Google patches Chrome, beefs up malicious file blocking tech
Starts 2012 by paying out $2,000 in bug bounties
Computerworld - Google last week patched Chrome 16 and improved the download warnings in the impending Chrome 17.
Last Thursday, Google updated Chrome 16 with a security update that quashed three bugs, all rated "high," the company's second-most-dire threat rating.
Two of the bugs warranted bounties of $1,000 each, including one to a developer who works for rival Mozilla, maker of Firefox. Google, like Mozilla, pays outside investigators for bugs they report: Last year, Google wrote checks totaling $180,000 to bug hunters.
Also last week, Google released the first beta of the next edition in its line, Chrome 17.
According to Google engineer Dominic Hamon, Chrome 17 expands on the anti-malware download warnings that were first added to Chrome's code in April 2011 and appeared in the stable channel of the browser in June 2011's Chrome 12.
"Chrome now includes expanded functionality to analyze executable files -- such as '.exe' and .msi' files -- that you download," said Hamon in a blog post. "If a file you download is known to be bad, or is hosted on a website that hosts a relatively high percentage of malicious downloads, Chrome will warn you that the file appears to be malicious and that you should discard it."
While download warnings have been part of Chrome since version 12, they have been limited to alerts triggered only when a user tries to retrieve a Windows .exe file from a malicious site.
Although the addition of .msi files -- Windows application installers -- was the only enhancement to Chrome's anti-malware warnings that Hamon mentioned, he promised that others would follow. "We're starting small with this initial Beta release, but we'll be ramping up coverage for more and more malicious files in the coming months," he said.
Chrome uses Google's Safe Browsing technology to identify potentially malicious websites, and files downloaded from them. Apple's Safari and Firefox also rely on Safe Browsing for their malware site blocking.
Google is playing catch-up to Microsoft in this area. Since its March 2011 debut, Microsoft's Internet Explorer 9 (IE9) has used a feature called Application Reputation, or App Rep, to identify a file's contents and its digital certificate to determine whether it's a known application with an established reputation. If App Rep's algorithm ranks the file as unknown, IE9 throws up a warning when users try to run or save the file.
If Google keeps to its usual rapid-release schedule that produces a new version about every six weeks, Chrome 17 will likely ship in final form around Jan. 25.
Chrome 17's beta can be downloaded from Google's website.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is firstname.lastname@example.org.
- Workarounds to purge search bar from Firefox's new tab page are available
- Mozilla ships Firefox 31, adds search to new tab page
- Microsoft's IE steps back from the brink of irrelevance
- Firefox falters, falls to record low in overall browser share
- Firefox risks user backlash by adding search box to new tab page
- Google unseats Microsoft as the U.S. browser powerhouse
- Safari, Chrome push to mask URLs
- Chrome on Windows champs at the 64-bit
- Google pulls trigger, cripples some Chrome add-ons
- Microsoft shoots to shorten Internet Explorer's long tail
Read more about Desktop Apps in Computerworld's Desktop Apps Topic Center.
- PCI 3.0 Compliance In this white paper, learn how PCI-DSS 3.0 effects how you deploy and maintain PCI compliant networks using CradlePoint devices.
- Mitigating Security Risks at the Networks Edge This white paper provides strategies and best practices for distributed enterprises to protect their networks against vulnerabilities, threats, and malicious attacks.
- 5 Strategies for Modern Data Protection Read the five strategies for modern data protection that will not only help solve your current data management challenges but also ensure that...
- 5 Ways Dropbox for Business Keeps Your Data Protected Protecting your data isn't a feature on a checklist, something to be tacked on as an afterthought. Download here to find out how...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!