Feeds

Google Chrome OS: Too secure to need security?

Confident anti-virus-less chocolateers may be repeating Apple's mistakes

Secure remote control for conventional and virtual desktops

A leading security researcher has warned that Google risks repeating Apple's mistakes on security with its new Chrome OS.

Google Chrome OS is a Linux-based operating system designed to work exclusively with web applications. Chrome netbooks running the new OS will be available from Google's partners Samsung and Acer from June. In a launch announcement, Google boasted of an end to patching and anti-virus updates woes.

Chromebooks have many layers of security built in so there is no anti-virus software to buy and maintain. Even more importantly, you won't spend hours fighting your computer to set it up and keep it up to date.

Rik Ferguson, a security consultant at Trend Micro, criticised this line as marketing rhetoric. Google risks repeating the security mistakes of Apple, he warns.

Security features of Chrome OS include process sandboxing (so any app is unable to interfere with other apps on a system), automatic updating and a reversion to the last known good state if any problems are detected. This latter feature is possible because user files are stored in the cloud (and encrypted), with only system files held locally.

In addition, every application in Chrome OS will run inside the browser, with only (sandboxes) browser plug-ins running locally.

However this sterile environment is unlikely to last long, not least because Google has created a a Software Development Kit that allows the creation of Chrome "native apps", according to Ferguson, who reckons this open the door towards the creation of malware.

Sandboxing technology ought to prevent any bad apps that are created getting out of their play pen. But Ferguson warns that sandboxing technology is no panacea for security woes.

"Exploits that break out of sandboxing have already been demonstrated for Internet Explorer, for Java, for Google Android and of course for the Chrome browser (to name but a few), while the Google sandbox is effective, it is not impenetrable and to rely on it for 100 per cent security would be short-sighted," he said.

Rebooting laptops and storing data in the cloud is just "moving the goalposts" for scammers, Ferguson further argues. Instead of stealing data on a compromised device, the motivation will shift towards swiping authentication keys. "If I can infect you for one session and steal your keys, well then I'll get what I can while I'm in there and then continue accessing your stuff in the cloud; after all I've got your keys now, I don't need your PC anymore," Ferguson writes.

Ferguson praises Google for its engineering work but questions its apparent suggestion that switching OSes is a "silver bullet" capable of killing off the modern myriad of security woes. He draws a comparison between Google's claim that Chrome needs no anti-virus and similar claims in the past by Apple.

Internet Security Threat Report 2014

More from The Register

next story
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
The DRUGSTORES DON'T WORK, CVS makes IT WORSE ... for Apple Pay
Goog Wallet apparently also spurned in NFC lockdown
Cray-cray Met Office spaffs £97m on VERY AVERAGE HPC box
Only 250th most powerful in the world? Bring back Michael Fish
Microsoft brings the CLOUD that GOES ON FOREVER
Sky's the limit with unrestricted space in the cloud
'ANYTHING BUT STABLE' Netflix suffers BIG Europe-wide outage
Friday night LIVE? Nope. The only thing streaming are tears down my face
Google roolz! Nest buys Revolv, KILLS new sales of home hub
Take my temperature, I'm feeling a little bit dizzy
IBM, backing away from hardware? NEVER!
Don't be so sure, so-surers
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.