Google patches Chrome, beefs up malicious file blocking tech
Starts 2012 by paying out $2,000 in bug bounties
Computerworld - Google last week patched Chrome 16 and improved the download warnings in the impending Chrome 17.
Last Thursday, Google updated Chrome 16 with a security update that quashed three bugs, all rated "high," the company's second-most-dire threat rating.
Two of the bugs warranted bounties of $1,000 each, including one to a developer who works for rival Mozilla, maker of Firefox. Google, like Mozilla, pays outside investigators for bugs they report: Last year, Google wrote checks totaling $180,000 to bug hunters.
Also last week, Google released the first beta of the next edition in its line, Chrome 17.
According to Google engineer Dominic Hamon, Chrome 17 expands on the anti-malware download warnings that were first added to Chrome's code in April 2011 and appeared in the stable channel of the browser in June 2011's Chrome 12.
"Chrome now includes expanded functionality to analyze executable files -- such as '.exe' and .msi' files -- that you download," said Hamon in a blog post. "If a file you download is known to be bad, or is hosted on a website that hosts a relatively high percentage of malicious downloads, Chrome will warn you that the file appears to be malicious and that you should discard it."
While download warnings have been part of Chrome since version 12, they have been limited to alerts triggered only when a user tries to retrieve a Windows .exe file from a malicious site.
Although the addition of .msi files -- Windows application installers -- was the only enhancement to Chrome's anti-malware warnings that Hamon mentioned, he promised that others would follow. "We're starting small with this initial Beta release, but we'll be ramping up coverage for more and more malicious files in the coming months," he said.
Chrome uses Google's Safe Browsing technology to identify potentially malicious websites, and files downloaded from them. Apple's Safari and Firefox also rely on Safe Browsing for their malware site blocking.
Google is playing catch-up to Microsoft in this area. Since its March 2011 debut, Microsoft's Internet Explorer 9 (IE9) has used a feature called Application Reputation, or App Rep, to identify a file's contents and its digital certificate to determine whether it's a known application with an established reputation. If App Rep's algorithm ranks the file as unknown, IE9 throws up a warning when users try to run or save the file.
If Google keeps to its usual rapid-release schedule that produces a new version about every six weeks, Chrome 17 will likely ship in final form around Jan. 25.
Chrome 17's beta can be downloaded from Google's website.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
- Mozilla ships Firefox 31, adds search to new tab page
- Microsoft's IE steps back from the brink of irrelevance
- Firefox falters, falls to record low in overall browser share
- Firefox risks user backlash by adding search box to new tab page
- Google unseats Microsoft as the U.S. browser powerhouse
- Safari, Chrome push to mask URLs
- Chrome on Windows champs at the 64-bit
- Google pulls trigger, cripples some Chrome add-ons
- Microsoft shoots to shorten Internet Explorer's long tail
- Firefox risks irrelevance as mobile browsing booms
Read more about Desktop Apps in Computerworld's Desktop Apps Topic Center.
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!