Browser security: lessons from Google Chrome

ABSTRACT

To shield the browser from attacks, Google Chrome developers eyed three key problems.

REFERENCES

• 1: Barth, A., Jackson, C., Reis, C., and Google Chrome team. The Security Architecture of the Chromium Browser (2008); http://crypto.stanford.edu/websec/chromium/chromium-security-architecture.pdf.
• 2: Douceur, J.R., Elson, J., Howell, J., and Lorch, J.R. Leveraging legacy code to deploy desktop applications on the Web. In Proceedings of Operating Systems Design and Implementation (2008).
• 3: Duebendorfer, T., Frei, S. Why silent updates boost security. ETH Tech Report TIK 302 (2009); http://www.techzoom.net/silent-updates.
• 4: Franco, R. Clarifying low-rights IE. IEBlog (June 2005); http://blogs.msdn.com/ie/archive/2005/06/09/427410.aspx.
• 5: Stefan Frei , Thomas Duebendorfer , Bernhard Plattner, Firefox (In) security update dynamics exposed, ACM SIGCOMM Computer Communication Review, v.39 n.1, January 2009 [doi>10.1145/1496091.1496094]
• 6: Google. Omaha: Software installer and auto-updater for Windows. Google Code; http://code.google.com/p/omaha/.
• 7: Chris Grier , Shuo Tang , Samuel T. King, Secure Web Browsing with the OP Web Browser, Proceedings of the 2008 IEEE Symposium on Security and Privacy, p.402-416, May 18-21, 2008 [doi>10.1109/SP.2008.19]
• 8: Howard, M., Thomlinson, M. Windows Vista ISV Security (2007); http://msdn.microsoft.com/en-us/library/bb430720.aspx.
• 9: Mayer, M. "This site may harm your computer" on every search result. The Official Google Blog (Jan. 2009); http://googleblog.blogspot.com/2009/01/this-site-may-harm-your-computer-on.html.
• 10: Niels Provos , Dean McNamee , Panayiotis Mavrommatis , Ke Wang , Nagendra Modadugu, The ghost in the browser analysis of web-based malware, Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets, p.4-4, April 10, 2007, Cambridge, MA
• 11: Charles Reis , Steven D. Gribble, Isolating web programs in modern browser architectures, Proceedings of the 4th ACM European conference on Computer systems, April 01-03, 2009, Nuremberg, Germany [doi>10.1145/1519065.1519090]
• 12: Sandbox. Chromium Developer Documentation (2008); http://dev.chromium.org/developers/design-documents/sandbox.
• 13: Wang, H.J., Grier, C., Moshchuk, A., King, S.T., Choudhury, P., and Venter, H. The Multi-Principal OS Construction of the Gazelle Web Browser. Microsoft Research Technical Report (MSR-TR-2009-16) 2009; http://research.microsoft.com/pubs/79655/gazelle.pdf.
• 14: Bennet Yee , David Sehr , Gregory Dardyk , J. Bradley Chen , Robert Muth , Tavis Ormandy , Shiki Okasaka , Neha Narula , Nicholas Fullagar, Native Client: A Sandbox for Portable, Untrusted x86 Native Code, Proceedings of the 2009 30th IEEE Symposium on Security and Privacy, p.79-93, May 17-20, 2009 [doi>10.1109/SP.2009.25]

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

Additional Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.3 Communications Applications

  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce