Google Security: Acquires Anti-Malware, Stumbles on Vulnerability
Google continues to move further into the security market with the acquisition of Greenborder Technologies, maker of browser-based security tools. Greenborder’s products provide a sandbox for executing code from untrusted sources, From Infoworld:
By running unknown code in such a "time-out" setting, where the content remains isolated from a local host and any trusted network it is connected to, GreenBorder claims to prevent malware programs from delivering their nefarious payloads.Any content arriving on a user's desktop from an untrusted source is visually hosted in a controlled virtual environment highlighted by a green border surrounding programs like Outlook and IE.
Both McAfee (sponsor of this site) and Symantec have this type of technology as well. For Google, this acquisition could help improve the security of their offerings which have suffered some vulnerabilities (but no show stoppers), like the problems with Google Apps, Adwords, and most recently, Google Desktop.
Chris Soghoian of Indiana University found vulnerabilities in Firefox add-ons that can be exploited when plug-ins are updated over poorly secured networks. The vulnerability described by Soghoian affects several popular plug-ins including Google Toolbar and Google Browser Sync. The Security Fix reports:
The problem is especially dangerous with Google's toolbar. Firefox usually will alert users that new versions of installed add-ons are available and give users the option to decline or accept the updates. But Soghoian said Google's toolbar (which is bundled with Firefox) updates without any such prompts.
Unfortunately, while one part of Google is making progress on the security front, who ever deals with security researchers is undermining the company’s image (again from the Security Fix):
Google said it planned to have the vulnerability corrected by today's date, but over the weekend the company asked Soghoian to delay publishing his findings for a few days more while the company worked on a solution. Soghoian declined that request, saying he didn't think it was appropriate for Google to ask for a delay after ignoring his e-mails for 30 days.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
