So there’s been a bit of debate lately about Google’s Chrome apps after the launch, most of you have probably heard of Chrome OS a while back with a few Chromebooks popping up here and there. Chrome Apps are the next generation of browser apps that can be run offline and eventually will be cross platform (only Windows for now).
The concern is, that Google is opening us up to a whole new era of cross platform exploits/vulnerabilities – the likes we have come to know from Java and Flash.
Google has had a fairly decent security record with Chrome browser and not too terrible with Android, but with a whole new eco-system of apps opening up – it might be out of their control.
Google’s launch of Chrome Apps, a new breed of browser-based software that will run on top of any operating system, has left sceptical security experts wondering whether Google is creating a needless opening for cybercriminals.
Launched late last week, Chrome Apps is Google’s latest step toward embedding its many services in the operating systems of rivals Microsoft and Apple. The goal is make apps running on Google’s platform appear to run natively on either Windows or Mac OS X, respectively.
Even though Chrome Apps require Google’s Chrome Web browser, the software can run outside the browser and offline. Documents, photos and video can be saved on a computer’s hard drive, as well as Google’s cloud storage service, called Google Drive. Updates, including security patches, occur automatically.
Initially, Chrome Apps will run only on Windows and the Google Chromebook, a high-end laptop powered by Google’s Chrome OS. In the near future, Chrome Apps will also run on Mac OS X and Linux.
The strategy behind Chrome Apps is to merge the technology with the host OS, so users do not notice a difference. This all-in-one approach toward the user experience increases the likelihood people will use Google services, which means the company can gather more data to sell to advertisers.
“We want Chrome Apps to be so good you don’t even realize it’s something different,” Rahul Roy-Chowdhury, project manager for Chrome Apps, told The Verge.
From a security aspect it’s a little worrying that they want to make it seamless to the user, so they don’t even realize if they are in the browser, in an app, or it’s just part of the OS.
Another thing to consider is how robust the auto-update/patching features are, and can they really keep users safe? The new auto-updating versions of flash for example, the mechanism just isn’t that effective.
And the Chrome browser, has a tiny little marker in the top right when it needs an update, and has to be restarted – not super obvious to the average user IMHO.
While the goal makes good business sense, security experts worry that Google is creating a layer of complexity that will introduce a new set of vulnerabilities that cybercriminals can exploit. Much of the concern is based on the huge security headache caused by other cross-platform technologies for running applications, such as Adobe Flash and Java, which was developed by Sun Microsystems. Sun was acquired by Oracle in 2009.
“Sun pioneered the write once, infect everywhere model that Oracle has perpetuated,” said Randy Abrams, research director for security adviser NSS Labs.
Because Google gathers enormous amounts of user data, Chrome Apps are unlikely to be welcomed by companies, Abrams said. “There are serious concerns as to privacy and data leakage when it comes to Google,” he said. “Chrome Apps will be a huge concern for enterprises trying to protect intellectual property and other sensitive data, as well as a new security headache.”
Vulnerabilities are a given in every software, so it is important to look at the vendor’s track record for getting out patches quickly. While often criticized for making security blunders in Android, Google’s mobile operating system, the company has incorporated strong security in the Chrome browser and in its Web services.
“They have been really impressive on the security side,” said Wolfgang Kandek, chief technology officer for vulnerability management company Qualys.
The plus side for those of us in the industry, is that enterprise/commercial take-up of this technology is likely to be very low – as most people already have concerns regarding privacy when it comes to Google.
It’ll be interesting to see which way this goes, and of course we’ll have to wait until it’s been around a while and has mainstream usage before we can really judge any security concerns that come to light.
If it’s built with an architecture as secure as the Chrome browser, we should be pretty safe – but as always – we shall wait and see.
Source: Network World
Jordan Rodriguez says
“We want Chrome Apps to be so good you don’t even realize it’s something different,”
What a load. Is that what they call apps and plug-ins causing computers to freeze when the two don’t co-operate? It seems I always have to shut down my shockwave plug-in to freely roam the net without freezing, but then I have to turn it on whenever I go somewhere with media.
I agree with the security problems. Cybercriminals want to go unnoticed. Well, not all of them. But if they can do what Google does, then that’s a serious problem.