Slashdot Mirror
Chrome Hacked In 5 Minutes At Pwn2Own
Skuto writes "After offering a total prize fund of up to $1M for a successful Chrome hack, it seems Google got what it wanted (or not!). No more than 5 minutes into the Pwn2Own cracking contest team Vupen exploited 2 Chrome bugs to demonstrate a total break of Google's browser. They will win at least 60k USD out of Google's prize fund, as well as taking a strong option on winning the overall Pwn2Own prize. It also illustrates that Chrome's much lauded sandboxing is not a silver bullet for browser security."
I think it's pretty clear they had their exploits worked out and ready to go for some time, and were just waiting for the contest to start to unleash them.
Still, kudos on what has to be almost world-record-time penetration of a "secure" system.
I do not fail; I succeed at finding out what does not work.
I guess this means they went in knowing exactly what they were going to do. This means that it has been known for a while which means there could be many more people who know and are exploiting this.
...now it seems you can also pwn2own google!
This isn't Swordfish. They had plenty of time to prepare their attack.
It's impressive they exploited Chrome. But the preparation took more than 5 minutes.
Handing out 2mill of prize money is still more cost effective that standard R&D, you get more professionals testing it for the chance of wining some prize money than Google could ever employ and the people they chose not to employ.
The posting says that one of the teams in Pwn2Own will win at least USD 60K from Google. But Google aren't putting up any Pwn2Own prize money. Last I heard Google are running their own competition with different rules. The participants in Pwn2Own may well not enter the Google competition because their exploit (if it escapes the sandbox) will be worth much more than USD 60K. My understanding is that the Pwn2Own entrants are not required to reveal their sandbox exploits before receiving the prize money because sandbox exploits are worth much more than the prize money that is available while Google will require full disclosure before handing over their money.
I haven't used Chrome for months. It was behaving errratically and made me nervous during a yime I was looking for a secure browser out of immediate necessity. I eventually managed to use an old version of firefox portable that settled things. I forgot pwn2own was even happening by the time I noticed Chrome zipped in my archives folder and deleted it as useless just two days ago.
But this stuff has me wondering: suppose this goes on and Chrome eventually has all of the exploits worked out of it. A theoretical possibility. Suppose, then, that some new features are requested. Now it seems to me that if I recall correctly, every time revisions are made to software, new exploits appear. This leads me to my first question: what is getting screwed up, learned, forgotten then screwed up again in the coding process that this always seems to be the case?
My second question is, by extension of the first, what are the major weaknesses of browsers? Their implementation of a half-finished "standard" like dHTML? The coders borrowing classes or libraries that would introduce flaw.X to any programmers including them or using them with the program? Programmers being clumsy and trying to force data types to do things they aren't meant to like fit four bytes through an argument that's two bytes wide, and instead of backtracking both directions and setting them both to te same width in planning, just over-riding some compiler warning and supressing runtime halts and sending it to market?
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
It doesn't have any of those annoying Google spying/tracing code built-in.
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
Tell me that Google couldn't do a better job than that.
5 minutes? What sort of coding knowledge does Google have anyway.
Essentially. Not broke per se, just not multibillionaires.
Do not look into laser with remaining eye.
So I run chrome inside of a sandbox so I can be sandboxed while Chrome's sandbox is being hacked.
Flappinbooger isn't my real name
That's $12 million/hour, more than Larry and Sergey combined :-)
Have you got your LWN subscription yet?
Thanks for linking to a complete useless, pointless and content-free Twitter post.
Are there any details on the exploit beyond "Code execution and sandbox escape (medium integrity process resulted)"?
$ echo "ceci n'est pas une pipe" | sed -Ee 's/(eci n|pas )//g'
saying "I know anecdotes aren't date" followed by "but insert anecdote here" doesn't excuse you from confirmation bias. There is no evidence presented by you that your practises wouldn't keep you just as safe with Opera or Gecko-based browsers.
What if Google set up a market protocol to buy Chrome bugs? $1k each, with strict disclosure and delivery terms. We might just deplete the entire Chinese exploit arsenal in 3 months... Or at least boost the knowledge-base of Chrome using CS students everywhere.
For in politics, as in religion, it is equally absurd to aim at making proselytes by fire and sword. - Publius
:D
For all the bad dudes out there who can do this, remember that it's a lot easier to break something than to build it.
I just saw some stuff on youtube that, well for me, was quite scary.
http://www.youtube.com/watch?v=fxri6DDYAdM
It was about dangerous sites on the internet. Youtube has lots of links to other similar postings.
