Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My company has some real security issues and I am wondering if using Chrome OS can be some solution to my problem. Typical Windows computers seems all to vulnerable to attacks from malicious images and websites which download keylogger software and remote access systems.

From my understanding, Chrome OS does not allow executable files. Am I correct? Will using Chrome OS computers help against attacks like those mentioned above (see bold).

share|improve this question
1  
I assume you're talking about a lack of general purpose computing on the device? –  Polynomial May 30 '13 at 10:59
4  
Chrome OS is Linux-based, and it can run executable files. –  Adnan May 30 '13 at 11:04
3  
If your Windows computers are vulnerable to attacks from malicious images and websites which download keylogger software and remote access systems, I would say your Windows computers are horribly mismanaged and misconfigured. There is really no reason (barring 0-days) why images or websites should even be able execute keylogger software or remote access systems. –  AviD Aug 7 '13 at 22:20
add comment

2 Answers

up vote 4 down vote accepted

By executable, you probably mean the .exe "executable" format that Windows uses to denote anything that contains a program. (Note that other extensions such as .com may also be executable, and it are not only executables that can get you infected; a malicious PDF does the job just as well.)

Any OS allows the execution of files, or else you can't do things like starting Powerpoint. You are right though that Chrome OS can't (by default) execute Windows' .exe files, but it's just as easy to make "binaries" (a more general term for executable files) for Chrome OS.

Chrome OS is based on Linux, making it vulnerable for pretty much any attacks that work on Linux computers, though it seems some things are sandboxed more than most other Linux distributions would do (see rakslice's comment). Many things in Chrome OS are done in the browser which makes it more secure, but this still doesn't eliminate all exploits. Migrating to Chrome OS would at least temporarily solve your problem since any attackers need to rethink their strategy, but it won't take very long. Windows, when used correctly, is a reasonably safe OS to use. The fact that you have real security issues (as you put it) hints at an underlying problem such as incompetence of employees (opening untrusted email attachments), bad patching, or something else.

If the attacks are by chance, e.g. when a user visits a website that happens to be infected, moving to Chrome OS (or any other Linux system) will solve your problem. In small organisations this might be an option, though in general I wouldn't advise to change the OS just because some employees happened to visit an infected website. Better install good anti-virus software, monitor workstations, limit permissions as much as possible, and setup a plan to perform when infections do occur. Something like: the computer will be taken off the network, the harddrive will be inspected and scanned in a safe environment, when the malicious part is found other computers will be scanned to see whether they have the same, and any infected computers will get a complete reinstall (shouldn't be too much work with system images and adequate backups).

If the attacks are targeted at your company specifically, you're in bigger trouble. Get someone on board with real knowledge of security, at least temporarily to get things under control. Targeted hacking attacks by professionals are hard to defeat and usually beyond the control of most sysadmins.

share|improve this answer
    
Very helpful, thanks. We have some issues where our team uses Facebook (we are a small social media company). When visiting some Facebook Pages, infected images are loaded and viruses downloaded to the computers. If my team uses virtual machines access Facebook, resenting to an image after each use, could this help combat the attacks? We run political pages which are being attacked intentionally. –  Jenny May 30 '13 at 11:38
2  
@Jenny Generally speaking, there are no infected "Facebook images". Whoever told you that is just messing with you. –  Adnan May 30 '13 at 11:40
1  
@Jenny What Adnan said, and get a security guy on board. At least let an external person (someone that works at a security company) asses the situation for a short while. It doesn't sound like anyone there knows what's going on, which is the worst possible scenario. –  Luc May 30 '13 at 11:53
    
Hi guys, I assumed it was Facebook as it seemed all who visited certain Facebook Pages were hacked. They did nothing else on those computers. I cannot afford security guys... it's a small startup with a lot of volunteers. –  Jenny May 30 '13 at 13:32
    
"Chrome OS is based on Linux, making it vulnerable for pretty much any attacks that work on Linux computers." That's not really true. Chrome OS has a bunch of process sandboxing that's not present in most distros, as well as software integrity checks built into the boot process on the dedicated hardware (e.g. ChromeBooks) See chromium.org/chromium-os/chromiumos-design-docs/… for more information. –  rakslice Aug 7 '13 at 23:22
show 1 more comment

Chrome OS is based on some sort of Linux, internally, and it has executable files. However, it won't show them to you, and, more to the point, it will not by default allow the user to download and run executable files of his own. It is somewhat similar to iOS in that respect.

Malicious executables can enter a user's system through two ways: by exploiting a vulnerability in the OS or its software (e.g. the Web browser), or by inducing the gullible user into running the executable himself. The latter is what these "email virus" do: they threaten the user with some story about unpaid taxes or disabled credit card, and they come with an attachment that the user "opens", i.e. runs, because it really is an executable file.

Chrome OS closes the "gullible user" door, by flatly refusing to launch externally obtained executable files of any kind(*). It can be expected to make the overall security situation better.


(*) Chrome OS will obtain and execute files which come as updates for the Chrome OS software, but these updates are signed and the machine won't accept updates which have not been signed by the Chrome OS maintainers, i.e. Google.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.