Blink – Chromium And Opera’s New Rendering Engine
Today Google made a very big announcement, they’re leaving WebKit behind and moving to Blink, a new rendering engine based on WebKit. With Blink Google will have more control over the code, and the company will be able to immediately begin stripping out unused or redundant code. Blink is a new project, and Google has only just announced it, but there’s a lot of news coming out all of the time. I don’t know anything that anyone else doesn’t already know, but I’d like to put it in a format that you, my readers, will get, with the sources provided for more in depth study.
I won’t go into any of the ‘browser politics’ or other stuff, this is a security blog, and I’ll write about the security.
1) Smaller code base.
In the Chromium blog post released about Blink it was stated that:
[…]we anticipate that we’ll be able to remove 7 build systems and delete more than 7,000 files—comprising more than 4.5 million lines—right off the bat.
That’s a pretty significant chunk of data they’re removing – 4.5 million lines of code will be removed, ‘right off the bat’. As we know, code is attack surface, and the best way to deal with attack surface is to remove the code. Of course, this code might not have been used in Chromium at all anyways – still, the benefit is now that it’s out of sight and out of mind, vetting code can happen at a much more efficient level without all of that muddled in. A simpler project is a safer project.
2) Google Is Good With Security
Google has been making WebKit more secure by implementing hardening techniques and vetting the code and performing bug bounties etc. It has made a huge difference – but it was limited, they didn’t have the control over the system to make significant changes. Now that this project is under their control (sort of, again, it’s open source, so there’s nothing stopping someone else from forking) they’ll be able to make major changes.
Justin Schuh wrote a Google+ post about this. He notes multiple new security techniques that they’ll be able to implement now:
So, with the Blink project we now have a chance to fix quite a bit of technical security debt that’s accumulated over the years.[…] Some of our immediate changes will include improvements to our basic memory hardening in Blink. We plan on making a number of memory-safety changes, like switching to bounds-checked containers and adding integrity checks at different points in HTML processing and rendering. And one really exciting development will be broad deployment of something we call binding integrity, which ensures that DOM objects are valid at the point they’re bound to JavaScript (nearly eliminating first-order stale pointer and type confusion vulnerabilities in the DOM).
Longer term changes will involve things like refactoring our loading, navigation, and history handling. The nature of bugs in these layers tends to be very subtle and complicated, and is usually due to WebKit’s behavior triggering discontinuities in Chrome’s architecture (e.g. inconsistent navigation state between processes). These issues have led to an array of vulnerabilities including: remote code execution, UXSS, spoofing, and sandbox escapes. With Blink we already have a good sense of how we’ll refactor these layers to directly reflect Chrome’s architecture. As a result, we expect to eliminate certain families of Chrome-specific vulnerabilities entirely.
That’s big news. WebKit has always sort of been Chrome’s ‘weak’ point. It’s not super vulnerable or anything, but based on researchers who break Chrome at competitions, they say the easiest part is always getting RCE. So being able to prevent RCE to begin with is great.
Now that Google’s got the project for itself it’ll be able to implement all of the changes they want.
3) Opera’s On Board Too
Although Opera isn’t known for its security, the company has stated that they will be using Blink in their browser, and committing code to it as well. That’s more eyes on the code, and very qualified ones at that. So it’s not like the Chromium security team has to do it themselves – Blink has already attracted a ton of new developers to look at the code and make changes. This is a great thing. Opera’s browser is way more than just legitimate, it’s constantly quite fast, and has a ton of features. I’m really psyched to see what they commit to Blink.
Overall I’m very happy with this move. I think it will have a very big effect on security, and I think we’re likely to see immediate changes. I am very excited to see future bug bounties and where they focus, and where Blink security begins.
To read about Blink: http://www.chromium.org/blink
http://infrequently.org/2013/04/probably-wrong/
http://aerotwist.com/blog/hello-blink/
blog comments powered by Disqus