Chrome has a serious security flaw
The Kim Komando Show
http://i.imgur.com/lNI55nT.jpg
Since Google launched the Chrome browser in 2008, it's built a reputation for speed and security not found in other browsers. While the gap has narrowed in both those areas thanks to improvements in Firefox, and Microsoft creating the new Edge browser for Windows 10, Chrome still has the edge in hacking contests.
That's one reason hundreds of millions around the world have it installed on their computers and mobile gadgets. Unfortunately, a newly discovered security flaw might put that reputation in jeopardy.
A Chinese researcher, Guang Gong, discovered the flaw after three months of work, and built a proof-of-concept he demonstrated at the recent PacSec conference. Using a simple game app with a bit of extra code in it, he forced the phone to call out to a special server and load up a webpage in Chrome containing malicious code.
When the Chrome browser visited the webpage, a flaw in the JavaScript system let the page download another app that took over the Android gadget completely. That's scary, but it gets worse.
Usually, attacks that lead to a full takeover of an operating system require multiple flaws, a number of steps and some user input to work. This attack does it in one go, which means as soon as the user installs a modified app, or visits a malicious page, it's over.
The way Gong's attack works, any app could have the code calling out to a special server with a malicious page. Apps do that all the time for ads and other uses, so it wouldn't trigger any alarms in the Google Play store. That means slipping a malicious app through Google's screening just got easier.
It isn't just Chrome, though. Other researchers are now worried that any third-party app that includes Google's version of JavaScript will also be vulnerable.
Of course, the same flaw exists in the desktop version of Chrome, meaning hackers might adapt it to launch attacks against PCs and Macs. Gong says he informed Google of the flaw in August, but so far there hasn't been a fix released.
Fortunately, Gong hasn't released the details on the flaw, so no hackers should have it yet. Considering it took him three months to find, it will probably be a little while before anyone else figures it out.
Still, you don't want to rely completely on that to stay safe. Here are some things you can do.
- Switch your mobile browser to Firefox on Android and Apple, or go back to Safari on Apple.
- Be careful when clicking on links you get in email or text messages. Only click if you know where it's going and you trust the person who sent it.
- Get a security app that warns you about phishing links and malicious app downloads.
