Slashdot Mirror
Chrome Hacked In 5 Minutes At Pwn2Own
Skuto writes "After offering a total prize fund of up to $1M for a successful Chrome hack, it seems Google got what it wanted (or not!). No more than 5 minutes into the Pwn2Own cracking contest team Vupen exploited 2 Chrome bugs to demonstrate a total break of Google's browser. They will win at least 60k USD out of Google's prize fund, as well as taking a strong option on winning the overall Pwn2Own prize. It also illustrates that Chrome's much lauded sandboxing is not a silver bullet for browser security."
I think it's pretty clear they had their exploits worked out and ready to go for some time, and were just waiting for the contest to start to unleash them.
Still, kudos on what has to be almost world-record-time penetration of a "secure" system.
I do not fail; I succeed at finding out what does not work.
I guess this means they went in knowing exactly what they were going to do. This means that it has been known for a while which means there could be many more people who know and are exploiting this.
...now it seems you can also pwn2own google!
This isn't Swordfish. They had plenty of time to prepare their attack.
It's impressive they exploited Chrome. But the preparation took more than 5 minutes.
me not grok your second comment? Are you suggesting that if BG had done the same thing, it would have embarassed the MS OS into not being the moneymaker it is? I seriously doubt that.
Handing out 2mill of prize money is still more cost effective that standard R&D, you get more professionals testing it for the chance of wining some prize money than Google could ever employ and the people they chose not to employ.
The posting says that one of the teams in Pwn2Own will win at least USD 60K from Google. But Google aren't putting up any Pwn2Own prize money. Last I heard Google are running their own competition with different rules. The participants in Pwn2Own may well not enter the Google competition because their exploit (if it escapes the sandbox) will be worth much more than USD 60K. My understanding is that the Pwn2Own entrants are not required to reveal their sandbox exploits before receiving the prize money because sandbox exploits are worth much more than the prize money that is available while Google will require full disclosure before handing over their money.
I haven't used Chrome for months. It was behaving errratically and made me nervous during a yime I was looking for a secure browser out of immediate necessity. I eventually managed to use an old version of firefox portable that settled things. I forgot pwn2own was even happening by the time I noticed Chrome zipped in my archives folder and deleted it as useless just two days ago.
But this stuff has me wondering: suppose this goes on and Chrome eventually has all of the exploits worked out of it. A theoretical possibility. Suppose, then, that some new features are requested. Now it seems to me that if I recall correctly, every time revisions are made to software, new exploits appear. This leads me to my first question: what is getting screwed up, learned, forgotten then screwed up again in the coding process that this always seems to be the case?
My second question is, by extension of the first, what are the major weaknesses of browsers? Their implementation of a half-finished "standard" like dHTML? The coders borrowing classes or libraries that would introduce flaw.X to any programmers including them or using them with the program? Programmers being clumsy and trying to force data types to do things they aren't meant to like fit four bytes through an argument that's two bytes wide, and instead of backtracking both directions and setting them both to te same width in planning, just over-riding some compiler warning and supressing runtime halts and sending it to market?
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
They'd have paid out so much in "bug bounty" that he'd be broke by now. That's what GP is going for, anyway.
cat
Without vulnerability details there really is no story. Without knowing what exactly is going on here we can't know what precautions to take or whether there is any likelihood of other software (even our own) being affected. Or if there's even a real story here.
I mean, it's nice they're going to win a price an all, but there's nothing here for us that we can act upon. Without knowing any details we can't even really know whether we're any safer if using another browser.
It doesn't have any of those annoying Google spying/tracing code built-in.
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
Tell me that Google couldn't do a better job than that.
5 minutes? What sort of coding knowledge does Google have anyway.
Essentially. Not broke per se, just not multibillionaires.
Do not look into laser with remaining eye.
So I run chrome inside of a sandbox so I can be sandboxed while Chrome's sandbox is being hacked.
Flappinbooger isn't my real name
That's $12 million/hour, more than Larry and Sergey combined :-)
Have you got your LWN subscription yet?
