Feeds

Google Oompa-Loompas dream of virus-free OS

Everlasting gobstopper

Using blade systems to cut costs and sharpen efficiencies

Google has rather rashly claimed its plans to develop an operating system promise an end to security woes.

The search giant said Google Chrome OS, due to debut in the second half of next year and initially targeted at netbooks, will be based on open source code and offer unprecedented security.

Sundar Pichai, VP of product management and Linus Upson, engineering director at Google, pledged an end to not just the need to run antivirus but of security updates more generally in a blog posting. The duo go on to boast that Google's sugar-coated OS will also offer speed, simplicity, an end to world hunger and an England Ashes win (we made the last two up).

Speed, simplicity and security are the key aspects of Google Chrome OS. We're designing the OS to be fast and lightweight, to start up and get you onto the web in a few seconds. The user interface is minimal to stay out of your way, and most of the user experience takes place on the web. And as we did for the Google Chrome browser, we are going back to the basics and completely redesigning the underlying security architecture of the OS so that users don't have to deal with viruses, malware and security updates. It should just work.

Carl Leonard, security research manager at Websense, describes Google's goals as commendable but essentially unachievable. He cited flaws in the Chrome browser as example of the kind of issue that were likely to effect Google as much as any other software developer.

"All software is susceptible to issues – it just depends on how much effort the malware author wants to go to and how much profit can be made," Leonard said. "Already we have seen vulnerabilities and issues with the Chrome browser, and Google even ran a contest in which two well-known security researchers found 12 exploitable security flaws in the company's Native Client system."

"Two of the top three security threats (SQL injection, browser vulnerability and rogue av) rely on software flaws so we know that it’s likely that malware authors will be looking for flaws in the Chrome OS to take advantage of from day one," he added.

Google Chrome OS, designed to run on both x86 as well as ARM chips, will run "within a new windowing system on top of a Linux kernel", Google explains. The project to develop a web-based OS for networks is separate from Android, Google's OS for mobile phones and devices such as set-top boxes.

Extended betas of Google's web apps, such as Gmail, incorporate technology to track user experience so its not that much of a stretch to imagine something similar might be incorporated into its Chrome OS, a factor that would have obvious privacy implications.

Graham Cluley, senior technology consultant at Sophos, said details published thus far suggest that apps would run inside a browser rather than getting installed. Such an approach might mix up the malware problem without eliminating it entirely.

"A lot of existing malware won't work but that still leaves potential problems from issues such as cross site scripting worms," Cluley told El Reg. "Storing data in the cloud also poses privacy concerns," he added.

Cluley described Google's security boasts as "marketing blurb" that ought not to to taken too seriously and certainly no reflection on the security expertise the search engine giant is able to call upon. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.