Skip the navigation
)
News

Chrome apes IE8, adds clickjacking, XSS defenses

Adds five new security features to Chrome 4, including two IE8 debuted last March

January 28, 2010 03:58 PM ET

Computerworld - Google yesterday announced it has added several new security features to Chrome, including two that were first popularized by rival Microsoft in Internet Explorer 8 (IE8) last year.

The newest "stable" build of Chrome -- Google's term for a production-quality edition -- includes five security additions that target Web developers who want to build more secure sites, said Adam Barth, a software engineer on the Chrome team.

Of the five features, two are notable because they're already part of IE8, a browser many consider behind the times -- and one that has trouble keeping up with competitors, such as Chrome and Mozilla's Firefox, which are upgraded more frequently.

Chrome now supports "X-Frame-Options," a security feature that helps sites defend against "clickjacking" attacks, Barth announced.

Microsoft added an anti-clickjacking feature to IE8, although one of the security researchers who first reported the problem the year before, said IE's new feature would have "zero impact" on protecting users.

Clickjacking was first used in September 2008 by Robert Hansen, CTO of SecTheory LLC and Jeremiah Grossman, CTO of Whitehat Security, to describe browser-based attacks that tricked users into clicking on site buttons or Web forms. Such attacks hide malicious actions under the cover of a legitimate site, and theoretically can be used to empty online bank accounts, secretly turn on Web cameras or change a computer's security settings.

The other Chrome security feature inspired by IE8 is cross-site scripting protection. "In Google Chrome 4, we've added an experimental feature to help mitigate one form of XSS [cross-site scripting], reflective XSS," Barth said. "The XSS filter checks whether a script that's about to run on a Web page is also present in the request that fetched that Web page. If the script is present in the request, that's a strong indication that the Web server might have been tricked into reflecting the script."

Cross-site scripting attacks were prominent in 2008, less so last year, and are often used by identity thieves as part of a broader phishing campaign.

Barth acknowledged that the XSS filter now in Chrome resembles the one in IE8, as well as the NoScript add-on for Firefox. The difference, Barth argued, is that Chrome's filter comes courtesy of WebKit, the open-source browser rendering engine that is the foundation of Chrome as well as Apple's Safari. Because the XSS filter is integrated with the engine, said Barth, it "can catch scripts right before they are executed, making it easier to detect some tricky attack variations."

Microsoft delivered the final version of IE8 in March 2009.

Google upgraded Chrome for Windows to version 4.0 last Monday. The new edition patched 13 security vulnerabilities, and added support for both bookmark synchronization and browser extensions.

Chrome can be downloaded for Windows XP, Vista and Windows 7 from the company's site.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at Twitter@gkeizer, send e-mail to gkeizer@ix.netcom.com or subscribe to Gregg's RSS feed Keizer RSS.

Read more about Web 2.0 and Web Apps in Computerworld's Web 2.0 and Web Apps Topic Center.



What is Tech Briefcase?
TechBriefcase is a new, free service where IT Professionals can Search, Store and Share IT white papers and content like this. Learn more
Bookmark content
Speed up your research efforts with content across the web.
Search and Store
Find the white papers you need. Create folders for any topic.
View Anywhere
Open your briefcase on your iPhone, tablet or desktop. Share with colleagues.
Don't have an account yet?
Additional Resources
Security KnowledgeVault
WHITE PAPER
Security is not an option. This KnowledgeVault Series offers professional advice how to be proactive in the fight against cybercrimes and multi-layered security threats; how to adopt a holistic approach to protecting and managing data; and how to hire a qualified security assessor. Make security your Number 1 priority.

Read now.

Cut Communications Costs Once and for All
WHITE PAPER
New IP-based communications systems are being deployed by small and midsized businesses at a rapid rate. Learn how these organizations are enabling faster responsiveness, creating better customer experiences, speeding office or mobile interactions, and dramatically reducing existing communications costs.

Read now.

Web 2.0 and Web Apps White Papers
Practice Management: Double Billing Rate and Improve Patient Services
Would you like to double your billing rate and achieve faster payment for services?

Download this customer success story to see how One Health...
Mission Critical Data Explosion and Customer Case Study
Would you like to double your tier 1 storage capacity while simultaneously reducing your storage footprint?

Download this customer success story to see how...
Protecting Against Database Attacks and Insider Threats: Top 5 Scenarios
Read this new eBook to learn the top five scenarios and essential best practices for preventing database attacks and insider threats.
Database Activity Monitoring Is Evolving
Read the analyst report and learn how you can leverage the core capabilities of a DAP solution for better database security.
Establishing a Strategy for Database Security is No Longer Optional
The options for securing increasingly valuable databases are very broad and deep, and can be confusing. This research provides an overview of three...
All Web 2.0 and Web Apps White Papers
Web 2.0 and Web Apps Webcasts
Distributed Database Security with Real-time Monitoring
View this demo and learn how IBM InfoSphere Guardium database activity monitoring can help protect your sensitive data in distributed DBMS environments with...
InfoSphere Warehouse Packs Demo
These flash modules make warehousing more tangible and relevant to business users through detailed explanations of the InfoSphere Warehouse Packs.
Delivery Management -- Extending Lifecycle Management
Date: Wednesday, June 20, 2012, 1:00 PM EDT

Siloed organizations continue doing the wrong things and doing things wrong, leading to increased costs,...
Leverage automation today to reduce IT complexity
Date: Tuesday, June 5, 2012, 2:00 PM EDT

Whether your B2B complexity is caused by multiple technologies due to M&A, business or application specific...
Redefine Expectations in the Data Center
Need to do more with less? Watch this video to learn how HP ProLiant Gen8 servers can help your business deploy servers three...
All Web 2.0 and Web Apps Webcasts
Newsletter Sign-Up

Receive the latest news test, reviews and trends on your favorite technology topics

Choose a newsletter
  1. View all newsletters | Privacy Policy
IT Jobs