browsers Disable browser synchronization in the office It’s common practice in many companies to keep work and personal information separate. But browser synchronization often remains unnoticed — and attackers are already exploiting it. Alexey Vovk March 9, 2023 Storing corporate and personal information, accounts, and files on separate devices is one of the most popular (and effective!) tips for information security. Many companies set this as a mandatory requirement for all employees. A natural extension of such policy is prohibiting data sharing between work and home computers via services like Dropbox, and recommending not to register personal accounts (for example, in online stores) to work e-mail. Often, neither users nor administrators consider another place where home and work intersect — in web browser settings. Suggestions to enable Chrome browser synchronization using a Google cloud account pop up from day one, and in fact, Chrome often enables it automatically after the user logs in to Gmail or Google Docs. In Firefox and Edge, syncing is less obtrusive, but it exists and is also offered. At first glance, having synced bookmarks is convenient and not risky, but attackers think otherwise, of course. How browser synchronization can be risky Firstly, your cloud profile contains quite a lot of information. In addition to a list of bookmarks and open tabs, browsers also synchronize passwords and extensions between computers. Therefore, attackers compromising an employee’s home computer can gain access to a number of work passwords. And if a user installs a malicious extension at home, it will automatically appear on the work computer. These are not hypothetical attacks. It was password synchronization in Google Chrome that led to the compromising of information-security giant Cisco, while malicious extensions disguised as corporate security were used to steal Oauth authentication tokens. Secondly, malicious extensions can be used for data exfiltration from an infected computer. As soon as the Chrome browser communicates with Google’s legitimate infrastructure here, an attack may go on a long time without generating warnings from network defenses. How to secure office computers against browser synchronization System administrators have to take a number of measures to effectively address the threat posed by browser synchronization: Use browsers that support centralized security policy settings (Google Chrome, Firefox) At the security policy level, disable profile synchronization Again at policy level, prohibit saving passwords in the browser (a specialized password manager is preferable) If necessary, limit the installation of browser extensions to a list of trusted extensions, or prohibit it altogether Last but not least, educate employees well in advance. Explain why they should only use corporate browsers, and why they mustn’t save passwords in the browser and synchronize bookmarks with their home computers. Allow some time for adaptation, and then apply the new policies. If for some reason an organization cannot implement corporate browser builds, employee training remains the only and key means of protection.
Read next Five reasons not to use desktop messengers We explain why it’s best not to use desktop versions of messengers such as WhatsApp, Telegram, Signal and the like.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.
Tips Nine reasons to set up a VPN on your router Get the most speed, reliability, and convenience out of your VPN by putting it on your router. Here’s a look at the real benefits of specific VPN setup scenarios for your whole home network.
Tips Fact and fiction about hidden Wi-Fi network names Hiding your Wi-Fi network name might seem like a smart security move, but in practice it does more harm than good. Let’s take a look at how it works, what side effects it can have, and how to properly secure your home Wi-Fi.