When syncing sinks your browser
by Rob Rachwald - Imperva - Thursday, 31 May 2012.
Google Chrome's most recent version (v19) introduced a "tab sync" feature. When inspecting this feature from a security perspective we realized that a new type of threat can allow a hacker to comfortably "leap" from a compromised home computer to a work computer. We name this kind of threat BYOB for "Bring Your Own Browser." Today, mobile devices mix work data and personal end points and the BYOB does exactly the same thing only it's more elusive as there's no physical device involved.

Let's start with the view of browser syncing according to Google:
Say you’ve found an awesome recipe on your work computer while... ahem... working hard at the office. But when you get back home, you can’t quite remember if it was two teaspoons of baking soda or two teaspoons of baking powder. Wouldn’t it be cool if you could pull up the same recipe on your home computer with one click?

With today’s Stable release of Chrome, you can. When you’re signed into Chrome, your open tabs are synced across all your devices, so you can quickly access them from the “Other devices” menu on the New Tab page. If you’ve got Chrome for Android Beta, you can open the same recipe tab right on your phone when you run out to the store for more ingredients. The back and forward buttons will even work, so you can pick up browsing right where you left off.

Open tabs aren’t the only things that sync when you sign in to Chrome. Signing in to Chrome also syncs your bookmarks, apps, extensions, history, themes, and other settings. That way, when you sign in to Chrome, you can have your personal Chrome experience on all your devices. Just go to the Chrome menu and select “Sign in to Chrome.
When you signing into chrome, what gets synced? By default, everything:

If a user follows the default setting and all information gets synced, what can get compromised? There are two main groups:

1. Personal data. For example, the auto fill feature remembers the addresses and credit cards details the user has typed in. The good news? We had found out the credit cards details are not synced across accounts. We are not sure if it's done by design, as we weren’t able to find official reference for that behavior.

The bad news? Usernames and passwords are also synced:

2. Browser behavior is also synced:
  • Extensions/apps/themes – can change the browser’s internal behavior and also the browser's look and feel.
  • Settings – Control the browser's internal behavior. Some examples for sensitive controls include:

So when you are syncing your data you are:

Sharing (even more) personal data with Google: You provide Google with some extra data. Since Google already knows a lot about your online activity, syncing amplifies the problem.

Sharing (even more) personal data with everyone who knows your Google password: This is an existing problem since knowing the password already allows access to your Google account that includes some sensitive data in your e-mail, documents, etc... Syncing amplifies the problem again. (Recall what happened with HBGary Federal CEO Aaron Barr who used the same password on several accounts - only now Google does it for you).


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Mon, Feb 8th