Google denies disassembling Vista code for Chrome

The source code underlying Google Chrome web browser suggests Google used a reverse-engineering technique called disassembly to figure out how to use a useful Windows Vista security feature, but the company has denied doing this.

The Google Chrome source code said a particular security feature available on Vista, Data Execution Prevention, can be used on Windows XP SP2 and Windows Server 2003 SP1, though it's not documented for the older operating systems. The source code also said the feature can be understood with a disassembler, a method of reverse-engineering that deconstructs a binary file — such as Windows — into instructions more easily understood by a human.

An explanatory comment in the Google Chrome source code mentions use of a disassembler to figure out the security feature. "Completely undocumented from Microsoft. You can find this information by disassembling Vista's SP1 kernel32.dll with your favourite disassembler," the comment says.

But Google itself didn't take that route. "We did not disassemble this code," the company said in a statement. "The source code indicates that the technique came from please also note that... disassembling is just one of several methods one can use to find this information."

Read this Roundup: Countdown to Google ChromeGoogle's open-source browser sends a clear challenge to Microsoft...

Read more Software companies trying to protect their proprietary software tend not to advocate the use of disassemblers. For example, Vista's End-User License Agreement states: "You may not... reverse-engineer, decompile, or disassemble the software, except and only to the extent that applicable law expressly permits, despite this limitation."

Google defended the practice, though. "Disassembling is a common and accepted practice in software development, frequently used to make sure software features are compatible with other software programs or operating systems," the company said.

Regarding the Data Execution Prevention interface, the Chrome source code says: "Try documented ways first. Only available on Vista SP1 and Windows 2008." The method described at Uninformed comes in a later section, labelled thus: "Go in darker areas. Only available on Windows XP SP2 and Windows Server 2003 SP1."

source:news.zdnet.co.uk

Google's Chrome Browser Not Yet Secure

Google Chrome browser is only a day old, but security researchers already have found vulnerabilities that can be exploited. According to a report published by ZDNet, security researcher Aviv Raff has found that he can combine a flaw in the open source WebKit engine with a Java bug to dupe Google Chrome users into downloading executable files.

Apple, which uses WebKit in its Safari browser, fixed this flaw with its Safari 3.1.2 browser patch. Chrome uses an older version of WebKit that has not been repaired. Another security researcher, Rishi Narang, claimed to have found a way to crash Google Chrome with a malicious link.

"An issue exists in how chrome behaves with undefined-handlers in chrome.dll version 0.2.149.27," Narang explained on the Evil Fingers Web site. "A crash can result without user interaction. When a user is made to visit a malicious link, which has an undefined handler followed by a 'special' character, the Chrome crashes with a Google Chrome message window 'Whoa! Google Chrome has crashed. Restart now?' "

And someone identified as "Nerex" has posted proof-of-concept JavaScript code on Milw0rm.com that supposedly "allows files (e.g., executables) to be automatically downloaded to the user's computer without any user prompt."

This exploit appears to be similar to the one identified by Raff.

In theory, Google Chrome should be more secure than other browsers because, rather than being a single-threaded application, each tab is handled by its own sandboxed process with its own memory space. Like a multiengine plane, Chrome is designed not to crash following the loss of a single engine.

"[Chrome] utilizes technology that has historically been associated with operating systems to create isolation between different browser tabs with the aim of improved crash-resistance and security," IDC analyst Al Hilwa said in a research note. "The security capabilities also ensue from a new sandbox model that strengthens what is typically available today from other browsers."But Chrome is beta software and remains a work in progress.

Hilwa observes that while Google's security architecture isolates the browser's kernel from attacks on rendering-engine vulnerabilities, it doesn't extend this same protection to plug-ins like Java, Flash, and Silverlight.

Mozilla software engineer Robert O'Callahan in a blog post said that while Chrome looks promising, Google's coders still have challenges to overcome. "There are some interesting architectural problems they haven't solved yet, especially with the process separation model, especially with regard to windowless plugins, and also Mac," he said. "These are problems that will be encountered by anyone doing process separation so it will be interesting to see how that goes."

Take a spin through our Google Chrome image gallery and have a look at the browser that's being touted as a game-changer.