Thanks for linking to a complete useless, pointless and content-free Twitter post.
Are there any details on the exploit beyond "Code execution and sandbox escape (medium integrity process resulted)"?
$ echo "ceci n'est pas une pipe" | sed -Ee 's/(eci n|pas )//g'
If I was sitting on an exploit for a competition, I would practice it many times in advance. There is no award for same exploit done in 6 minutes.
The prize isn't a lot of money by Google standards, but it's a lot of money by most people's. Kudos to Google for putting up enough money to get some serious hack attempts to come out of the woodwork.
saying "I know anecdotes aren't date" followed by "but insert anecdote here" doesn't excuse you from confirmation bias. There is no evidence presented by you that your practises wouldn't keep you just as safe with Opera or Gecko-based browsers.
What if Google set up a market protocol to buy Chrome bugs? $1k each, with strict disclosure and delivery terms. We might just deplete the entire Chinese exploit arsenal in 3 months... Or at least boost the knowledge-base of Chrome using CS students everywhere.
For in politics, as in religion, it is equally absurd to aim at making proselytes by fire and sword. - Publius
For all the bad dudes out there who can do this, remember that it's a lot easier to break something than to build it.
I just saw some stuff on youtube that, well for me, was quite scary.
http://www.youtube.com/watch?v=fxri6DDYAdM
It was about dangerous sites on the internet. Youtube has lots of links to other similar postings.
A question for fellow slashdotters... how much truth is in this? Or are they playing games with me to scare the hell out of me?
Comments invited.
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
Writing exploits for a modern browser like Firefox, where they have a good process and use static analysis tools to eliminate most possible exploitable bugs, or a browser like Chrome that has decent engineering but a hardware-assisted sandbox, is probably the hardest thing in all of computer science. Only a tiny few can do it these days. Building a browser just takes time and effort, exploiting it takes doing the 'impossible'.
Common sense. With 100 million users there are many bad sites and these are not games. It is a dangerous place.
Yes there are many bad websites and legit ones that have been compromised with ads or hacked to serve javascript exploits. Wordpress seems to be a popular legit series of sites that hackers keep injecting bad ads and malware to infect users who browse.
Go Google Norton Safe web and click the top 10? It changes everyday.
If you are really freaked out use an anti virus package that has cloud updates that blocklists bad sites and prevents them from opening. Avast Free is a popular one which updates every 8 minutes and blocks any browser. Commodo Dragon is a Chromium/Chrome based browser that has built in website blocking from bad domains as they make Commodo IS (haven't used it but has good ratings, though slows down your computer).
If you go to www.openDNS.com you can use the IP addresses in your DNS settings and it will provide filtering too (not as quick to block as other AV products I listed above).
Use a great Anti Virus product and do not got wierd unknown sites. Do not listen to the slashdot geeks who claim you do not need AV products and that they are not infected. 90% are and all it takes is one bad or flash exploit ... keep flash up to date too by going to Adobe or www.filehippo.com. The new one will auto update. Good luck keeping secure
http://saveie6.com/
Does this exploit sandbox in other programs? Or was Google just arrogant in setting forth this challenge figuring it would take them several hours or days to crack it?
5-minutes or under is is funny, but does this also mean that the "sandbox" idea is a waste of time in other programs!
It is funny Google claimed they wanted to find out how Chrome could be cracked so they can fix the problems, only to find out they are no where near being a "secure" browser..
Haha, no.
The whole concept of PWNing is that someone comes up with a way to circumvent the security built into that system. Sure, multiple layers like you describe will hopefully catch the intruder at some other point, where they try to do something that triggers an alarm. However, there is nothing you can do against zero-day vulnerabilities, other than multilayer your security and set up proper alerting.
People smart enough to find a zero day in a common and well tested browser, tend to be smart enough to write "payload code" that will not be detected by your virus scanner as well. Most likely, they will disable your local (windows) firewall (the payload would have to be OS specific anyway) and get the information they are after back to themselves some way.
