasco.

      IE 9 started the change to standards with hardware acceleration and IE 11/Edge are fully 100% W3C compliant. Infact I think IE 10 is W3C compliant too and no longer sucked but was a bit behind Chrome and Firefox at the time.

      Anyway I welcome the rapid improvement to security and standards compliance for both. Where Edge sucks is it is more of a mobile browser than a desktop and had issues crashing during the initial Windows 10 build 204100 release 2015. But that is my take.

      • MS changed to being all spyware, all the time with Windows 10.

        An OS which spies on you is the diametric opposite of security.

      • by wjcofkc ( 964165 )
        "Disclaimer I am using Chrome so I am not drinking the coolaid."

        Just what do you think coolaid is?

        Disclaimer, I do not use Chrome since I don't like coolaid, but I have had the chance to use Edge extensively over the past year and found it favorable in every respect. Although Edge is not my primary browser, so I would really like you to elaborate on, "Where Edge sucks is it is more of a mobile browser than a desktop..." As I have no idea what you are talking about.
      • Well, ok, but MS could have pushed way more to get rid of that IE6 insanity earlier and make it more standard (and secure), even during the XP era.
  • by Anonymous Coward

    Local high school basketball coach criticizes NFL team for its poor tackling form on Sunday.

    While I agree with them, it should be noted that Edge is not even in the same league as Chrome.

  • by jarkus4 ( 1627895 ) on Sunday October 22, 2017 @03:00AM (#55412321)

    Bugs happen. What has me worried is a month long waiting time between security fix in public facing repository and release. This pretty much asks for exploitation even by not very skilled "hackers" as interested parties have lots of time to prepare viable exploit based on provided regression tests.

  • by thegarbz ( 1787294 ) on Sunday October 22, 2017 @03:21AM (#55412333)

    I don't know of any other company that has a monthly release cycle for security updates, even for zero day bugs! Google you are evil, you should be like Micros... oh.

    • by thomst ( 1640045 )

      thegarbz quipped:

      I don't know of any other company that has a monthly release cycle for security updates, even for zero day bugs! Google you are evil, you should be like Micros... oh.

      Mod parent +1 Funny, please ...

      • Mod parent +1 Funny, please ...

        I appreciate the support. I have to admit it did not occur to me that a moderator may not have a sense of humour and may need instructions.

        • by thomst ( 1640045 )

          I requested:

          Mod parent +1 Funny, please ...

          Prompting thegarbz to respond:

          I appreciate the support. I have to admit it did not occur to me that a moderator may not have a sense of humour and may need instructions.

          In my experience, most people do not, in fact, possess an actual sense of humor. That's why laugh tracks exist.

          You're welcome, btw - and I'm gratified to see that some moderators have followed my advice, regardless of whether they required it or not ...

  • People who live in glass houses...

  • by aepervius ( 535155 ) on Sunday October 22, 2017 @03:31AM (#55412349)
    ...Trying to outdo each other at finding browser vulnerabilities. Outcome : both browser become more secure.
  • I mean.. seriously?
  • by mentil ( 1748130 ) on Sunday October 22, 2017 @03:37AM (#55412369)
  • by roca ( 43122 ) on Sunday October 22, 2017 @04:30AM (#55412433) Homepage

    I wrote about this:
    http://robert.ocallahan.org/20... [ocallahan.org]
    Summary: In practice, attackers can leverage arbitrary-write bugs to produce the same-origin violations Microsoft warns about without requiring RCE, completely bypassing the CFI mitigations Microsoft is touting here.

  • Microsoft desperately needs money. They are left to find bugs in Chrome to get the $1,000 award
    • Joking aside, I thought people might like to know the actual numbers and result:

      We responsibly disclosed the vulnerability that we discovered along with a reliable RCE exploit to Google on September 14, 2017. The vulnerability was assigned CVE-2017-5121, and the report was awarded a $7,500 bug bounty by Google. Along with other bugs our team reported but didn’t exploit, the total bounty amount we were awarded was $15,837. Google matched this amount and donated $30,000 to Denise Louie Education Center, our chosen organization in Seattle. The bug tracker item for the vulnerability described in this article is still private at time of writing.

      It appears these companies don't pay each other directly, but donate to company-chosen charities. And in Google's case, it looks like it matched those donations, in effect paying double. So, I guess good on both of them for that.

      • It appears these companies don't pay each other directly, but donate to company-chosen charities. And in Google's case, it looks like it matched those donations, in effect paying double. So, I guess good on both of them for that.

        The magic of operations made public.

  • "we set out to examine Google’s Chrome web browser .. is having a strong sandboxing model sufficient to make a browser secure?" Jordan Rabet [microsoft.com] Microsoft Offensive Security Research team

    That's a bit rich coming from Microsoft. Security resides in the Operating not in the Browser. Chrome wouldn't need sandboxing if the underlying Operating System did its job. That is isolate one processes memory from the other. Something the WinTEL platform seem unable to do despite numerous iterations of the x86 proc
    • Chrome wouldn't need sandboxing if the underlying Operating System did its job. That is isolate one processes memory from the other. Something the WinTEL platform seem unable to do despite numerous iterations of the x86 processor.

      Except you still have all the same kinds of flaws in other operating systems, too, which is why Chrome is also sandboxed on other platforms, e.g. Linux [googlesource.com]. It's not just Windows. The techniques vary, but no mainstream OS is designed for security first. That would impinge upon performance. Microsoft literally decided to go the other direction in NT4, specifically in the name of graphics performance.

  • *Bill Maher enters the stage, waits for cheering to calm down*

    Bill - "Good evening ladies and gentlemen, as we've just heard from the tech community,
    Microsoft Chastises Google over Security ..."

    *laughter errupts* ...

  • We found something that's insecure in Chrome that Edge isn't susceptible to!

    Hey, that's reason to celebrate, and use the good champagne. It's not like it happens often.

  • ...as easily as I do in Chrome?

    No?

    Then fuck off with that.

  • "He who is without sin cast the first .... something or other"

  • ... yeah, that's what I thought. They can't fully secure a browser on 1 platform but they're going to call out a browser that runs on no less than 5 platforms? Amateurs.

    https://www.cvedetails.com/vul... [cvedetails.com]
  • Unless you are a teenager, please don't use the slang "throwing shade". It just makes you sound like a old person, desperately trying to appear cool by talking like a teenager.

  • This article brings me the first laugh of this day. Ironic, Don't you think?

"The one charm of marriage is that it makes a life of deception a neccessity." - Oscar Wilde

Working...