Thursday, June 21, 2018
Search
  
Submit your own News for
inclusion in our Site.
Click here...
Breaking News
Micron Had a Record Quarter in Terms of Revenue and Profitability
Bose Noise-Masking Sleepbuds Will Help You Sleep
Intel to Bring Silicon-Based Security to AI and Blockchain Workloads
Microsoft to Buy Bonsai to Build 'Brains' for Autonomous Systems
Instagram Unveils 10-Minute Videos, Reaches 1 Billion Monthly Users
Foxconn to Further Expand in the U.S. Market Though Vizio
Microsoft Releases Microsoft News App For Windows 10, iOS and Android
Galaxy S9 and S9+ Sunrise Gold Available in the U.S.
Active Discussions
Which of these DVD media are the best, most durable?
How to back up a PS2 DL game
Copy a protected DVD?
roxio issues with xp pro
Help make DVDInfoPro better with dvdinfomantis!!!
menu making
Optiarc AD-7260S review
cdrw trouble
 Home > News > General Computing > Microso...
Last 7 Days News : SU MO TU WE TH FR SA All News

Friday, June 17, 2011
Microsoft Claims WebGL Is Harmful


The Khronos Group's WebGL technology is a cross-platform, a 3D graphics API for the web, supported by Chrome and Firefox browsers. Microsoft has analyzed the technology and concluded that it could be harmful and not safe.

Microsoft's MSRC Engineering team, which analyzes various technologies in order to understand how they can potentially affect Microsoft products, took a look at WebGL. Microsoft's analysis concluded that the company's products supporting WebGL would have difficulty passing Microsoft?s Security Development Lifecycle requirements.

Microsoft claims that browser support for WebGL directly exposes hardware functionality to the web in a way that it "overly permissive."

"The security of WebGL as a whole depends on lower levels of the system, including OEM drivers, upholding security guarantees they never really need to worry about before. Attacks that may have previously resulted only in local elevation of privilege may now result in remote compromise. While it may be possible to mitigate these risks to some extent, the large attack surface exposed by WebGL remains a concern. We expect to see bugs that exist only on certain platforms or with certain video cards, potentially facilitating targeted attacks," Microsoft said.

Any uncovered WebGL vulnerabilities will not always manifest in the WebGL API itself. The problems may exist in the various OEM and system components delivered by IHV's. "While it has been suggested that WebGL implementations may block the use of affected hardware configurations, this strategy does not seem to have been successfully put into use to address existing vulnerabilities," Microsoft added.

Microsoft also believes that as configurations are blocked, increasing levels of customer disruption may occur. "Without an efficient security servicing model for video card drivers, users may either choose to override the protection in order to use WebGL on their hardware, or remain insecure if a vulnerable configuration is not properly disabled," the company said.

"Users are not accustomed to ensuring they are up-to-date on the latest graphics card drivers, as would be required for them to have a secure web experience. In some cases where OEM graphics products are included with PCs, retail drivers are blocked from installing. OEMs often only update their drivers once per year, a reality that is just not compatible with the needs of a security update process."

Microsoft added that WebGL systems will be vulnerable to Denial-Of-Service (DoS) scenarios.

"Modern operating systems and graphics infrastructure were never designed to fully defend against attacker-supplied shaders and geometry. Although mitigatinos such as ARB_robustness and the forthcoming ARB_robustness_2 may help, they have not proven themselves capable of comprehensively addressing the DoS threat. While traditionally client-side DoS is not a high severity threat, if this problem is not addressed holistically it will be possible for any web site to freeze or reboot systems at will. This is an issue for some important usage scenarios such as in critical infrastructure," the company said.

The company concluded saying that "WebGL will likely become an ongoing source of hard-to-fix vulnerabilities. In its current form, WebGL is not a technology Microsoft can endorse from a security perspective."

WebGL, a technology which brings hardware-accelerated 3D graphics to the browser, has been supported by Google's Chrome and Mozilla's FireFox browsers. The technology allows users to experience 3D content right inside the browser with no need for additional software. Microsoft's Internet Explorer 9 does not support WebGL. The company supports its own, proprietary, Direct3D.


Previous
Next
Panasonic Introduces Ruggedized Toughbook Tablet        All News        LG Rolls Out OPTIMUS 3D Smartphone
Google Launches Personal Reputation Management Tool     General Computing News      GLOBALFOUNDRIES Appoints New CEO, Announces Investment Plan Through 2012

Get RSS feed Easy Print E-Mail this Message

Related News
Microsoft to Buy Bonsai to Build 'Brains' for Autonomous Systems
Microsoft Releases Microsoft News App For Windows 10, iOS and Android
Microsoft Follows Amazon in Checkout-free Retail Technology: report
E3 2018: Microsoft 'Halo Infinite' Trailer Unveiled, Ninja Theory, Undead Labs, Playground Games, Forza Horizon, and Gears of War 5
Microsoft Highlights Intelligent Cloud, Intelligent Edge vision at Computex Taipei
Microsoft Launches Program for Women Returning to Work
Microsoft to Buy GitHub for $7.5 Billion
Microsoft to buy GitHub: report
Microsoft's Value Overtakes Alphabet
Microsoft Acquires Conversational AI Company Semantic Machines
Microsoft Build 2018 Highlights
Azure and Office Power Microsoft's Third Quarter Results

Most Popular News
 
Home | News | All News | Reviews | Articles | Guides | Download | Expert Area | Forum | Site Info
Site best viewed at 1024x768+ - CDRINFO.COM 1998-2018 - All rights reserved -
Privacy policy - Contact Us .