Attacks/Breaches
3/8/2012
01:12 PM
50%
50%

Google Chrome Falls Twice In Hacking Contest

VUPEN Security hacks Google Chrome, Safari, and Internet Explorer to take early lead in Pwn2Own contest.

Anonymous: 10 Facts About The Hacktivist Group
Anonymous: 10 Facts About The Hacktivist Group
(click image for larger view and for slideshow)

In this year's annual Pwn2Own battle of browser-hacking prowess, Google Chrome was the first to fall--and in the first five minutes of the competition.

French vulnerability research firm VUPEN Security stormed to an early lead in the annual Pwn2Own cracking contest, which is part of this week's CanSecWest information security conference in Vancouver. VUPEN received 32 points for the Chrome hack from officials at TippingPoint's Zero Day Initiative, a bug-bounty reward program that sponsors the contest. By day's end Vupen was in the lead with 62 points, after also hacking Safari 5 on Mac OS X Snow Leopard and Firefox 3 on Windows XP. The contest continues through Friday.

According to a tweet from VUPEN, its Chrome exploit involved "code execution and sandbox escape (medium integrity process resulted)" against a copy of Chrome running on Windows 7. VUPEN has previously discovered zero-day vulnerabilities that exploited Chrome after bypassing its sandbox, although this is the first time in three years that Chrome has been exploited in the Pwn2Own contest, the lead-up to which typically sees browser makers furiously issuing patches.

[ Here's how you can address some of today's greatest security challenges to help keep your company's data safe. See 10 Lessons From RSA Security Conference. ]

"We wanted to show that even Chrome is not unbreakable," VUPEN CEO Chaouki Bekrar told Ars Technica.

Also Wednesday, veteran Chrome researcher Sergey Glazunov earned a quick $60,000 for an attack that bypassed the Chrome sandbox using only code native to Chrome and which allowed him to execute an arbitrary exploit, as part of Google's alternative "Pwnium" contest.

While Google has helped sponsor the Pwn2Own prize in recent years, this year the company announced that it was pulling out, due to a change in contest rules. "Originally, our plan was to sponsor as part of this year's Pwn2Own competition," said Chris Evans and Justin Schuh, part of the Google Chrome security team, in a blog post. "Unfortunately, we decided to withdraw our sponsorship when we discovered that contestants are permitted to enter Pwn2Own without having to reveal full exploits (or even all of the bugs used!) to vendors. Full exploits have been handed over in previous years, but it's an explicit non-requirement in this year's contest, and that's worrisome."

Instead, Google created Pwnium, promising to issue up to $1 million in prize money in exchange for full disclosure (and Google promising to share all flaws with relevant vendors). "We will issue multiple rewards per category, up to the $1 million limit, on a first-come-first served basis. There is no splitting of winnings or 'winner takes all,'" said Evans and Schuh.

"We require each set of exploit bugs to be reliable, fully functional end to end, disjoint, of critical impact, present in the latest versions, and genuinely zero-day--i.e., not known to us or previously shared with third parties. Contestant's exploits must be submitted to and judged by Google before being submitted anywhere else," they said.

Beyond the $60,000 prize--awarded for any attack that exploits only Chrome bugs--contestants can win $40,000 by combining a Chrome bug with another bug, and $20,000 for exploiting a bug in third-party code, such as browser plug-ins, Flash, or Windows. All Pwnium winners also get a Chromebook.

It's no longer a matter of if you get hacked, but when. In this special retrospective of news coverage, Monitoring Tools And Logs Make All The Difference, Dark Reading takes a look at ways to measure your security posture and the challenges that lie ahead with the emerging threat landscape. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
HH000
50%
50%
HH000,
User Rank: Apprentice
3/9/2012 | 11:09:07 AM
re: Google Chrome Falls Twice In Hacking Contest
Does it escaped?
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-6093
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6196
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSp...

CVE-2014-7247
Published: 2014-11-25
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?