Security experts question if Google's Chrome Apps is worth the risk

Google's launch of Chrome Apps, a new breed of browser-based software that will run on top of any operating system, has left skeptical security experts wondering whether Google is creating a needless opening for cybercriminals.

Launched late last week, Chrome Apps is Google's latest step toward embedding its many services in the operating systems of rivals Microsoft and Apple. The goal is make apps running on Google's platform appear to run natively on either Windows or Mac OS X, respectively.

Even though Chrome Apps require Google's Chrome Web browser, the software can run outside the browser and offline. Documents, photos and video can be saved on a computer's hard drive, as well as Google's cloud storage service, called Google Drive. Updates, including security patches, occur automatically.

Initially, Chrome Apps will run only on Windows and the Google Chromebook, a high-end laptop powered by Google's Chrome OS. In the near future, Chrome Apps will also run on Mac OS X and Linux.

The strategy behind Chrome Apps is to merge the technology with the host OS, so users do not notice a difference. This all-in-one approach toward the user experience increases the likelihood people will use Google services, which means the company can gather more data to sell to advertisers.

"We want Chrome Apps to be so good you don't even realize it's something different," Rahul Roy-Chowdhury, project manager for Chrome Apps, told The Verge.

While the goal makes good business sense, security experts worry that Google is creating a layer of complexity that will introduce a new set of vulnerabilities that cybercriminals can exploit. Much of the concern is based on the huge security headache caused by other cross-platform technologies for running applications, such as Adobe Flash and Java, which was developed by Sun Microsystems. Sun was acquired by Oracle in 2009.

[Also see: Despite malware scanning, Chrome Web Store security still fall short]

"Sun pioneered the write once, infect everywhere model that Oracle has perpetuated," said Randy Abrams, research director for security adviser NSS Labs.

Because Google gathers enormous amounts of user data, Chrome Apps are unlikely to be welcomed by companies, Abrams said. "There are serious concerns as to privacy and data leakage when it comes to Google," he said. "Chrome Apps will be a huge concern for enterprises trying to protect intellectual property and other sensitive data, as well as a new security headache."

Vulnerabilities are a given in every software, so it is important to look at the vendor's track record for getting out patches quickly. While often criticized for making security blunders in Android, Google's mobile operating system, the company has incorporated strong security in the Chrome browser and in its Web services.

"They have been really impressive on the security side," said Wolfgang Kandek, chief technology officer for vulnerability management company Qualys.

Nevertheless, Google will have to provide a compelling reason to risk the inevitable vulnerabilities introduced with its new application platform. Simply offering to run software similar to what is already available for Windows or Mac OS X is unlikely to lure many users, and is certainly not worth the risk.

"From a security point of view, [Chrome Apps] is something to keep your eye on, because hackers love to go after things that are new and interesting," Court Little, senior service architect for managed security provider Solutionary, said.

Read more about application security in CSOonline's Application Security section.

Join the CSO newsletter!

Error: Please check your email address.

Tags applicationsMicrosoftsecurityData Protection | Application SecurityAccess control and authenticationjavasoftwaredata protectionChrome AppsAppleGoogle

More about Adobe SystemsAppleApple.GoogleLinuxMicrosoftOracleQualysSun Microsystems

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Antone Gonsalves

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts