Google Online Security Blog

Don’t mess with my browser!

31 жовтня 2013 р.

In some ways, it's safer than ever to be online — especially if you use Chrome. With continued security research and seamless automatic updates, your browsing experience is always getting better and more secure. But recently you may have noticed something seems amiss. Online criminals have been increasing their use of malicious software that can silently hijack your browser settings. This has become a top issue in the Chrome help forums; we're listening and are here to help.
Bad guys trick you into installing and running this kind of software by bundling it with something you might want, like a free screensaver, a video plugin or—ironically—a supposed security update. These malicious programs disguise themselves so you won’t know they’re there and they may change your homepage or inject ads into the sites you browse. Worse, they block your ability to change your settings back and make themselves hard to uninstall, keeping you trapped in an undesired state.

We're taking steps to help, including adding a "reset browser settings" button in the last Chrome update, which lets you easily return your Chrome to a factory-fresh state. You can find this in the “Advanced Settings” section of Chrome settings.

In the current Canary build of Chrome, we’ll automatically block downloads of malware that we detect. If you see this message in the download tray at the bottom of your screen, you can click “Dismiss” knowing Chrome is working to keep you safe.

This is in addition to the 10,000 new websites we flag per day with Safe Browsing, which also detects and blocks malicious downloads, to keep more than 1 billion web users safe across multiple browsers that use this technology. Keeping you secure is a top priority, which is why we’re working on additional means to stop malicious software installs as well.

Update: 11/1/13: Updated to mention that Safe Browsing already detects and blocks malware.

Linus Upson, Vice President

reCAPTCHA just got easier (but only if you’re human)

25 жовтня 2013 р.

Posted by Vinay Shet, Product Manager, reCAPTCHACAPTCHA

A new and easier numeric CAPTCHA

Going beyond vulnerability rewards

9 жовтня 2013 р.

Posted by Michal Zalewski, Google Security TeamWe all benefit from the amazing volunteer work done by the open source community. That’s why we keep asking ourselves how to take the model pioneered with our Vulnerability Reward Program - and employ it to improve the security of key third-party software critical to the health of the entire Internet.We thought about simply kicking off an OSS bug-hunting program, but this approach can easily backfire. In addition to valid reports, bug bounties invite a significant volume of spurious traffic - enough to completely overwhelm a small community of volunteers. On top of this, fixing a problem often requires more effort than finding it.So we decided to try something new: provide financial incentives for down-to-earth, proactive improvements that go beyond merely fixing a known security bug. Whether you want to switch to a more secure allocator, to add privilege separation, to clean up a bunch of sketchy calls to strcat(), or even just to enable ASLR - we want to help!We intend to roll out the program gradually, based on the quality of the received submissions and the feedback from the developer community. For the initial run, we decided to limit the scope to the following projects:

Core infrastructure network services: OpenSSH, BIND, ISC DHCP

Core infrastructure image parsers: libjpeg, libjpeg-turbo, libpng, giflib

Open-source foundations of Google Chrome: Chromium, Blink

Other high-impact libraries: OpenSSL, zlib

Security-critical, commonly used components of the Linux kernel (including KVM)

Widely used web servers: Apache httpd, lighttpd, nginx

Popular SMTP services: Sendmail, Postfix, Exim

Toolchain security improvements for GCC, binutils, and llvm

Virtual private networking: OpenVPN

How to participate?Before participating, please read the official rules posted on this page; the document provides additional information about eligibility, rewards, and other important stuff.Please submit your patches directly to the maintainers of the individual projects. Once your patch is accepted and merged into the repository, please follow the submission process outlined here. If we think that the submission has a demonstrable, positive impact on the security of the project, you will qualify for a reward ranging from $500 to $3,133.7. Happy patching!

Security rewards at Google: Two MEEELLION Dollars Later

12 серпня 2013 р.

Posted by Chris Evans and Adam Mein, Masters of CoinChromiumGoogle Webleading standards for response timeChromium VRPPwniumGoogle Web VRPpreviously announced bonusesproviding a patchhow to report a security bug wellhow we determine higher reward eligibilityincreases under the Google Web program

Transparency Report: Making the web a safer place

25 червня 2013 р.

Posted by Lucas Ballard, Software Engineer[Cross-posted from the Official Google Blog]Safe Browsing programTransparency Report

this pageGoogle Webmaster ToolsSafe Browsing Alerts for Network Administrators

Iranian phishing on the rise as elections approach

12 червня 2013 р.

Posted by Eric Grosse, VP Security Engineering[Update June 13: This post is available in Farsi on the Google Persian Blog.]

targeted users within Iranstate-sponsored attackssuspicious activitytake extra steps to protect your accountenabling 2-step verification

Increased rewards for Google’s Web Vulnerability Reward Program

6 червня 2013 р.

Posted by Adam Mein and Michal Zalewski, Security Teamintroducingsupport a school projectupdated rules

Cross-site scripting (XSS) bugs on https://accounts.google.com now receive a reward of $7,500 (previously $3,133.7). Rewards for XSS bugs in other highly sensitive services such as Gmail and Google Wallet have been bumped up to $5,000 (previously $1,337), with normal Google properties increasing to $3,133.70 (previously $500).

The top reward for significant authentication bypasses / information leaks is now $7,500 (previously $5,000).

let us know

Disclosure timeline for vulnerabilities under active attack

29 травня 2013 р.

Posted by Chris Evans and Drew Hintz, Security EngineersXML parsing vulnerabilitiesuniversal cross-site scripting bugstargeted web application attacksrecommendation

Changes to our SSL Certificates

23 травня 2013 р.

Posted by Stephen McHenry, Director of Information Security Engineeringmust

Perform normal validation of the certificate chain;

Include a properly extensive set of root certificates contained. We have an example set which should be sufficient for connecting to Google in our FAQ. (Note: the contents of this list may change over time, so clients should have a way to update themselves as changes occur);

Support Subject Alternative Names (SANs).

shouldhttps://googlemail.com

Matching the leaf certificate exactly (e.g. by hashing it)

Matching any other certificate (e.g. Root or Intermediate signing certificate) exactly

Hard-coding the expected Root certificate, especially in firmware. This is sometimes done based on assumptions like the following:

The Root Certificate of our chain will not change on short notice.
Google will always use Thawte as its Root CA.
Google will always use Equifax as its Root CA.
Google will always use one of a small number of Root CAs.
The certificate will always contain exactly the expected hostname in the Common Name field and therefore clients do not need to worry about SANs.
The certificate will always contain exactly the expected hostname in a SAN and therefore clients don't need to worry about wildcards.

this documentFAQ

The results are in: Hardcode, the secure coding contest for App Engine

10 травня 2013 р.

Posted by Eduardo Vela Nava, Security TeamannouncedSummer of CodeCode-in

Team 0xC0DEBA5EVienna University of Technology, Austria (SGD $20,000)Team GridlockLoyola School, Jamshedpur, India (SGD $15,000)Team CeciliaSecUniversity of California, Santa Barbara, California, USA (SGD $10,000)Team AppDaptorThe Hong Kong Polytechnic University, Hong Kong (SGD $5,000)Team DesiCodersBirla Institute of Technology & Science, Pilani, India (SGD $5,000)Team Saviors of Middle EarthWalt Whitman High School, Maryland, USA

Security Blog