Early this year I gave you five reasons to avoid desktop versions of messengers. The fact that many such applications use the Electron framework is one of them. This means that such a messenger works as an additional browser in your system, and its updates are quite difficult to control.

But, as I wrote in that post, it has become clear the problem is much more widespread — affecting not only messengers but hundreds of other apps as well. Chances are, because of Electron-based apps, you have a many more browsers than you think in your system this very minute…

What is Electron, and why do application developers want to use it?

Electron is a cross-platform desktop application development framework that employs web technologies — mostly HTML, CSS, and JavaScript. It was originally created by GitHub for its source code editor Atom (hence its original name — Atom Shell). Later on the framework was renamed Electron, ultimately evolving into an extremely popular tool used to create desktop applications for various operating systems, including Windows, macOS, and Linux.

Electron framework official site

Main page of the Electron framework official site. Source

Electron itself is based on the Chromium browser engine, which is responsible for displaying web content within a desktop application. So any Electron application is effectively a single website opened in the Chromium browser.

Users usually have no idea at all how the thing works. From their point of view, an Electron application is just another program you install, run in the usual way, give access to some files, occasionally update to the newest version, and so on.

Why has Electron grown so popular with developers? The idea is mainly this: no matter what digital service one might want to create, a web version is still needed. And the Electron framework allows you to develop just the web version and, based on it, produce full-fledged apps for all the desktop operating systems out there.

Electron’s other convenience features include making installation packages, their diagnostics, publication to app stores, and automatic updates.

Mullvad VPN uses the Electron framework, too

Et tu autem, Brute! You can find Electron in apps you least expect to

Summing up, the Electron framework is popular among developers — most particularly as it allows to greatly accelerate and simplify the application development process for all desktop operating systems in one go.

Issues with Electron-based applications

Electron-based applications have a number of drawbacks. The most obvious from the users’ perspective is their sluggishness. Electron-based software is usually resource-intensive and suffers from excessive file size. No wonder: each such app carries its whole home on its back like a snail a full-blown Chromium browser. In effect, it operates through that browser — serving as a sort of intermedium.

Next issue: web browsers are a favorite target of cybercriminals. It’s worth repeating: inside every Electron-based app there’s a separate instance of the Chromium web browser. This means your system may have a dozen additional browsers installed, all of which present a tempting target for criminals.

New, serious vulnerabilities pop up almost weekly in a popular browser like Chrome/Chromium: so far this year more than 70 high, and three critical severity-level vulnerabilities have been found in Chromium as of the time of writing. Worse yet, exploits for the world’s most popular browser’s vulnerabilities appear really quick. This means that a good part of Chrome/Chromium holes are not just abstract bugs you treat as a matter of routine — they’re vulnerabilities that can be used for attacks by cybercriminals out in the wild.

List of Chrome/Chromium vulnerabilities found in the first eight months of 2023

Even in fine print, Chromium vulnerabilities found so far in 2023 take up several screens. Source

For the standalone Chrome browser, this isn’t such a serious problem. Google is very quick to release patches and rather persistent in convincing users to install them and restart their browser (it even thoughtfully re-opens all their precious tabs after restarting so they don’t need to fear updating).

Things are very different for the Electron-based apps. A Chromium browser built into such an app will only get patched if the app’s vendor has released a new version and successfully communicated to users the need to install it.

So it appears that, with a bunch of installed Electron apps, not only do you have multiple browsers installed on your system, but also little to no control over how updated and secure those browsers are, or how many unpatched vulnerabilities they contain.

The framework’s creators know full well about the problem, and strongly recommend that app developers release patches on time. Alas, users can only hope that those recommendations are followed.

And here’s a fresh example: On September 11, Google fixed the CVE-2023-4863 vulnerability in Google Chrome. At that point, it was already actively exploited in the wild. It allows a remote attacker to perform an out of bounds memory write via a crafted HTML page, which can lead to the execution of arbitrary code. Of course, this bug is present in Chromium and all Electron-based applications. So, all companies using it in their applications will have to work on updates.

Which desktop applications are based on Electron?

Not many folks seem to know how incredibly common Electron-based desktop applications are. I’ll bet you are using more than one of them. Check them out yourself:

  • 1Password
  • Agora Flat
  • Asana
  • Discord
  • Figma
  • GitHub Desktop
  • Hyper
  • Loom
  • Microsoft Teams
  • Notion
  • Obsidian
  • Polyplane
  • Postman
  • Signal
  • Skype
  • Slack
  • Splice
  • Tidal
  • Trello
  • Twitch
  • Visual Studio Code
  • WhatsApp
  • WordPress Desktop

I personally use around a third of the apps from the list (but, for the record, none of them as desktop applications).

That list is not exhaustive at all though, representing only the most popular Electron-based applications. In total there are several hundred such applications. A more or less complete list of them can be found on a special page on the official website of the framework (but, it seems, not all of them are listed even there).

