Security Firm Cracks Chrome's Sandbox

[Guest]

Your Chrome browser has a secret vulnerability.

Security Firm Cracks Chrome's Sandbox : Read more

 

[NapoleonDK]

...(with the exception of a version of Firefox 4 that runs inside a Linux virtual machine)...

For the love of bob, that's a regular Firefox 4 crammed into a VM dammit. It's not special! >.

 

[Zingam]

I have a better solution Firefox in Ubuntu running in VirutalBox on Solaris running on QEMU on Fedora running in VirutalBox in Boxee on Windows. That should be secure???

 

[Anomalyx]

but will be sharing it only with its government customers.

So... why the heck aren't they sharing it with Google so the vulnerability can be patched quickly? Yet they're sharing it with governments... This reeks of government corruption, as if we didn't already have enough of it...

 

[officeguy]

I can crack Chrome's Sandbox in 3 seconds. Just give me a sledge hammer 😀

 

[hellwig]

(with the exception of a version of Firefox 4 that runs inside a Linux virtual machine)

You don't need firefox OR Linux. By that logic, IE6 running on Windows ME in a virtual machine is just as secure, assuming you run in snapshot mode and revert the VM back to a clean install after each session. A VM is a VM, if someone gains control of the VM, you just shut it down, that's sort of the whole point.

I am doing something similar every time I need to visit GameCopyWorld: running Opera in a snapshot of "XP Mode" on Windows 7. I've been doing this ever since a malicious ad on GameCopyWorld installed some fake antivirus on my machine a while back. It was my own stupid fault, I clicked "Ok" on a popup that said "This website requires Java to run", and they actually still have those ads, Yay! Anyway, I can do whatever I want, and then simply "Undo" changes to the VM disk. The VM rolls back to a clean state each time. Of course, I thoroughly scan any files I download (because if I actually need the file, I need to make sure it's virus-free), but if anyone manages to exploit something in my browser or the OS, they only get my VM and nothing else.

 

[Anomalyx]

[citation][nom]Zingam[/nom]I have a better solution Firefox in Ubuntu running in VirutalBox on Solaris running on QEMU on Fedora running in VirutalBox in Boxee on Windows. That should be secure???[/citation]
Nope, there's Windows somewhere in the chain, then it's insecure =P jk
As long as you keep Apple OS's out of the chain, you're fine. I can't help but think that it's a bit overcomplicated, though... 😵

 

[NapoleonDK]

[citation][nom]Zingam[/nom]I have a better solution Firefox in Ubuntu running in VirutalBox on Solaris running on QEMU on Fedora running in VirutalBox in Boxee on Windows. That should be secure???[/citation]I'm trying this when I get home. 😀

 

[milktea]

The hack works on all “default” Chrome installations

Hint! The hack has to do with the settings of Chrome? 😀

 

[CsG_kieran_2]

A browser is as secure as the OS it runs on.
Ubuntu ftw! 😀

 

[everygamer]

I would expect they are going to let Google know so that they can alter the security, it would be in their best interests (and those government customers of theirs) to do so.

 

[legacy7955]

[citation][nom]everygamer[/nom]I would expect they are going to let Google know so that they can alter the security, it would be in their best interests (and those government customers of theirs) to do so.[/citation]

My bet is that this was already done the moment the hacking was achieved.

Like most corporate media stories you rarely get the WHOLE picture. That is no accident either.

 

[dioxholster]

safest browser is Opera.

 

[eddieroolz]

"except sharing with government customers"

Why not Google too, so they can patch it? Or do governments want to keep this as a "backdoor" to hack into people's browsers?

 

[IzzyCraft]

[citation][nom]dioxholster[/nom]safest browser is Opera.[/citation]
maybe if you consider it not a target of people attacks then sure. Opera is down there with safari when you talk about security features. The best is chrome and IE(IE out of necessity, chrome out of wanting to show off)

 

[wifiwolf]

[citation][nom]hellwig[/nom]You don't need firefox OR Linux. By that logic, IE6 running on Windows ME in a virtual machine is just as secure, assuming you run in snapshot mode and revert the VM back to a clean install after each session. A VM is a VM, if someone gains control of the VM, you just shut it down, that's sort of the whole point.I am doing something similar every time I need to visit GameCopyWorld: running Opera in a snapshot of "XP Mode" on Windows 7. I've been doing this ever since a malicious ad on GameCopyWorld installed some fake antivirus on my machine a while back. It was my own stupid fault, I clicked "Ok" on a popup that said "This website requires Java to run", and they actually still have those ads, Yay! Anyway, I can do whatever I want, and then simply "Undo" changes to the VM disk. The VM rolls back to a clean state each time. Of course, I thoroughly scan any files I download (because if I actually need the file, I need to make sure it's virus-free), but if anyone manages to exploit something in my browser or the OS, they only get my VM and nothing else.[/citation]

I did that too for some years back with vmware but there are ways to get to the host passing through the vm. That's why this virtual machine had to be done using a reputable solid security OS and tweaked for even more security.

 

[dalethepcman]

Hrmm I don't know about most secure, but using the built in android browser from the android SDK within windows is pretty safe, and its touch screen responsiveness is better than any of the add ons for chrome or Firefox

 

[fir_ser]

Nothing is 100% secure, every program has its weaknesses.

 

[f-14]

[citation][nom]Anomalyx[/nom]So... why the heck aren't they sharing it with Google so the vulnerability can be patched quickly? Yet they're sharing it with governments... This reeks of government corruption, as if we didn't already have enough of it...[/citation]
it's customers, which happenes to be the government. or do you always work for free?
if you work for free boy do i have a job for you!

 

[mayankleoboy1]

ubuntu FTW!