Chrome OS Security

Question

I am new to how botnets work and I was wondering if Chrome OS could be infected to become part of a botnet? I own a chromebook and would love to know if this is possible for testing purposes. Is the OS too different for this to happen?

Answer 1

For these reasons, you are more likely to find malware developed for Windows than for Chromebook.

1. Chromebook is less widely used (for now) than Windows for now. It takes extra work to develop cross-platform. This is Security Through Obscurity and has limited effect.

2. Windows, like Mac is a classical OS with user access per person. If malware is installed, it has access to everything you do.

   This is contrary to Android, where each 'app' has its own user access. The benefit of containerized user access per app, is that one app cannot steal credentials from another.

   While Chromebook does not create Linux user accounts like Android does (AFAIK), Chromebook does have a strong emphasis on 'Sandbox Everything', which, if implemented properly is practically equivalent (or better) than OS user accounts.

   Additionally, since the apps are sandboxed, and never run as root, it is super easy to remove malware. There's nowhere to hide so you do not have to wipe the OS as you would on a Windows machine.

3. The app Store is managed by Google, and it is less convenient to install apps from odd websites. If an app is discovered to contain malware then there is an easy way for Google to ban that developer from the store.

   Windows and Mac users can install untrusted apps from any website with no special settings.

So that's the good news, but it is still possible for a Chrome OS to contain malware.

• The Store owner (Google) cannot vet every developer before their apps are published. They rely on abuse reports and can only act after some damage has been done. Also there is cost to verify any abuse report so less wide-spread malware is never discovered.

• Some users click through warnings without thinking. For example, an app could be given access to see every web page you visit.

  So read before you click. Also beware of Phishing.

• There is always the possibility that an App can hack its way out of the Sandbox. Google will try very hard to prevent this, but it is possible they will miss something. Always allow your Chromebook to be updated with the latest security fixes.

... wondering if Chrome OS could be infected to become part of a botnet?

• Speaking specifically to your question about Botnets, apps on Chromebook have internet access, even if they are running in a sandbox.

  While low-level actions such as TCP packet spoofing or Ping are not available (AFAIK), it is still possible to use traditional HTTP requests, and perhaps even some plain TCP, in order to brute force or otherwise try to hack a target.

  This qualifies as a Botnet even if there are certain attacks that cannot be done with Chromebooks.

  Fortunately you have #3 to reduce the risk of this, and #2 makes it easy to get rid of them.

Answer 2

There have been malicious botnet Chrome extensions before, though Google has done their best to remove them from their web store. While I am not aware of any that have targeted ChromeOS specifically, the attack would still work there as the extensions inject Javascript into each page to mine cryptocurrency.

Answer 3

Yes, it can happen. Likely? No. Don't think that there much malware developers bothering to make a trojan for ChromeOS. Also, it's based on Linux; which is a lot more secure than e.g Windows. So it probably also be pretty secure. And ChromeOS is actually even one of the most 'secure' 'distributions' of Linux. Because ChromeOS only allows you to use web-applications most of the time. It doesn't allow the installation of apps like you know it on other operating systems.

However, there are already some vulnerabilities found on Chrome OS: Click!
Of which some, pretty critical.

IMHO is ChromeOS a pretty revolutionary operating system, because it's very cloud-based etc - perfectly for the everyday user. This also means that attackers will use other types of attacks; web-based attacks will be used more against operating systems like ChromeOS. Phishing, XSS, MiTM,...