Slashdot Mirror
Hack Chrome, Win $20,000
CWmike writes "Google will pay $20,000 to the first to exploit its Chrome browser at this year's Pwn2Own hacking contest at CanSecWest in Vancouver, BC, on March 9. At this year's Pwn2Own, researchers will pit exploits against machines running Windows 7 or Mac OS X as they try to bring down Microsoft's IE, Mozilla's Firefox, Apple's Safari and Chrome. The first researchers to hack IE, Firefox and Safari will receive $15,000 and the machine running the browser. The prizes are $5,000 more than those given for exploiting browsers at the last Pwn2Own contest, and three times more than the 2009 awards. 'We've upped the ante this time around and the total cash pool allotted for prizes has risen to a whopping $125,000,' said Aaron Portnoy, the manager of the sponsor, HP TippingPoint's security research team, which set the contest's rules Wednesday in a blog post written by Portnoy."
That wouldn't be fair.
I'm a bit confused by the article. They use so many buzzwords I'm not sure what they're looking for when they say "hack".
1 vulnerability to escape a sandbox, 1 vulnerability to exploit a bug in chrome, but to what end? Hijacking someone's session data?
The list of prizes includes "... the machine running the browser."
Who would be dumb enough to use a computer they won from a hacking contest?
There's no -1 for "I don't get it."
While I applaud their efforts, the truth of it is that there's always another exploit to fix.
Shouldn't the prize be a free copy of Chrome?
Oh. Wait...
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
I presume it would be easier on Windows anyway so who cares?
My Chrome on Win7 looks all funny in the new Slashdot.
Home of The Suki Series
Chrome has never been hacked, which is not surprising, because the contest requires the contestant to exploit a Chrome bug and escape the sandbox while doing so. This is a far greater challenge than merely exploiting a browser bug that lets you do whatever, because if you find an exploit in Chrome the odds are high you will run into the sandbox and be stopped outright.
Whenever I see "un" attached to an adjective, I'm inclined to believe it to be false. Unsinkable ship my foot.
What do I know, I'm just an idiot, right?
It's good to hear that we finally can link the pwnage and the ownage together. It's only fair, after all (ref. owning the machine you just pwned)
Writing browser specific attacks is going about it the wrong way. Sure, you might come up with a vector that works for N% of the current browsing population, but you will score a higher percentage of that population if you target a plugin they are all likely going to have installed without knowing, such as PDF, Flash, or Java. Once you hit those plugins, it is very likely you've already escaped the sandbox and can now perform a more traditional attack on the machine itself.
I hacked it to make Bing come up with the same results as Google... Please send me a check or a money order.
Hack Chrome. Keep quiet about it. Sell it to criminals for a lot more.
If I'm good enough to exploit a browser, then I can surely find more profitable ways than a mere 20,000 dollars.
Especially when you consider the taxes. Sure, I might have to do ILLEGAL things to make money, but for some people the reward would trump the risk of being caught.
I'm curious, how does this contest work? You sign up for a 30 minute spot. Do they allow the security researcher to sit at the system to compromise and operate it or does the security researcher direct a user to visit some url with a potential exploit? Part of the contest is to exploit the browser so I am guessing that the browser needs someone operating it and fetching well crafted html etc. from some where.
The phone stuff looks interesting as they are looking for drive by exploits as well as browser exploits.
The rules aren't clear... can I use a gun?
The tyrant will always find a pretext for his tyranny - Aesop
What I get from this is that Google is so certain of Chrome's security, they're willing to trust $20k on that security. The lesson you can take from this is not to do anything with the Chrome browser that would put you at risk of losing more than $20k. After all, the authors won't risk more than that. Of course, other authors are even less certain of their browser's security...
Why no love for Linux? I personally think it would be much more interesting to see if they could hack Chrome (or Firefox) on a Linux based OS (like Ubuntu). Although I suspect it would actually be easier because less testing is done on those platforms (or at least less development).
This is pure marketing. If they want to prove to me it's secure, ask for a public code review and reward those who find clear problems, and compile from that reworked code.
A "pass" from a hacking contest only shows that at a specific point in time, a specific set of people with specific skills were either unable to break a specific version of the software or unwilling to tell the organisers what they found so they could exploit that later for much more profit.
Any occurrence of the word "specific" indicates a variable that will invalidate the result of that contest - pass or fail.
But hey, it looks good in the press, I guess..
Insert
They'd have to pay me USD 20,000 just to get me to *use* Chrome again, never mind hack it. Software that secretly creates 3 separate scheduled tasks to reinstall its update program if it's deleted is indistinguishable from malware.