Chrome has a new way to keep Specter hackers at bay

By adding a new compartmentalisation technology, Google's Chrome browser has taken action to prevent websites from stealing sensitive data.

Since its first public release in 2008, Chrome has divided the work between several IT processes. This approach avoids the work of one tab interfering with what happens in another. Google has tested a stricter variant of this type of partitioning to protect against Specter, a new type of attack that Google and other researchers have revealed in January.

Google released the new security feature, called site isolation, to a limited number of Chrome users starting with the Chrome 67 version in May. Now, it's "enabled for 99% of users on Windows, Mac, Linux and Chrome OS," said Charlie Reis, a member of the Chrome team on Wednesday

which shows just how much Specter and the Meltdown attacks are complicated. counter. Technology companies that manufacture processors, operating systems and browsers have all collapsed to prevent hackers from using vulnerabilities to snatch sensitive data like passwords or keys from encryption . The problem is serious enough to be brought before the US Congress, where senators were complaining on Wednesday that they had not heard of Specter earlier.

Uses more memory

Google's site isolation feature is a major change to Chrome. It affects a central part of the browser called the rendering engine, which turns the programming code of the website into real pixels on your phone or laptop screen. With site isolation, Chrome more often divides rendering engines into separate computational processes to further isolate the data.

Unfortunately, this means that Chrome needs more memory. The increase is in the range of 10 to 13% for people with many open tabs, says Google in a project document. The good news, though, is that the site's isolation allows Google to loosen the previous restrictions on accurately tracking browser actions that it has adopted to make attacks more difficult.

"Our team continues to work hard to optimize Chrome and secure," Reis said in the blog, and he is also working on the Chrome site's isolation for Android, he said.

Isolation of site, a ten-year project

Reis has been working on site isolation technology for a decade, beginning with his doctorate. Chrome security leader, Justin Schuh, tweeted

Eric Lawrence, a former member of the Chrome security team who is now working on Microsoft's Edge browser, called an extremely impressive achievement . "

" Google has invested many years of engineering in a feature film that seemed at first desperate compared to the POV cost / profit [point of view]"he tweeted. Then when Specter arrived, the isolation of the site suddenly became "an essential defense against a class of attack."

This is an extremely impressive achievement.

Google has invested many years of engineering in a feature that initially seemed hopelessly out of whack by the cost / benefit ratio. And then, suddenly, it was not just a nice diD to do, but rather an essential defense against an attack class. https://t.co/eQGU3djVF8

– Eric Lawrence ? (@ericlaw) 11 July 2018