The Advanced Persistent Threat You Have: Google Chrome [pdf] | Hacker News Reader

The Advanced Persistent Threat You Have: Google Chrome [pdf]

netsq.com

42 pointsepsylon12 comments

This seems like a good paper that isn't actually about something wrong with Chrome. It's about what security tools need to do to track auto-updating software.

"Making of" paper is here: http://www.netsq.com/Documents/MakingOfGoogleAPT.pdf

I found the paper very eye-opening, but perhaps I missed the "moral" of the story. I understand that Google's auto updater can behave similarly to a malicious utility by an APT, but what recourse or mitigation techniques are available? According to the paper, each step individually is indistinguishable from benign activity. Techniques for identifying the end result of the activity and flagging it as suspicious are omitted (or perhaps I missed them).

Presumably Chrome and its updater are digitally signed... not that that stops malware but at least it is another layer.

Others are dumping Chrome for similar reasons: http://www.extremetech.com/computing/210576-why-im-dumping-g...

Deleted comment

The author is not saying Google Chrome is a security risk -- he's saying that malware has goals and behavior similar to Google's software updater.

> Here are just some of the reasons Google’s software update system can serve as a model APT. (1) There is a bootstrapping program, GoogleSoftwareUpdateAgent, buried deeply in a user’s home directory. Few people know it is there, even fewer probably know when it becomes active. It neither requests permission to modify your system nor notifies you when it does. (2) Detailed analysis of this bootstrapping program cannot reveal what it may do because actual actions (via programs & scripts in this case) are only received from the Internet at runtime. (3) A critical executable (one you trust with your passwords for many important network services) will be modified.

The paper then goes on to argue that this is a useful test case for people trying to detect when malware has modified their system, and what it has modified.

The paper does not discuss the security strengths or flaws of Chromium itself --- that discussion is completely tangential to the paper.

The paper is dated 18-Apr-2012

total FUD .. nothing gets updated here unless I want it to. And why isn't the Microsoft software updater or your AV updater considered an equal threat. Who paid for this 'study'.

I can't read through the pages and pages of grandstanding in this PDF, does this at all have some sort of escape of a security boundary, or is it just "I found a weird way to hack myself"?

It's not about hacking; it's about threat modeling using a widespread and well-understood implementation that behaves similarly in many ways to a real threat. Basically, if your APT identification tech can't detect Google Chrome updates being pushed out over your network, you won't be able to detect real malicious actors. A true threat would act in a very similar way, except the payload would be more malicious than Chrome updates.

It's an interesting thought experiment; but no, there are no concrete conclusions.

If you're running Chrome, you've let all the people who can update Chrome into your system. If your security software hasn't detected this, it's snakeoil and won't detect more serious threats either.

Reply on news.ycombinator.com