Slashdot Mirror
Hack Chromebook In Guest Mode, Win $100,000
An anonymous reader writes: Google has once again upped the ante for bug hunters concentrating on Chrome, and is now offering $100,000 to anyone capable of achieving a compromise of a Chromebook or Chromebox (the desktop variant of the Chromebook laptop) with device persistence in guest mode (i.e. guest to guest persistence with interim reboot, delivered via a web page). From Google's Monday announcement: Last year we introduced a $50,000 reward for the persistent compromise of a Chromebook in guest mode. Since we introduced the $50,000 reward, we haven't had a successful submission. That said, great research deserves great awards, so we're putting up a standing six-figure sum, available all year round with no quotas and no maximum reward pool.
Manages high security by being very limited. Don't get me wrong, if all you want is a portable machine with a browser then it's great.
I use a Chromebox as a second device. Its great for quick browser access nothing more though. It was cheap and Chrome OS runs better on cheap hardware then Windows 10. Otherwise Chrome OS is too limiting to be real useful, which brings to mind why Google would even suggest hacking Guest mode which by design only gives you access to Chrome browser and nothing else. If your going to hack a Chrome OS device Guest would not provide a hacker much of anything. If you could hack into a user on a Chrome device that might be something, but then again much of the files are in cloud storage. I frankly can understand why no hacker pays much attention to a Chrome device. Its not worth it.
question: can you hack a hardened, underpowered Linux workstation without root access.
response: no one hacks an OS anymore, they bolt-on worms, social engineering, flash zero-days and javascript bypasses to steal your credit cards and dick pics.
Good people go to bed earlier.
Hardly worth the effort. When they put up a reward matching a years pay for an average Google employee I might be interested.
I've got a great idea for another contest. The Slashdot headline for the submission about it could be, "Use Chromebook Productively, Win $100,000".
As that title states, if somebody can manage to do something even slightly productive (sorry, browsing Facebook doesn't count!) using a Chromebook, they'd get $100,000.
To be honest, I think there's a greater likelihood of a payout in this security challenge than there would be in that productivity challenge.
So what do I get? My chromebox was the one released at google i/o 2012 with a Core i5 sandy bridge and I'm running a custom coreboot + seabios installation and full ubuntu with completely replaced ChromeOS with 8gb of ddr3 and a 256gb crucial m4 ssd and it's my personal server running a virtual machine hosting several websites and my personal email/file server and I even released a customized version of the Chrubuntu script that includes a bunch of additional options if you don't want to go all out like I did. https://github.com/austinksmith/Chruboostu
I found a job for GhostShell!
Chrome is getting alot more popular with users and schools in particular, its nice to see them pushing on the security like this - up to this point it probably hasn't been worth the time of someone to compromise it (from a marketshare standpoint), but that day is coming. It's good Google is trying to stay ahead of that.
My wife got a Chromebook to augment / replace her Linux desktop. I set the Chromebook up to boot Ubuntu, but we went ahead and booted ChromeOS once just to check it out. I was surprised to find she never had any reason to boot into Ubuntu. ChromeOS does everything she wants to do with her computer and it's fast.
Most recently, she's been job hunting. She looks for job on the web, edits her resume in Google Docs, fills out pdf forms, all on ChromeOS. It actually does 90% of what I use my computer for too - email, browsing, ssh, and text editing (programming). I'm a old-school programmer who doesn't use an IDE except once every few years when I write in a Microsoft language.
At y old job, a business I owned, I spent 80% of my time using SSH, which works fine from ChromeOS. At my current job, I run a couple of virtual machines on my computer and the company chat program, so a ChromeBook wouldn't do for work, but at home virtual machines go on the server that has 32 GB of RAM and multiple CPUs anyway. So I'd probably be just fine with a ChromeBook at home too.
As an added bonus, Google Inc now has a full profile of your and your wife's life. They know she has been looking for a job, everything. And you only had to pay hundreds of dollars for the privilege. So it is a win/win.
Google already had that. The Chromebook is just their way of paying it forward.
Not really an OS vulnerability, but you can reserialize the logic board on at least some Chromebook models.
The process does involve disassembling the device to disconnect the battery and remove the write-protect screw temporarily though. Again, it's not a ChromeOS bug, but it does allow, for example, a high school student to bypass the school's management, or a thief to bypass any sort of lost mode protection enabled by the owner.