Microsoft claims WebGL makes consumer PCs DDoS targets

PROPRIETARY SOFTWARE DEVELOPER Microsoft has slammed the WebGL graphics standard as allegedly insecure.

Microsoft's security research and defense group said that its research into WebGL had concluded that it "would have difficulty passing Microsoft's Security Development Lifecycle requirements". Microsoft then rattled off its security concerns with WebGL, mainly surrounding its low level access to hardware.

WebGL was originally a Mozilla-based effort, but now the Khronos development consortium oversees development with WebGL integrated into Mozilla's Firefox and Google's Chrome web browsers. While companies such as AMD, Apple, ARM, Intel, Nokia, Nvidia, Oracle, Samsung and Sony are part of Khronos, Microsoft isn't.

Microsoft said that the security of WebGL is dependant on "lower levels of the system, including OEM drivers". It claims that while the risk can be mitigated, "the large attack surface exposed by WebGL remains a concern". Interestingly, Microsoft said that certain video card vendors might be more prone to security vulnerabilities than others, though it did not finger any suspects.

Aside from video card driver vulnerabilities, Microsoft said that WebGL generally relies too heavily on third parties to provide secure website viewing. The problem is a manifestation of the graphics card driver issues Microsoft mentioned previously, saying that hardware vendors could decide to block web content in order to prevent users from being affected by security vulnerabilities.

Microsoft said, "Users are not accustomed to ensuring they are up-to-date on the latest graphics card drivers, as would be required for them to have a secure web experience. In some cases where OEM graphics products are included with PCs, retail drivers are blocked from installing. OEMs often only update their drivers once per year, a reality that is just not compatible with the needs of a security update process."

Certainly AMD and Nvidia would argue, correctly, that they issue driver updates far more frequently than once a year, but Microsoft might point to the percentage of users that actually update their software regularly, which is likely to be very low.

Microsoft is also worried that operating systems do not adequately defend against attacks that make use of "attack-supplied shaders and geometry". It claims that WebGL might lead to consumer PCs becoming targets for denial of service attacks.

After all that, Microsoft judged that WebGL "will likely become an ongoing source of hard-to-fix vulnerabilities. In its current form, WebGL is not a technology Microsoft can endorse from a security perspective."

Perhaps Microsoft should join the Kronos Group to try to change the 'current form' of WebGL if it doesn't want to deal with alleged vulnerabilities it claims to be so worried about. µ