Slashdot Mirror
Chrome Hacked In 5 Minutes At Pwn2Own
Skuto writes "After offering a total prize fund of up to $1M for a successful Chrome hack, it seems Google got what it wanted (or not!). No more than 5 minutes into the Pwn2Own cracking contest team Vupen exploited 2 Chrome bugs to demonstrate a total break of Google's browser. They will win at least 60k USD out of Google's prize fund, as well as taking a strong option on winning the overall Pwn2Own prize. It also illustrates that Chrome's much lauded sandboxing is not a silver bullet for browser security."
I think it's pretty clear they had their exploits worked out and ready to go for some time, and were just waiting for the contest to start to unleash them.
Still, kudos on what has to be almost world-record-time penetration of a "secure" system.
I do not fail; I succeed at finding out what does not work.
I guess this means they went in knowing exactly what they were going to do. This means that it has been known for a while which means there could be many more people who know and are exploiting this.
...now it seems you can also pwn2own google!
I think that a lot of people will put an awful lot of work in for a shot at money. It worked for the X-prize foundation, after all.
Of course, I don't think Bill Gates would be one of the richest men in the world if Microsoft had adopted the same policy as Google did with Chrome...
Do not look into laser with remaining eye.
This isn't Swordfish. They had plenty of time to prepare their attack.
It's impressive they exploited Chrome. But the preparation took more than 5 minutes.
Handing out 2mill of prize money is still more cost effective that standard R&D, you get more professionals testing it for the chance of wining some prize money than Google could ever employ and the people they chose not to employ.
The posting says that one of the teams in Pwn2Own will win at least USD 60K from Google. But Google aren't putting up any Pwn2Own prize money. Last I heard Google are running their own competition with different rules. The participants in Pwn2Own may well not enter the Google competition because their exploit (if it escapes the sandbox) will be worth much more than USD 60K. My understanding is that the Pwn2Own entrants are not required to reveal their sandbox exploits before receiving the prize money because sandbox exploits are worth much more than the prize money that is available while Google will require full disclosure before handing over their money.
I haven't used Chrome for months. It was behaving errratically and made me nervous during a yime I was looking for a secure browser out of immediate necessity. I eventually managed to use an old version of firefox portable that settled things. I forgot pwn2own was even happening by the time I noticed Chrome zipped in my archives folder and deleted it as useless just two days ago.
But this stuff has me wondering: suppose this goes on and Chrome eventually has all of the exploits worked out of it. A theoretical possibility. Suppose, then, that some new features are requested. Now it seems to me that if I recall correctly, every time revisions are made to software, new exploits appear. This leads me to my first question: what is getting screwed up, learned, forgotten then screwed up again in the coding process that this always seems to be the case?
My second question is, by extension of the first, what are the major weaknesses of browsers? Their implementation of a half-finished "standard" like dHTML? The coders borrowing classes or libraries that would introduce flaw.X to any programmers including them or using them with the program? Programmers being clumsy and trying to force data types to do things they aren't meant to like fit four bytes through an argument that's two bytes wide, and instead of backtracking both directions and setting them both to te same width in planning, just over-riding some compiler warning and supressing runtime halts and sending it to market?
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
Without vulnerability details there really is no story. Without knowing what exactly is going on here we can't know what precautions to take or whether there is any likelihood of other software (even our own) being affected. Or if there's even a real story here.
I mean, it's nice they're going to win a price an all, but there's nothing here for us that we can act upon. Without knowing any details we can't even really know whether we're any safer if using another browser.
It doesn't have any of those annoying Google spying/tracing code built-in.
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
Tell me that Google couldn't do a better job than that.
5 minutes? What sort of coding knowledge does Google have anyway.
So I run chrome inside of a sandbox so I can be sandboxed while Chrome's sandbox is being hacked.
Flappinbooger isn't my real name
That's $12 million/hour, more than Larry and Sergey combined :-)
Have you got your LWN subscription yet?
You forgot "In Soviet Russia..."
You're such an ass-licking nigger. See that gaping goatse guy's asshole? Yeah your tongue has been in there.
Thanks for linking to a complete useless, pointless and content-free Twitter post.
Currently, the latest release vesrion of Chrome is 17.0.963.66. Let's see the hackers try that exploit with this version and see if they succeed. :-)
Are there any details on the exploit beyond "Code execution and sandbox escape (medium integrity process resulted)"?
$ echo "ceci n'est pas une pipe" | sed -Ee 's/(eci n|pas )//g'
If I was sitting on an exploit for a competition, I would practice it many times in advance. There is no award for same exploit done in 6 minutes.
The prize isn't a lot of money by Google standards, but it's a lot of money by most people's. Kudos to Google for putting up enough money to get some serious hack attempts to come out of the woodwork.
OMFGBBQ that is so interesting. +11
OMFGBBQWTFROTFMAO !!!
saying "I know anecdotes aren't date" followed by "but insert anecdote here" doesn't excuse you from confirmation bias. There is no evidence presented by you that your practises wouldn't keep you just as safe with Opera or Gecko-based browsers.
What if Google set up a market protocol to buy Chrome bugs? $1k each, with strict disclosure and delivery terms. We might just deplete the entire Chinese exploit arsenal in 3 months... Or at least boost the knowledge-base of Chrome using CS students everywhere.
