Hack Chrome, Win $20,000

CWmike writes "Google will pay $20,000 to the first to exploit its Chrome browser at this year's Pwn2Own hacking contest at CanSecWest in Vancouver, BC, on March 9. At this year's Pwn2Own, researchers will pit exploits against machines running Windows 7 or Mac OS X as they try to bring down Microsoft's IE, Mozilla's Firefox, Apple's Safari and Chrome. The first researchers to hack IE, Firefox and Safari will receive $15,000 and the machine running the browser. The prizes are $5,000 more than those given for exploiting browsers at the last Pwn2Own contest, and three times more than the 2009 awards. 'We've upped the ante this time around and the total cash pool allotted for prizes has risen to a whopping $125,000,' said Aaron Portnoy, the manager of the sponsor, HP TippingPoint's security research team, which set the contest's rules Wednesday in a blog post written by Portnoy."

Comments

The machine is a prize?

[MrEricSir]

The list of prizes includes "... the machine running the browser."

Who would be dumb enough to use a computer they won from a hacking contest?

Re:The machine is a prize?

[Rinnon]

That's a kind of silly question. It's not like a door that has been broken open and won't close. They'll probably take it home, install Linux on it, maybe change the MAC address on the NIC, and it's basically a new machine.

Re:The machine is a prize?

[TaoPhoenix]

"I'll take Things to do with faulty Sandy Bridge machines for 200 Alex".

Re:The machine is a prize?

[nzac]

Why?? You would have a rather good understanding of what you just did to the computer so you can fix it.

Or if you are worried about being traced as a hacker the hard drive would immediately be formatted and os reinstalled and if you are especially paranoid or do illegal hacking change the MAC address.

Re:The machine is a prize?

[MrEricSir]

Not if the hardware was compromised.

Re:The machine is a prize?

[nzac]

note the if conditional statement >> if(paranoid || illegal hacker)
if he was he might see the need to do this

google mac address changer for me. I don’t know the specifics but its not on the motherboard its on network hardware so proof of concept would be to swap out the hardware.

Re:The machine is a prize?

[commodore64_love]

I'd take it. I don't mind non-virgin machines.

random question:
  - I'm running the non-google Chromium right now. Any reason to upgrade to Chrome?

Re:The machine is a prize?

[eviljolly]

From what I understand, the people receiving the machine would be the ones hacking it in the first place. I don't think there would be a problem.

Re:The machine is a prize?

[wed128]

you can spoof a mac address in software anyway; the ifconfig ether command for instance.

Re:The machine is a prize?

[MrEricSir]

Windows Update can't solder a keylogger into my USB subsystem, so even if I used Windows, I wouldn't be too worried about that.

Re:The machine is a prize?

[nzac]

I know browser hackers are not necessarily quite as skilled as (open)bsd hackers (but have success much more often) but i would think that the effort to make a hardware exploit that is undetectable to a winner would be more effort than its worth (it would have to survive a motherboard inspection and behave like the regular component almost all of the time) when it is likely that most hacking would be done from a desktop.

Or if you think hacking the browser did the damage i think they win when they can execute some arbitrary code on the other machine (not that damaging unless the excitable was intended to do so)

Re:The machine is a prize?

[MrEricSir]

*facepalm*

Re:The machine is a prize?

[allusionist]

Let's start with the fact that as the WINNER of the contest, they were the ones who hacked it before we get into the other absurdities of that statement.

Oh, and remember that this is only a contest, so they're just trying to get through the security, not actually do anything damaging once they're in.

Re:The machine is a prize?

[Riceballsan]

That puts it roughly at the same level of safety as any laptop you buy. If the hardware was comprimised, The government, the chip manufacturers, the QC people, the government could be requiring a hidden back door, any number of possible vectors are a higher possibility then some insane uber hacker planting a hardware level attack through a network connection in the plain view of several other hackers, that somehow finds it worth his time to plant a bug intended for the winner, but is not worth his time to just use his knowlege to get $20,000 and win the laptop himself.

Re:The machine is a prize?

[YoshiDan]

The details of the exploit used in the competition aren't released until after the vendor has released a patch to fix it...

Re:The machine is a prize?

[dudpixel]

who says you have to connect it to the internet?

Re:The machine is a prize?

[LordLimecat]

Why would you need to change the mac address?

Its like people think that someone else knowing your NIC's MAC is a security issue; you cant even discover a MAC address once you go through a router.

Re:The machine is a prize?