A question for fellow slashdotters... how much truth is in this? Or are they playing games with me to scare the hell out of me?
Comments invited.
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
Common sense. With 100 million users there are many bad sites and these are not games. It is a dangerous place.
Yes there are many bad websites and legit ones that have been compromised with ads or hacked to serve javascript exploits. Wordpress seems to be a popular legit series of sites that hackers keep injecting bad ads and malware to infect users who browse.
Go Google Norton Safe web and click the top 10? It changes everyday.
If you are really freaked out use an anti virus package that has cloud updates that blocklists bad sites and prevents them from opening. Avast Free is a popular one which updates every 8 minutes and blocks any browser. Commodo Dragon is a Chromium/Chrome based browser that has built in website blocking from bad domains as they make Commodo IS (haven't used it but has good ratings, though slows down your computer).
If you go to www.openDNS.com you can use the IP addresses in your DNS settings and it will provide filtering too (not as quick to block as other AV products I listed above).
Use a great Anti Virus product and do not got wierd unknown sites. Do not listen to the slashdot geeks who claim you do not need AV products and that they are not infected. 90% are and all it takes is one bad or flash exploit ... keep flash up to date too by going to Adobe or www.filehippo.com. The new one will auto update. Good luck keeping secure
http://saveie6.com/
The whole concept of PWNing is that someone comes up with a way to circumvent the security built into that system. Sure, multiple layers like you describe will hopefully catch the intruder at some other point, where they try to do something that triggers an alarm. However, there is nothing you can do against zero-day vulnerabilities, other than multilayer your security and set up proper alerting.
People smart enough to find a zero day in a common and well tested browser, tend to be smart enough to write "payload code" that will not be detected by your virus scanner as well. Most likely, they will disable your local (windows) firewall (the payload would have to be OS specific anyway) and get the information they are after back to themselves some way.
Like others already said, you won't get to hear details on how they got through until after the patch has been rolled out and you can download a fixed version. If you want to learn how to defend yourself against zero-days in general, read what the leak was, do that for as many other zero-day vulnerabilities as you can spend time on and come up with generic defenses that will help against as much of those as possible. Just concentrating on this one won't do you any good.
I was promised a flying car. Where is my flying car?
sixty thousand clones of George Washington disagree with you on that.
I was promised a flying car. Where is my flying car?
What's "funny" about five minutes? The point of the competition is that you show up with your exploit, and run it. Five minutes is a pretty long time to do that in.
But breaking something in a way that no-one has ever done before is a lot HARDER than either.
It also illustrates that Chrome's much lauded sandboxing is not a silver bullet for browser security."
When I made a comment a few weeks back that the fact that Chrome could be installed without admin privileges is a huge security hole, I was told by the "experts" on here that because Chrome was sandboxed, my comment was completely without merit.
Repeat after me: there is no such thing as a secure application. Given enough time, someone, somewhere, will find a way to circumvent any security you may have in your software.
So yeah, fuckers, allowing Chrome to be installed without admin privileges IS a gaping security hole waiting to happen. And here it is.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
And, another question: Which sandbox did it exploit? Chromium has a chroot-based sandbox, an SELinux sandbox, a Capsicum sandbox, and a Windows sandbox and a Mac sandbox. Was the compromise something specific to one of these implementations, or was it in the platform-agnostic code?
I am TheRaven on Soylent News
That's probably because it's news for nerds, not news for computer engineers. The days when there was a natural bias on the internet towards computer geeks is over. Nerds on the internet come in all flavours now.
You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
This article linked in another post above disagrees:
Corrected headline .. :)
AccountKiller
"I'm gonna write myself a new minivan this afternoon!"
http://dilbert.com/strips/comic/1995-11-13/
Also:
http://thedailywtf.com/Comments/The-Defect-Black-Market.aspx
Online Starcraft RPG? At
Dietary fiber is like asynchronous IO-- Non-blocking!
Actual corrected headline. Please stop with the sensationalist headlines about hacking. The only number that matters is how long it took to find the exploits and to package them into an attack vector versus the reward from Google.
There are virtually no applications that will survive for more than a few minutes against a 0day when the attacker is given sufficient capability to execute an attack.
Well, that would explain why it took so long, if he had to type it out from memory.
If only there were a -1 WRONG button.
That's for Pwn2Own, which google is also not particpating in. Pwnium (what this is about) allows pre-written exploits.