Is Google, the greatest single security threat to the Internet?

Forum Moderators: goodroi

Message Too Old, No Replies

Is Google, the greatest single security threat to the Internet?

Brett_Tabke

2:48 pm on Nov 11, 2020 (gmt 0)

I feel the greatest security risk to the internet, is Google. You are not going to patch a major Operating System in 7 days. The only thing Google is doing, is putting the entire internet at risk. [zdnet.com...]

The serious irony here, is that hackers "were using a Chrome zero-day exploit to run malicious code inside Chrome and then use the Windows zero-day to escape the Chrome security sandbox and elevate the code's privileges to attack the underlying OS."

They couldn't even fix Chrome in 7 days! And they were publishing exploits against Window!? WTF. Someone explain to the internet, how this isn't the tech dick move of the last 10 years!?

What can we do?

Google discovered the zero-day around mid-October and gave Microsoft seven days to release a patch. Since releasing a security patch for any Microsoft product —and especially the bulky Windows OS— takes time to test and fine-tune, the patch was not ready during the original seven-day disclosure timeline.

robzilla

6:11 pm on Nov 11, 2020 (gmt 0)

They couldn't even fix Chrome in 7 days!

CVE-2020-15999 was reported [bugs.chromium.org] on October 19, and patched [chromereleases.googleblog.com] the next day.

It's reasonable to reduce the disclosure deadline when a vulnerability is actively being exploited in the wild. Microsoft considered the attack "very limited and targeted in nature, and [said they] have seen no evidence to indicate widespread usage" [techcrunch.com ]. Apparently they did not consider it a priority and bundled the fix with the other updates released this Patch Tuesday. That's very different from saying they couldn't fix it sooner. And Google finding and reporting a vulnerability actively being exploited hardly makes them the enemy of the internet.

tangor

1:12 am on Nov 12, 2020 (gmt 0)

The threat is the sales reach of g to implant chrome on so many units connecting to the web.

Interesting times. I suspect FF users are not quite as concerned at the moment... but even that, eventually, might change!