Like others already said, you won't get to hear details on how they got through until after the patch has been rolled out and you can download a fixed version. If you want to learn how to defend yourself against zero-days in general, read what the leak was, do that for as many other zero-day vulnerabilities as you can spend time on and come up with generic defenses that will help against as much of those as possible. Just concentrating on this one won't do you any good.
I was promised a flying car. Where is my flying car?
sixty thousand clones of George Washington disagree with you on that.
I was promised a flying car. Where is my flying car?
Where's the $1M for a/the hack?
Well, as long as you ain't Laughing your ass off...
What's "funny" about five minutes? The point of the competition is that you show up with your exploit, and run it. Five minutes is a pretty long time to do that in.
But breaking something in a way that no-one has ever done before is a lot HARDER than either.
the target systems musta been running vista and still booting on the word 'go'.
It also illustrates that Chrome's much lauded sandboxing is not a silver bullet for browser security."
When I made a comment a few weeks back that the fact that Chrome could be installed without admin privileges is a huge security hole, I was told by the "experts" on here that because Chrome was sandboxed, my comment was completely without merit.
Repeat after me: there is no such thing as a secure application. Given enough time, someone, somewhere, will find a way to circumvent any security you may have in your software.
So yeah, fuckers, allowing Chrome to be installed without admin privileges IS a gaping security hole waiting to happen. And here it is.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
So GOOGLE keeps a lot of paid shills around here then, eh? That's what I am gathering from your statements. Slashdot's "groupthink" also? However - in case they are NOT "paid for trolling downmodding shills"?? Don't you really mean 'sheep-think', instead???
I state that, because a good 90% of the fools around here don't know a DAMNED THING about computing other than @ user level (perhaps @ the network admin level, & that's only a user with a BETTER PASSWORD!).
Is encryption on everything so that even the FBI or the NSA will not be able to hack.
That is not going to happen
And, another question: Which sandbox did it exploit? Chromium has a chroot-based sandbox, an SELinux sandbox, a Capsicum sandbox, and a Windows sandbox and a Mac sandbox. Was the compromise something specific to one of these implementations, or was it in the platform-agnostic code?
I am TheRaven on Soylent News
This article linked in another post above disagrees:
For all the bad dudes out there who can do this, remember that it's a lot easier to break something than to build it.
In general, I'd say it's a lot easier to build insecure software than it is to find and exploit bugs in software.
Corrected headline .. :)
AccountKiller
"I'm gonna write myself a new minivan this afternoon!"
http://dilbert.com/strips/comic/1995-11-13/
Also:
http://thedailywtf.com/Comments/The-Defect-Black-Market.aspx
Online Starcraft RPG? At
Dietary fiber is like asynchronous IO-- Non-blocking!
For all the commenters who remark that Vupen had their exploits ready to go--and to the moderator who thinks those comments are just so d@mn interesting--look back at previous Pwn2owns and you'll see the same thing--but with other browsers. You've all merely revealed yourselves as either ignoramuses (probably just a few) or completely pwned by Google (most likely). What's actually interesting about the contest this year is that Chrome hadn't been pwned in any previous year, and this year Google claims to put up millions of dollars, and (surprise!) they do get pwned. All you Chrome users have been living in a dream world. What's even more interesting is that Vupen isn't apparently to receive a million dollar prize. And that's false advertising.
Actual corrected headline. Please stop with the sensationalist headlines about hacking. The only number that matters is how long it took to find the exploits and to package them into an attack vector versus the reward from Google.
There are virtually no applications that will survive for more than a few minutes against a 0day when the attacker is given sufficient capability to execute an attack.
Well, that would explain why it took so long, if he had to type it out from memory.
FUNNY they get 60K NOT 1 MILL....not worth helping corporate america sorry..give me 100 million ill show ya a few bugs and hacks....other wise piss off.
If only there were a -1 WRONG button.
That's for Pwn2Own, which google is also not particpating in. Pwnium (what this is about) allows pre-written exploits.