[tehcyder]

That's a kind of silly question. It's not like a door that has been broken open and won't close. They'll probably take it home, install Linux on it, maybe change the MAC address on the NIC, and it's basically a new machine.

They'll install Linux in a door?!

Now I'm confused too.

Re:The machine is a prize?

[tehcyder]

simple, you bring up a DOS prompt and ask the user to type in "format c:"

Cat and Mouse

[Arch_Android]

While I applaud their efforts, the truth of it is that there's always another exploit to fix.

Re:Cat and Mouse

[samuel.hurley]

Plus, its sort of a bad deal for the contestants, isn't it? Expand many man-hours of effort groping for a prize that probably won't materialize. No one is guaranteed to 'win,' but Google is guaranteed to get lots of free labour! Just a thought before you enter into something like this...

Re:Exploits?

[MrEricSir]

Immanentizing the eschaton?

Re:Exploits?

[99BottlesOfBeerInMyF]

Pwn2Own has been going on for years. Just Google the competition and the goal required to win a prize is very clearly explained.

Hack Chrome, Win $20,000

[John Hasler]

Shouldn't the prize be a free copy of Chrome?

Oh. Wait...

Re:Hack Chrome, Win $20,000

[rainbow9898]

Thanks for showing up such fabulous information. I have bookmarked you and will remain in line with your new posts. I like this post, keep writing and give informative post...! escort delhi

Slashdot wins

[Suki I]

I presume it would be easier on Windows anyway so who cares?

My Chrome on Win7 looks all funny in the new Slashdot.

Re:Exploits?

[Suki I]

I'm a bit confused by the article. They use so many buzzwords I'm not sure what they're looking for when they say "hack".

1 vulnerability to escape a sandbox, 1 vulnerability to exploit a bug in chrome, but to what end? Hijacking someone's session data?

Golf may be involved. Perhaps a taxi driver golfing, with a driver.

Chrome stands tall

[Randyll]

Chrome has never been hacked, which is not surprising, because the contest requires the contestant to exploit a Chrome bug and escape the sandbox while doing so. This is a far greater challenge than merely exploiting a browser bug that lets you do whatever, because if you find an exploit in Chrome the odds are high you will run into the sandbox and be stopped outright.

Re:Chrome stands tall

[commodore64_love]

>>>Chrome has never been hacked

Impressive. Are there any other browsers that can claim that distinction? SeaMonkey? Opera? Amiga Origyn? Mozilla TimberWolf?

Re:Chrome stands tall

[Anonymous Coward]

Yeah, people sometimes forget about this when talking about sandboxes. The sandbox might prevent malware from escaping to the OS or to another tab process, but it WON'T prevent it from masquerading as the tab session, and snooping on whatever you're doing in that tab. Even if things like form input/submission were moved to the broker, the malware could just rewrite the DOM, since parsing is typically done with least permissions. It's just a short-lived malware infection, existing only in memory.

Re:Chrome stands tall

[icebraining]

Not Opera, apparently: https://www.alternativ-testing.fr/blog/index.php?post%2F2011%2F%5BCVE-XXXX-XXXX%5D-Opera-11-Integer-Truncation-Vulnerability

But in general, plenty, but none with that user base.

Re:Chrome stands tall

[icebraining]

And you're an idiot because it was Randyll who said Chrome had never been hacked, not me.

Unhackable eh?

[JustAnotherIdiot]

Whenever I see "un" attached to an adjective, I'm inclined to believe it to be false. Unsinkable ship my foot.

Re:Unhackable eh?

[Sigma 7]

Whenever I see "un" attached to an adjective, I'm inclined to believe it to be false.

Even unstable?

(Affected players did have a workaround, but it wasn't on the official support pages.)

Re:of course not on linux

[hairyfeet]

First of all to quote the million pedantics we have here "Linux is a kernel NOT an OS" and second, which fricking one? There are about a bazillion Linux based distros out there, and ANY one they choose will be considered shite by the Linux geeks: Ubuntu? kiddie newb OS according to the guys here.

And then of course is the elephant in the room: Linux is only used by geeks that actually know enough about an OS to work on it and therefor are more secure simply by having more knowledge and experience. It is like the different between an Air Force flight mechanic and the guy that works on airplanes at the backwoods airport, in that one always lives with a wrench in his hand and is constantly working on different things (just like the Linux geeks I know which try different distros like normal people try on clothes) and the other that knows just enough to be dangerous, like the average Windows or Mac user I have to clean up after.

