Operation “Aurora”, the sophisticated Chinese cyber attack that hit several dozen companies in December 2009, not only compromised the intellectual property of the companies, but also raised the critical issue of Internet browser security.

The primary enabler of this specific exploit was an un-patched vulnerability in Microsoft Internet Explorer (IE). By taking advantage of this unfixed security hole in the popular Web browser, cyber attackers compromised users systems. It happened when a victim was lured into navigating to a malicious web page from a vulnerable Microsoft Windows system, where JavaScript code then exploited the vulnerability. The infected system then contacted remote servers controlled by the attackers, allowing them to view, create, and modify information on the compromised system.

Browser vulnerabilities affect all Web browsers and vendors and are far from being an issue for Microsoft’s exclusively. However, since it’s the most commonly used browser with hundreds of millions of users around the world and the largest market share, Internet Explorer naturally tends to be a favorite target for cyber attacks. Yet, Apple Safari, Opera or Mozilla Firefox have had their share of security flaws, which, if exploited, could also lead to the same type of attack that we witnessed recently.

In spite of vendors’ constant efforts to release new, higher performance, more secure web browsers – for example, Google recently launched the ‘Google Chrome’ browser and Microsoft is currently testing now a new ‘Gazelle’ browser — numerous Web browser attacks and vulnerabilities continue to be reported. In 2009 alone, over 300 browser vulnerabilities were publicly reported in the CVE (Common Vulnerabilities and Exposure) repository, including several dozens for each vendor.

What makes the Web browser such a popular vector of attacks?

The Web browser is one of the most ubiquitous applications used throughout the computing community. Browsers today integrate many complex applications such as ActiveX, Cookies, Plug-In, Flash Player, Java, Acrobat Reader and so on, which extend the browsers’ functionalities and enable them to host graphics, friendly users’ interfaces and all sorts of animations. Many websites actually require the user to install additional software to enable these features.

Alternatively, those bundled programs are commonly enabled in most browsers’ default settings.

Each application, however usable it is, likely contains additional flaws and vulnerabilities in addition to the web browser itself, therefore increasing the total security risks for users. Some of the risky web features include:

ActiveX:
Used by Microsoft Internet Explorer on Microsoft Windows systems, ActiveX is a technology that has seen various vulnerabilities and implementation issues. One of the latest ActiveX vulnerabilities was discovered in July 2009 in Microsoft DirectShow Video ActiveX Control. The exploit, through drive-by-attacks, compromised thousands of Web sites, which in turn infected endpoints with malware and exposed companies to potential data leakage.

Java:
Java is an object-oriented programming language used to develop active content for Web sites. Many software applications contain security vulnerabilities in their implementation of Java, allowing for arbitrary code execution with the same privileges as the current user.

Plug-ins:
Plug-ins are applications that are intended for use in the Web browser. They may contain programming and design flaws, such as cross-domain violations and buffer overflows. Adobe Flash Player is an example of a browser plug-in that has been affected by dozens of vulnerabilities in the past year.

In a browser attack, what hackers typically do is create deceptive Web pages or links that redirect the user to undesired locations that then download malicious software on to the users’ PC. The attacker then exploits the access — as if they are the user with full-rights — and can steal sensitive or private information, hijack the browsing session or use the original target computer to attack other computers. These exploits can even affect secure websites protected by SSL certificates, such as banks or credit card companies.

“Web browsers represent a serious security threat,” explains Guy Guzner, director of security products at Check Point. “While many years ago you could get infected typically if you downloaded a bad program or perhaps pirated software from very odd web pages, today hackers inject malware directly into reputed websites including news sites users browse every day, so that just by browsing into a web page today your computer can get infected,” he says. So how do you stay safe?

The best ways to block web browser attacks on the end-point level is by ‘sandboxing’ the browser. Sandboxing, also called browser virtualization, prevents the browser to affect user data, other applications, or the operating system.

“Check Point endpoint security suite offers today Browser Security virtualization and virtualizes the browsing session to provide users protection against zero-day vulnerabilities, drive-by downloads and to prevent other types of Web-based threats from damaging their PC. Our WebCheck virtualization technology redirects the Web attacks to a sandbox where it remains trapped and cannot harm the operating system,” says Guzner.

This feature is available for consumers in Check Point’s Zone Alarm Extreme Security software.