List of Electron-based applications

The list of Electron-based desktop applications comprises several hundred online services, including about 20 really popular ones. Source

Security considerations

So how to avoid the threats posed by uncontrolled browsers that thoughtful developers are now unpredictably embedding into desktop apps? I have three main tips regarding this:

  • Minimize the number of Electron-based apps as much as possible. It’s not as difficult as it seems: the very fact of using the framework normally suggests that the service has an extremely advanced web version, which is most likely on a par with the desktop application in terms of features and convenience.
  • Try to inventory all Electron-based apps used by your company’s employees, and prioritize their updates. More often than not, these are collaboration applications of different forms and shades — from Microsoft Teams, Slack, and Asana, to GitHub and Figma.
  • Use a reliable security solution. It will help you repel attacks in those periods when vulnerabilities are already known and being exploited but the patches haven’t yet been issued. By the way, Kaspersky products have an exploit protection system: it helps our experts detect the exploitation of new, as yet unknown vulnerabilities, and warns the developers of the corresponding programs about these holes.

#Electronbased #desktop #applications #secure

Dinten anu sanés – kerentanan browser anu sanés kapanggih! Mémang, jumlah liang kaamanan bahaya dua kali dina saminggu! Kami nembé nyorot kabutuhan anu mendesak pikeun ngapdet ios sareng macOS kusabab bug utama dina Apple WebKit (mesin di jero Safari sareng panyungsi sanés dina ios). Sareng ayeuna, kusabab ancaman anu sami dina hal eksploitasi, anjeun ogé kedah ngapdet browser anu sanés. Waktos ieu fokus perhatian bakal Google Chrome sareng panyungsi anu aya hubunganana (sareng sanés ngan ukur panyungsi, tapi ulah rusuh teuing).

Kerentanan dina mesin V8

Kerentanan CVE-2023-2033 parantos kapanggih dina mesin V8. Mesin ieu dipaké pikeun ngolah JavaScript. Kapanggihna ku panalungtik anu sami di Google Threat Analysis Group (TAG) anu ngagaduhan panangan dina panemuan kerentanan ios sareng macOS anu dijelaskeun dina tulisan kami sateuacana.

Kusabab éta mangrupikeun kabijakan standar Google pikeun henteu ngaluarkeun detil ngeunaan kerentanan dugi ka kalolobaan pangguna ngapdet panyungsina, teu aya anu khusus ngeunaan cacad kaamanan ieu. Nanging, anu urang terang nyaéta yén eksploitasi pikeun kerentanan ieu parantos aya.

Pikeun eksploitasi suksés, panyerang kedah mamingan korban ka halaman wéb anu didamel khusus sareng jahat. Éta ngamungkinkeun aranjeunna ngajalankeun kode sawenang dina komputer target. Kawas kerentanan kapanggih saméméhna dina Safari WebKit, liang ieu mempermudah serangan clickless. Dina basa sejen, penjahat cyber bisa nginféksi alat tanpa aksi aktif ti pihak pamaké – cukup nyieun korban nganjang ka situs jahat.

Kerentanan dipikanyaho aya sahenteuna dina versi desktop sadaya browser dumasar Chromium, hartosna henteu ngan ukur Google Chrome, tapi ogé Microsoft Edge, Opera, Yandex Browser, Vivaldi, Brave sareng seueur deui. Ieu kamungkinan ogé mangaruhan aplikasi dumasar-éléktron. Sakumaha anu urang tulis teu lami pisan, program sapertos ieu dasarna mangrupikeun halaman wéb anu dibuka dina browser Chromium anu diwangun kana aplikasi.

Kumaha ngajaga diri

Pikeun nétralisasi ancaman CVE-2023-2033 dina komputer anjeun, geura-giru ngapdet sadaya panyungsi basis Chromium anu dipasang dina éta. Parios pos lengkep kami sareng panjelasan kumaha cara ngalakukeun ieu dina Google Chrome. Tapi pikeun motong kana ngudag:

  • Apdet Google Chrome kana versi 112.0.5615.121.
Apdet Google Chrome kana versi 112.0.5615.121

Liang kaamanan anu dijelaskeun ku kami parantos dibenerkeun dina versi Google Chrome 112.0.5615.121.

  • Kerentanan patch dina aplikasi basis Chromium anu sanés ogé: Anjeun tiasa mendakan patch pikeun ngapdet Microsoft Edge kana versi 112.0.1722.48 di dieu, sedengkeun situs wéb Vivaldi sareng Brave parantos gaduh patch pikeun browser ieu.
  • Salawasna balikan deui browser sanggeus ngamutahirkeun; disebutkeun, update moal mawa pangaruh.
  • Ngamutahirkeun ogé sadaya aplikasi dumasar éléktron (patch pikeun aranjeunna sigana bakal muncul engké).

Sareng tangtosna, pastikeun ngajagi sadaya alat anjeun nganggo antipirus anu dipercaya anu ngajagi tina kerentanan anyar anu parantos dieksploitasi tapi henteu acan dibereskeun.

#Apdet #Google #Chrome #sareng #browser #dumasar #Chromium