But in the end it is companies like Google that care about this, and with them it all comes down to demographics. Linux users are more likely to use Chromium because they actually care (or even know) about privacy issues, and are likely to tweak everything they run. Windows and Mac users run defaults a good 99.995% of the time and THAT is what companies like Google want to find out: Will their defaults make it easy to hack or not. Linux simply brings nothing to this discussion,anymore than letting someone like me go into the Windows machine and set everything up beforehand so it would be less of a target.

Good to hear

[amn108]

It's good to hear that we finally can link the pwnage and the ownage together. It's only fair, after all (ref. owning the machine you just pwned)

Re:Exploits?

[Stenchwarrior]

They have to hack the browsers from the cloud while using public apps and in a virtual environment, all the while staying well within the green limits set forth by the cyber industry. If they win they get $15,000 and a set of e-nano replicators.

Microsoft Copied... HA!

[kellyb9]

I hacked it to make Bing come up with the same results as Google... Please send me a check or a money order.

So how does this all work?

[origin2k]

I'm curious, how does this contest work? You sign up for a 30 minute spot. Do they allow the security researcher to sit at the system to compromise and operate it or does the security researcher direct a user to visit some url with a potential exploit? Part of the contest is to exploit the browser so I am guessing that the browser needs someone operating it and fetching well crafted html etc. from some where.

The phone stuff looks interesting as they are looking for drive by exploits as well as browser exploits.

Re:So how does this all work?

[kent_eh]

No, the attacks come over the network (in the case of the wireless devices, over the air).

There's pretty much no challenge attacking a system you have physical access to.

sure win?

[Have Brain Will Rent]

The rules aren't clear... can I use a gun?

Re:sure win?

[thehodapp]

No, but knives less than 5 inches and certain hatchets are allowed for the hacking part.

Don't trust Chrome with more than $20k

[fizzup]

What I get from this is that Google is so certain of Chrome's security, they're willing to trust $20k on that security. The lesson you can take from this is not to do anything with the Chrome browser that would put you at risk of losing more than $20k. After all, the authors won't risk more than that. Of course, other authors are even less certain of their browser's security...

but no Linux?

[thehodapp]

Why no love for Linux? I personally think it would be much more interesting to see if they could hack Chrome (or Firefox) on a Linux based OS (like Ubuntu). Although I suspect it would actually be easier because less testing is done on those platforms (or at least less development).

Waste of time and money

[cheros]

This is pure marketing. If they want to prove to me it's secure, ask for a public code review and reward those who find clear problems, and compile from that reworked code.

A "pass" from a hacking contest only shows that at a specific point in time, a specific set of people with specific skills were either unable to break a specific version of the software or unwilling to tell the organisers what they found so they could exploit that later for much more profit.

Any occurrence of the word "specific" indicates a variable that will invalidate the result of that contest - pass or fail.

But hey, it looks good in the press, I guess..

Re:Waste of time and money

[n0-0p]

This is pure marketing. If they want to prove to me it's secure, ask for a public code review and reward those who find clear problems, and compile from that reworked code.

The codebase (minus PDF, Flash, and branding) is open source. Google pays out anywhere from $500 to $3113.70 to anyone who reports Chrome/Chromium security vulnerabilities to them. And if you look at the release notes on Chrome and Safari it's obvious that Google has a full-time team searching for and fixing security issues in both Chrome and WebKit. I'm not sure what else you want them to do, because they're already going well beyond anything you suggested.

Re:Waste of time and money

[cheros]

Maybe stop marketing gimmicks? There are two direct problems with what they do here:

1 - it gives others the impression that hack contests are the way to assure security. This is the same as corporate execs relying on audit to assure the security of an IT platform instead of making sure they have solid fundamentals in place so that no retro-fitting is required.

2 - it takes away the focus from the fact that they do indeed do the preparing work as well. They could make more work of the whole process instead of just focusing on the result with this stunt. It propagates an approach that is, frankly, not the best thing to promote if you want people to think about security.

Not enough cash

[dugeen]

They'd have to pay me USD 20,000 just to get me to *use* Chrome again, never mind hack it. Software that secretly creates 3 separate scheduled tasks to reinstall its update program if it's deleted is indistinguishable from malware.

Re:Why go to a contest?

[perryizgr8]

for me, risk-reward logic gets skewed if i have to do something that i consider wrong( whatever that means). even if presented with great rewards and low risk i might choose not to do something if i find it immoral.
i expect the majority of people to think likewise.

Re:Exploits?

[tehcyder]

That's easy for you to say.