For in politics, as in religion, it is equally absurd to aim at making proselytes by fire and sword. - Publius
For all the bad dudes out there who can do this, remember that it's a lot easier to break something than to build it.
Writing exploits for a modern browser like Firefox, where they have a good process and use static analysis tools to eliminate most possible exploitable bugs, or a browser like Chrome that has decent engineering but a hardware-assisted sandbox, is probably the hardest thing in all of computer science. Only a tiny few can do it these days. Building a browser just takes time and effort, exploiting it takes doing the 'impossible'.
Does this exploit sandbox in other programs? Or was Google just arrogant in setting forth this challenge figuring it would take them several hours or days to crack it?
5-minutes or under is is funny, but does this also mean that the "sandbox" idea is a waste of time in other programs!
It is funny Google claimed they wanted to find out how Chrome could be cracked so they can fix the problems, only to find out they are no where near being a "secure" browser..
Haha, no.
The whole concept of PWNing is that someone comes up with a way to circumvent the security built into that system. Sure, multiple layers like you describe will hopefully catch the intruder at some other point, where they try to do something that triggers an alarm. However, there is nothing you can do against zero-day vulnerabilities, other than multilayer your security and set up proper alerting.
People smart enough to find a zero day in a common and well tested browser, tend to be smart enough to write "payload code" that will not be detected by your virus scanner as well. Most likely, they will disable your local (windows) firewall (the payload would have to be OS specific anyway) and get the information they are after back to themselves some way.
Like others already said, you won't get to hear details on how they got through until after the patch has been rolled out and you can download a fixed version. If you want to learn how to defend yourself against zero-days in general, read what the leak was, do that for as many other zero-day vulnerabilities as you can spend time on and come up with generic defenses that will help against as much of those as possible. Just concentrating on this one won't do you any good.
I was promised a flying car. Where is my flying car?
sixty thousand clones of George Washington disagree with you on that.
I was promised a flying car. Where is my flying car?
Where's the $1M for a/the hack?
What's "funny" about five minutes? The point of the competition is that you show up with your exploit, and run it. Five minutes is a pretty long time to do that in.
But breaking something in a way that no-one has ever done before is a lot HARDER than either.
the target systems musta been running vista and still booting on the word 'go'.
It also illustrates that Chrome's much lauded sandboxing is not a silver bullet for browser security."
When I made a comment a few weeks back that the fact that Chrome could be installed without admin privileges is a huge security hole, I was told by the "experts" on here that because Chrome was sandboxed, my comment was completely without merit.
Repeat after me: there is no such thing as a secure application. Given enough time, someone, somewhere, will find a way to circumvent any security you may have in your software.
So yeah, fuckers, allowing Chrome to be installed without admin privileges IS a gaping security hole waiting to happen. And here it is.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
So GOOGLE keeps a lot of paid shills around here then, eh? That's what I am gathering from your statements. Slashdot's "groupthink" also? However - in case they are NOT "paid for trolling downmodding shills"?? Don't you really mean 'sheep-think', instead???
I state that, because a good 90% of the fools around here don't know a DAMNED THING about computing other than @ user level (perhaps @ the network admin level, & that's only a user with a BETTER PASSWORD!).
Is encryption on everything so that even the FBI or the NSA will not be able to hack.
That is not going to happen
And, another question: Which sandbox did it exploit? Chromium has a chroot-based sandbox, an SELinux sandbox, a Capsicum sandbox, and a Windows sandbox and a Mac sandbox. Was the compromise something specific to one of these implementations, or was it in the platform-agnostic code?
I am TheRaven on Soylent News
This article linked in another post above disagrees:
For all the bad dudes out there who can do this, remember that it's a lot easier to break something than to build it.
In general, I'd say it's a lot easier to build insecure software than it is to find and exploit bugs in software.
Corrected headline .. :)
AccountKiller
"I'm gonna write myself a new minivan this afternoon!"
http://dilbert.com/strips/comic/1995-11-13/
Also:
http://thedailywtf.com/Comments/The-Defect-Black-Market.aspx
Online Starcraft RPG? At
Dietary fiber is like asynchronous IO-- Non-blocking!
For all the commenters who remark that Vupen had their exploits ready to go--and to the moderator who thinks those comments are just so d@mn interesting--look back at previous Pwn2owns and you'll see the same thing--but with other browsers. You've all merely revealed yourselves as either ignoramuses (probably just a few) or completely pwned by Google (most likely). What's actually interesting about the contest this year is that Chrome hadn't been pwned in any previous year, and this year Google claims to put up millions of dollars, and (surprise!) they do get pwned. All you Chrome users have been living in a dream world. What's even more interesting is that Vupen isn't apparently to receive a million dollar prize. And that's false advertising.
Actual corrected headline. Please stop with the sensationalist headlines about hacking. The only number that matters is how long it took to find the exploits and to package them into an attack vector versus the reward from Google.
There are virtually no applications that will survive for more than a few minutes against a 0day when the attacker is given sufficient capability to execute an attack.
Well, that would explain why it took so long, if he had to type it out from memory.
FUNNY they get 60K NOT 1 MILL....not worth helping corporate america sorry..give me 100 million ill show ya a few bugs and hacks....other wise piss off.
If only there were a -1 WRONG button.
That's for Pwn2Own, which google is also not particpating in. Pwnium (what this is about) allows pre-written exploits.