Ads by TechWords

See your link here
Receive the latest technology news and information.
Networking
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Microsoft researchers devise new browser with stronger security

'Gazelle' browser, still a prototype, would be more secure than Chrome, Firefox or IE, researchers claim

February 23, 2009 12:00 PM ET

Active Comments
Reelix says: If I can break the CW Vote, I can break the new browser ;)...
Anonymous says: Standard is created/improved by people,not the reverse. If a new technology could help you have better life, why sticks to...


IDG News Service - Microsoft Corp. researchers are developing a new Web browser that they say could offer a far greater degree of security than Google's Chrome, Mozilla's Firefox or Microsoft's own Internet Explorer.

The browser, called Gazelle, relies on a "browser kernel" -- 5,000 lines of C# code -- that helps enforce security rules to prevent malicious access to the PC's underlying operating system, according to a recently published paper (download PDF).

So far, Gazelle is just a prototype, with other parts of the browser based on Microsoft's IE. Due to the complex nature of the way it processes Web pages for better security, the browser's performance is more tortoise than gazelle, but the researchers say a few tweaks will make it faster.

Gazelle is different from some other browsers in that it considers each part of a Web site, such as iframes, subframes and plug-ins, as separate elements. Sometimes those elements can pull in malicious content from other Web sites. Google's Chrome runs a Web page and its elements in a single process.

The researchers say that their approach improves reliability and security because processes can't interact with the underlying system and are mediated by system calls supplied by the browser kernel.

In the paper, the researchers are surprisingly critical of the company's forthcoming Web browser, IE8, which uses an approach similar to that of Chrome by using tabs to isolate processes.

"This granularity is insufficient since a user may browse multiple mutually distrusting sites in a single tab, and a web page may contain an iframe with content from an untrusted site (e.g., ads)," the paper reads.

Gazelle goes far to separate elements of a Web page that come from the same registrar-controlled domain. For example, content from Ad.datacenter.com and User.datacenter.com would be considered separate, whereas Chrome "puts them into the same site instance," the paper said.

Another feature of Gazelle is aimed at blocking so-called race condition attacks. In that scenario, an attacker creates a Web page, intending to get a user to click on a particular area of the page. But just before the expected click happens, an overlay appears that could be used to initiate an attack.

Related Blog

Frank Hayes Frank Hayes:
Those that can ... won't
Apple could offer a netbook ... Microsoft could offer a really secure web browser ... But those things won't happen.

Gazelle will ignore any clicks in newly exposed screen areas for about one second until a user can see the new screen areas.

Gazelle is also intended to limit the dangers posed by programming flaws in browser plug-ins. Plug-ins are small bits of code that enable other programs to run within a browser, but they have also been known to contain vulnerabilities that can allow a PC to be hacked.

In Gazelle, the plug-ins are sandboxed, or isolated from the rest of the system, so that a bad plug-in would only affect the particular Web page's plug-in process and not the whole PC.

But one big problem with Gazelle's approach is that existing plug-in code would have to be rewritten or ported to interact with Gazelle's browser kernel system calls. That would be difficult, since plug-ins are written by a wide variety of software vendors whose development schedules don't necessarily work in sync with those of browser developers.

Other parts of Gazelle borrow from IE code that's unrelated to security. For example, the researchers said they didn't want to write a new HTML parser, so they used IE7's Trident renderer and JavaScript engine.

In compatibility tests, Gazelle correctly rendered 19 of the top 20 sites ranked by Web survey firm Alexa Internet Inc. The paper warns that the new security of Gazelle introduces "performance overhead," especially for sites such as The New York Times', but further work should be able to make it faster.


Reprinted with permission from

IDG.net
Story copyright 2009 International Data Group. All rights reserved.

Jump to comments

Microsoft

Additional Resources

WHITE PAPER
Approximately 60 percent of data migration projects overrun time or budget, while some fail completely. Download this white paper, "Enhancing Your Chance for Successful Data Migration," to learn the critical steps you need to take to execute a data migration project with minimum cost and risk to your business.
WHITE PAPER
Read the Gartner research note to learn why the TCO of a server-based computing deployment used to deliver all applications to users is around 50% lower than that of an unmanaged desktop deployment.
WHITE PAPER
Economic downturns have a tendency to accelerate emerging technologies, boost the adoption of effective solutions, and punish solutions that are not cost competitive or that are out of synch with industry trends. This IDC White Paper presents the results of an IDC survey of 330 companies in Western Europe, Asia/Pacific and the Americas that measures the receptiveness to Linux and takes into consideration changing views driven by the disruptive economic environment that businesses face today.

What People Are Saying

White Papers & Webcasts

Southern Company
Download Now  

Aligning IT to Business: The Rising Importance of Application Delivery Networks
Application Delivery Networking (ADN) will play a vital role in helping enterprises incorporate strategic technologies to achieve business initiatives.

Mitigate Risk, Lower Costs and Improve Network Efficiency
Create a stable IP network that not only meets today's challenges, but is flexible enough to also meet future demands.

Share our Strength
Download Now  

Preparing Your Business Services for the Future
Would you trust your network monitoring tools enough to know when something is truly halting a business service?

IPAM: Slashing Network Costs
Slashing Network Costs by Consolidating and Automating Core Network Services

Horror stories: Managing IT Across Multiple Locations
How one extra sharp IT manager eliminates daily agony, hassle and repetition.

Disaster Recovery & Cost Savings Zone
Thousands of customers world-wide have turned to virtualization solutions from Riverbed as a way to reduce costs.