|
MICROSOFT WARNS CONSUMERS OF WEB SECURITY RISK
~ Security Firm Context
Releases Report Showing High Security Risks and Concerns
with WebGL ~
June 2011
(Redmond, WA) -- Microsoft
has echoed concerns on its blog
raised by U.K. security firm Context, which released
a report detailing the security and safety concerns
for those using WebGL-enabled browsers, like Google
Chrome and Mozilla Firefox. The security and safety
of customers is a primary concern for Microsoft, and
the report from Context further underscores its belief
that WebGL threatens that security.
WebGL leaves people using
Chrome and Firefox susceptible to security holes that
allow malicious Web pages to crash their computers.
Although the goal of WebGL is to bring 3-D graphics
to the Web, Microsoft believes it simply isn't ready
for prime time. Microsoft has looked at the analysis
of the security concern and has concluded that if their
products were to support WebGL, they would have difficultly
passing Microsoft security requirements and therefore
it cannot endorse WebGL as safe or secure.
Some key concerns include
these:
-
Browser support for WebGL directly exposes
hardware to attack - The security of a computer
itself is at risk when running WebGL because it
leaves the computer and the user's entire system
open to attacks that can crash it.
-
Larger scale attacks -Attacks that may
have previously resulted only in confined attacks
may now result in larger scale attacks on the entire
operating system. Consumers using Internet Explorer
9 on Windows 7, or Internet Explorer 8 on Windows
XP or Windows Vista, are not at risk of this vulnerability.
-
3-D graphics on WebGL are not ready yet for
the Web - Modern operating systems and graphics
infrastructure were never designed to fully defend
against attacks via 3-D graphics. If this problem
is not addressed holistically it will be possible
for any malicious website to attack, freeze and
reboot systems at will, causing harm to users and
their computers.
More information on safety
and security online can be found at www.microsoft.com/security/default.aspx.
###
|
|
