BOSTON (Reuters) – Google Inc brags that computers running its recently released Chrome operating system are a lot safer than traditional PCs, partly because user data is stored in the Internet cloud and not on the machine.
Yet researchers at an independent computer security firm warn that the Chrome PC's reliance on Web computing makes it vulnerable to the same attacks that hackers have been launching on websites and Web browsers for years.
Matt Johansen, a researcher with WhiteHat Security, said he identified a flaw in a Chrome OS note-taking application that he exploited to take control of a Google email account. He reported it to Google, which fixed the problem and gave him a $1,000 reward for pointing it out.
Johansen said he has since discovered other applications with the same security flaw.
"This is just the tip of the iceberg," he told Reuters. "This is just evolving around us. We can see this becoming a whole new field of malware."
Google is betting that the launch of its Web-centric Chrome OS PCs will help reshape the decades-old personal computer industry, challenging entrenched players such as Microsoft Corp and Apple Corp. The first Chrome PC laptop, from Samsung, went on sale earlier this month. Early reviews have been mixed, with some influential technology hands noting that the concept of an always-Internet-connected PC may be ahead of its time and not ideal for mainstream users.
One key to hacking Chrome OS is to capture data as it travels between the Chrome browser and the cloud, Johansen said. Hackers have until now mostly targeted data that sits on a machine's hard drive.
"I can get at your online banking or your FaceBook profile or your email as it is being loaded in the browser," he said. "If I can exploit some kind of Web application to access that data, then I couldn't care less what is on the hard drive."
Johansen declined to identify the applications with the security bugs. He and colleague Kyle Osborn are holding back that information for a presentation at Black Hat, a prestigious hacking conference to be held this August in Las Vegas.
Those applications belong to a class of software programs known as "extensions," which users download from the Google Chrome Web Store. Extensions are essentially applications that run inside browsers
The bulk of Chrome OS extensions are written by independent software developers, not by Google.
Johansen said the problem with the extensions is related to a design flaw in Google Chrome OS: the operating system gives extensions sweeping rights to access data stored on the cloud.
"Chrome is trusting these extensions more than it would be trusting just another website," he said.
Executives at Google said they are looking to improve procedures that screen extensions for vulnerabilities before clearing them for the Chrome Web Store.
Caesar Sengupta, director of Chrome OS, said the company was exploring "various ways" of trying to automatically tag questionable extensions. Yet he said that Google did not want to make it onerous for developers to get their extensions distributed through the marketplace.
"We are trying to create a system that -- like the Web -- is open," he said.
Alex Stamos, a security expert with iSec Partners who helped develop the security system for Chrome OS, said that it would be unfair to condemn the overall security of the new operating system just because of the issues cited by the WhiteHat researchers.
"While things might not be perfect, we are talking about a much more controlled and secure environment than you have on Windows and Mac PCs," he said.
For information on the Black Hat conference, see http://www.blackhat.com.
(Reporting by Jim Finkle; Additional reporting by Alexei Oreskovic; Editing by Gary Hill)
One of the more impressive games in the App Store in terms of graphics and conversion to touch controls from a classic console gamepad or arcade joystick is Street Fighter IV. Volt is an update of Capcom's popular 2-D fighting game, with new characters (Balrog, Cody, and Vega) and a phenomenal new feature: online and local multiplayer. You can take on players in ranked or unranked matches using Game Center over a Wi-Fi-enabled connection, or beat on your friends over Bluetooth. It's a big addition to the earlier version of the game, which only let players battle computer-controlled opponents. Expect to get a little annoyed with the "cheap" special move tactics of the players online, though. Time to practice.
Freemilaum title Tiny Tower succeeds where other games in the same vein annoy. Yes, it's a time nmanagement game that makes you wait around a lot. As the owner of your own tiny tower, you construct the building layer by layer, adding floors when you earn "coins" and then deciding what to do with those floors. First you'll add apartments and rent them to "bitizen" characters who frequent your tower, but later, you'll add businesses based on the demands of your residents. The management aspects have you giving all your bitizens jobs in your stores based on their preferences, and each one will earn money by selling things to customers, which you have to keep stocked. While Tiny Tower makes you wait quite a bit while you stock things and construct floors, it also dishes out the game's premium currency, TowerBux, with relative frequency, which allow you to cut out some of the waiting. It's just enough to keep the game engaging without feeling like it's trying to dupe you into paying for premium content, which is nice. Oh, and Tiny Tower is also an addictive good time.
Continuity 2 mixes two fun game types: slide puzzles, in which you maneuver pieces of a picture arranged in a grid around the screen to make a picture, and platforming as seen in titles like Super Mario Bros. In Continuity 2, each of those sliding pictures on the grid is actually a room in the puzzle, and moving them around makes them match up in different ways. With different matches, you can steer your character into new rooms and use them to collect coins before heading for the exit of each level. The game is at once a combination of skills, allowing you to exercise your video game smarts alongside your puzzle-solving smarts. Add in a few extra-cool mechanics, like rotating your phone to change gravity for your character, and Continuity 2 has a lot of fun and interesting gameplay to offer. It also has 50 levels and Game Center support to offer, as well.
Imagine the popular Mario Kart franchise on your iPhone – but instead of Mario, you've got Sonic the Hedgehog. That's Sonic & SEGA All-Star Racing, a kart racer that blends solid 3-D graphics and tried-and-true gameplay with tight tilt controls. The game is filled with popular SEGA franchise characters for you to choose from to race through inventive environments. You get 10 characters to race with and against across 25 levels that make up three Grand Prix cups in Sonic & SEGA. The game also features support from Game Center, so you can log your best times on the Sonic & SEGA online leaderboards and see how good a racer you are compared to players all over the world.
Sequel to Telltale's acclaimed Puzzle Agent, the second game in the franchise picks up right where the first left off, continuing the story of the last title and adding a bunch more great puzzles, as well. In Puzzle Agent, you play FBI Agent Norman Tethers as he works to solve a case using his skills as a member of the Puzzle Division. But after solving the case last time around, he returns to Scoggins, Minnesota, because he still feels uneasy. Puzzle Agent 2 has the same great storytelling present in other titles from Telltale Games (this is the developer behind Back to the Future, for example), as well as lots of challenging and diverse puzzles to tease your brain.
For the first time since the