In an enterprise environment, to safeguard against Web-based threats it is also highly recommended to complete protection with an IPS system that will detect and block these attacks. “Based on its Software Blade architecture, Check Point IPS Software Blade provides complete in-line firewall intrusion prevention capabilities at multi-gigabit speeds, with preemptive threat coverage for clients, servers, OS from vulnerabilities, malware/worm infections, and more,” adds Guzner.

In addition to implementing these protections, Internet users and administrators should regularly patch and update their browser to make sure they are using the latest version. The browser plug-ins and surrounding applications should be patched regularly. For ultimate protection, users should disable the browser functionalities and configure security settings so that Java applets, JavaScript and VBScript, ActiveX controls don’t run automatically. This will decrease the risk of attacks through feature vulnerabilities.

“All web browsers have security holes. New vulnerabilities are discovered all the time and no browser is completely immune or secure today — regardless of performance or how up to date they are,” concludes Guzner.

After all, just like browser technologies evolve, so do threats and cyber criminals. So to continue browsing safely on the Internet and avoid unpleasant experiences, the best advice is to take your browser security seriously.

SAN FRANCISCO – Google’s Chrome OS is coming to a netbook near you sometime later this year. The Web-centric, Linux-based, open source platform will offer a lightweight, cost-effective alternative operating system for portable computing. Eventually, Google plans to expand the scope of Chrome OS to take on Windows on the desktop as well–a goal that requires both a solid operating system and a significant culture shift.

Chrome is essentially a Web browser as an operating system. A media player app will be included that will facilitate offline music play and photo viewing, but aside from that the platform is designed to operate exclusively in the cloud and take advantage of the vast portfolio of services from Google.

The operating system seems ideal for the netbook crowd, or possibly even as a platform for tablet devices to compete with Apple’s iPad. Netbooks and tablets generally lack CD or DVD drives and the smaller hard drive sizes of the diminutive portable laptops seem geared for storing only the core OS components. An open source operating system that can reduce costs and make the hardware into more of instant-on, cloud-based device might be welcome among the netbook crowd.

The Chrome OS might also provide a solid alternative for a tablet OS. Apple has built the iPad on the iPhone mobile OS, HP is building the Hurricane on Palm’s WebOS mobile OS, and the Dell Streak is built on Google’s Android mobile OS. There is demand, though, for a tablet that is more like a desktop and less like a smartphone. It remains to be seen if Windows 7 can be nimble enough to satisfy in the tablet market, but the Chrome OS seems to comfortably straddle between mobile OS and desktop OS–a potentially ideal position for a tablet OS.

But, what of Google’s aspirations to usurp the crown of desktop dominance from Microsoft? Assuming that the Chrome OS lives up to expectations and provides a polished, capable experience, there is still a long way to go before a Web-centric OS can even begin to replace the traditional desktop operating system (a.k.a. Windows).
Look, the Mac operating system has been available since 1984 and has only five percent of the OS market. Linux has been around since 1991–or 1994 if you want to start counting from the 1.0 release, yet Linux in all of its varieties has barely more than one percent of the operating system market. Can we really expect Chrome to knock Microsoft off its pedestal any time soon when two very capable operating systems have been barely able to scratch the surface after 20 years?

At its heart, Chrome is just another version of Linux. However, the Google brand carries a lot of consumer clout. It is respected. It is trusted. Businesses and consumers alike are much more likely to adopt a Linux variant with the Google stamp of approval, so it has that going for it. But, Apple is also respected, and trusted, and has a strong and loyal following…and five percent of the market.

Many small and medium businesses are already invested in Google. They rely on Gmail for messaging, Google Docs for office productivity, Google Voice for communicating, and Google Wave and/or Google Buzz for collaborating and social networking. Chrome will work nicely for them.

Many organizations, though, are reluctant to put that much faith in the cloud. There are availability and security concerns. Many companies will need to address the compliance issues associated with trusting personal information, and sensitive or confidential data to third-party providers such as Google. There are some hurdles to overcome before the desktop culture can be abandoned completely.

What Chrome needs in order to compete with, or replace Windows as the desktop standard is a complete culture shift. Chrome most likely won’t be any more successful than Mac or Linux in fighting Windows on its own turf, but as the culture continues to evolve to a more mobile, more cloud-based model, it plays to Chrome’s strengths and arguably puts Windows on the defensive to scramble and adapt.