Computer Support Network

Google’s Chrome internet browser has remained the high water mark for web browser security for four years but that legacy has finally been broken.  Chrome, which entered the browser marketplace back in 2008 quickly gained a name for itself for being the fastest web browser as well as functionally hacker proof.  Google has taken part in Pwn2Own—a security competition run by HP—for the last four years and matched Chrome against the likes of Safari, Internet Explorer and Firefox.  For four years Chrome remained the sole competitor un-hacked by the competitors.

This year however, Google let their pride get the best of them and offered a $60,000 prize for anyone who could crack their code.  A Russian college student stepped up to the challenge during the Google hosted Pwnium event.  Sergey Glazunov submitted a hack that completely bypassed the security measures built into the Chrome browser.  ZDNet reports that a previously undiscovered exploit was used to bypass its “sandbox”—a restriction designed to stop hackers from accessing the rest of a user’s computer even if they do compromise the browser. When asked about the exploit, Justin Schuh, a member of the Chrome security team, revealed that the exploit was specific to Chrome and bypassed the browser security sandbox entirely.  ”It didn’t break out of the sandbox [but] it avoided the sandbox,” Schuh said in an interview.

Google was left embarrassed a second time as a French security firm showed that they had their own hack to bypass the browser; a feat that was accomplished in only five minutes.

Google is already working on fixes for the exploits and expects to have the solutions released within days as part of Chromes automatic system updates.  Regardless, Google can no longer flaunt Chrome as the hack proof browser and reinforces the adage that there is no such thing as a truly secure security system.

- Richard Keene
IT Computer Support of New York
Design and Optimization Department

The current browsers wars will be on topic for this week’s Tech Wars Software feature but I wanted to preface with this weekend’s Firefox milestone.  The newest version of Firefox reached 104 million downloads over the weekend, a milestone that was achieved in just over a month.  Firefox has held onto its #2 spot in the browser wars for over 4 years but the speed with which the general populous upgraded to the newest version is quite remarkable.

According to the analytics firm Net Applications, Firefox holds onto a 21.8% market share, less than half of Internet Explorers 55.92% but far ahead of both Chrome at 11.57% and Safari at 6.61%.  Firefox 4 represents the first “full” redevelopment the browser has seen in three years and totes a number of new features and performance updates.  What is amusing is that many of the toted new features have been taken almost directly from Google Chrome (Something we will cover on Friday).

Firefox’s claim to fame has always been the efficiency of the browser and generally heightened security over Internet Explorer.  With the newest release Firefox takes this further with a new Content Security Policy designed to stop both XSS attacks and malicious code deployment.

Firefox has a fine lead over much of the competition but faces a difficult future as Chromes fan base seems to be doubling about every 6 months and the popularity of Apple products has redoubled exposure to Safari.  The pertinent question here, however, is who will be the first competitor to take down Internet Explorer?

- Richard Keene
IT Computer Support of New York
Design and Optimization Department

When Google released the beta version of Google Chrome earlier this year it was received with a mixed reception. The browser that had been announced as faster and more secure then either Firefox or Internet Explorer proved instead to be little more than a cosmetic alternative. Now however, Google is ramping up its Chrome promotion campaign by cutting default stature from Firefox.

Until recently Firefox had been the default browser selected as part of the Google Pack. For those unfamiliar with it, the Google pack is a set of productivity applications that Google packages for users. The package includes applications such as Spyware Doctor, Picasa, Adobe Reader, Google Earth, Norton Security Scan, and now Google Chrome. Advanced users won’t likely be bothered by the need to select one extra option. Casual users on the other hand are unlikely to go through the extra trouble, and will accept whatever is given to them by default. Additionally, Google has also removed all of the Firefox promotions that used to be included in Google Properties. Mozilla Firefox is depended on Google as their main source of income so if Google continues to aggressively oppose Firefox the company could find themselves in economic hardship.

A second part of the Google Chrome campaign is actually set to put Internet Explorer in more damage than Firefox. Google reportedly plans to sign a deal starting in 2009 which would have computer manufactures preinstall Google Chrome as the default browser on computers. It has long been acknowledged that casual users will remain with whatever default internet browser is installed on their computer. This is primary factor in why Internet Explorer remains the most used Internet Browser despite numerous superior alternatives. A distributer for the deal hasn’t been announced but if it ends up being a partnership with a computer giant such as Dell, this could upset the current browser war into Google’s favor.

- Richard Keene
IT Computer Support of New York
Design and Optimization Department

Microsoft announced Tuesday that a critical vulnerability has been found in Microsoft Internet Explorer 7. The flaw in the browser can allow cybercriminals to gain access to your computer and steal your passwords. Security experts are advising users to switch to an alternate internet browser until an emergency patch can be issued.

It is highly recommended that all Internet Explorer 7 users cease using the browser until Wednesday night.

(Update)

Microsoft has now released a Critical Security Update for Internet Explorer. View the full Security Bulletin here.

- Richard Keene
IT Computer Support of New York
Design and Optimization Department

On Wednesday Microsoft announced that the previously expected end of year release of Internet Explorer 8 would be pushed back into 2009. IE8, which entered public beta in March has undergone scrutiny for compatibility issues but was still expected to be ready for a winter 2008 release. The news that this will no longer happen has unleashed further hostility in the community from those who have adopted Firefox.

Microsoft has touted a number of new features with the release of Internet Explorer 8 but the delay has stressed validity. The problem with many of the features, such as deleting browsing history and enhanced crash recovery is that these features have already been incorporated in competitors browser’s for years. Other features such as Web Slices feel gimmicky and not worthy of holding up a project. The most important upgrades are for security and an improved rendering engine, but again, these features have already been done. Why is it taking Microsoft so long to implement them?

The release of Windows 7 is planned for the second half of 2009 and is expected to ship with IE8. Considering the complications that would arise if the operating system shipped with a broken browser it can be expected that a standalone version will ship prior to the launch. It will be interesting to see if Microsoft can get its act together and release a product worthy of the version update by then.

For years Microsoft Internet Explorer has retained the largest market share of browsers despite falling into last place with performance. In recent years this has begun to fall but the majority of computer users still will not seek out a new browser and so Microsoft remains on top. With the eventual release of IE8 one can only hope Microsoft finally earns that place.

- Richard Keene
IT Computer Support of New York
Design and Optimization Department

Chrome Beta 3 arrived recently to the fanfare of Google aficionados but few others. What is Chrome you might ask? Well for the uninitiated its Google’s news web foray; a proprietary internet browser that they had hoped would surpass IE and Firefox in user base. The promise behind Chrome stems primarily from its pedigree. The Google search engine took the world by storm and has grown to become an everyday household term. Google had hoped to do the same for web browsers.

So have they succeeded? Not quite. When the first Chrome Beta was released they held a respectable portion of the market share but since then users have actually dwindled. Currently Google Chrome has now settled into a holding pattern around 0.7 percent browser market share. The biggest problem facing Chrome is that there is already a competitor doing what they intend. Within the last five years, Firefox has quite literally taken the internet by storm.

As it stands now Chrome is the fastest browser on the market. Chrome is also secure, easy to use and attractive looking. But as for new killer features Chrome has very little to offer. Firefox already has the security, functionality, and higher degree of customization than any other browser on the marketplace. Also, looking at time frame, Firefox overtook Internet Explorer in functionality years ago but did not come close to matching its market share until quite recently. As a secure and reliable platform most people simply don’t see a reason to switch browsers. For this reason it is unlikely that Chrome will make any great leaps in its market share. It is not a bad product; just that for most users, there is no reason to upgrade from something that already works.

- Richard Keene
IT Computer Support of New York
Design and Optimization Department