{"id":394434,"date":"2022-01-14T18:58:46","date_gmt":"2022-01-14T15:58:46","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/chrome-will-soon-stop-websites-from-attacking-your-router\/"},"modified":"2022-01-14T18:58:46","modified_gmt":"2022-01-14T15:58:46","slug":"chrome-will-soon-stop-websites-from-attacking-your-router","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/chrome-will-soon-stop-websites-from-attacking-your-router\/","title":{"rendered":"#Chrome Will Soon Stop Websites From Attacking Your Router"},"content":{"rendered":"

“#Chrome Will Soon Stop Websites From Attacking Your Router”<\/strong><\/p>\n

\n\"Google<\/p>\n

Google is always working on ways to make Chrome more secure. Starting in Chrome 98, the company will make it much harder to attack network devices such as your router or printer thanks to a new security measure called Private Network Access.<\/p>\n

As first reported by Ars Technica<\/a>, Chrome 98 will intercept requests when public websites want to access endpoints inside a user\u2019s private network (such as your router, printer, NAS, smart home gadgets, and more) and then log the attempt. In later versions of Chrome, possibly as soon as Chrome 101, the browser will actually block these requests until you grant permission.<\/p>\n

In its rollout plan<\/a>, Google says, \u201cPrivate Network Access (formerly known as CORS-RFC1918) restricts the ability of websites to send requests to servers on private networks.\u201d<\/p>\n

Routers are often attacked, especially by worms, and taken over by botnets that use them for DDoS attacks. But did you know that websites have used web browsers to attack routers, too? Now, Google is going to stop websites from ever using Chrome to perform an attack of this sort again.<\/p>\n

On the large scale, this could keep major services like AWS from going down and on the smaller scale, it could prevent end-users from having their connections overloaded through DDoS attacks.<\/p>\n

In\u00a02014<\/a>, hackers used\u00a0a cross-site request forgery<\/a> to change the DNS server settings for more than 300,000 wireless routers, which was only able to occur because of the open nature of browsers. If this change to Chrome had been active, this attack wouldn\u2019t have occurred.<\/p>\n

There isn\u2019t a set launch date because Google needs to use the trial period to make sure\u00a0significant parts of the Internet aren\u2019t broken by this change. Assuming nothing significant breaks, this will create an extra layer of security in Chrome that could prevent\u00a0an entire class of web attacks.<\/p>\n

What\u2019ll happ<\/a>en with Chrome 98 is that\u00a0Chrome will send preflight requests ahead of private network subresource requests (websites requesting access to devices on your private network). Any failures\u00a0display warnings in DevTools, without otherwise affecting the requests. Chrome will\u00a0gather data and reach out to the largest affected websites to let them know.<\/p>\n

With Chrome 101 (if everything goes well during testing),\u00a0preflight requests must succeed. Otherwise, the requests will fail.<\/p>\n

For most Chrome users, not much should change in their day-to-day web browsing. However, there will be a more secure experience when the update eventually goes live and there may be some additional prompts to allow or deny.<\/p>\n

If you want all of the technical details about what will happen and how it works, you can read Google\u2019s Private Network Access post<\/a>. It gets into all the technical stuff, but most people will be happy to know that the browser will cut off a specific type of attack before it starts, and that\u2019s a good thing.<\/p>\n<\/div>\n