Vulnerabilities / Threats
2/3/2011
07:06 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%
Repost This

Google Bets $20,000 You Can't Hack Chrome

A special $20,000 award awaits the Pwn2Own contestant who can hack Google's Chrome browser.

HP TippingPoint on Wednesday announced the dates for its Pwn2Own hacking competition -- March 9-11 in Vancouver -- and that Google has augmented the contest's $105,000 cash award fund with an additional $20,000 for anyone who can compromise the Chrome browser.

Other Web browsers available to potential hackers at the contest will include the latest release candidates of Apple's Safari, Microsoft's Internet Explorer, and Mozilla's Firefox, running on 64-bit systems under either Windows 7 or Mac OS X Snow Leopard.

The laptops used will be either a Sony Vaio, an Alienware m11x, or an Apple MacBook Air 13". For a successful hack of Firefox, Internet Explorer, or Safari, the hacker will win the laptop used and a $15,000 cash prize, along with some other benefits.

If Chrome is hacked -- and this requires escaping the Chrome sandbox using vulnerabilities only in Google-written code -- the competitor will win $20,000 and a Google CR-48 Chrome OS netbook. Perhaps because of the unfinished state of Chrome OS, competitors will not have the option of trying to break into Chrome on a Chrome OS netbook.

Mobile devices will be the other major target. Competitors will have the option of trying to hack into a Dell Venue Pro running Windows 7, an iPhone 4 running iOS, a Blackberry Torch 9800 running Blackberry 6 OS, or Nexus S running Android.

In addition, competitors this year will be able to attack cell phone baseband processors, which send and receive signals from cell towers. This has been an area of active security research, in part due to the availability of software called OpenBTS, which allows users to set up their own cell tower with some relatively inexpensive computer equipment.

As with the browser attacks, Pwn2Own competitors who execute a successful mobile device attack win the device itself and $15,000. Those who think they have the right stuff can register for the contest until February 15.

Awards of this sort appear to be helpful in promoting the controlled release of vulnerabilities. Three months ago, Google expanded its bug bounty program through which it pays $500 to $3,133.70 for previously undiscovered software flaws. Launched in January 2010 to reward those reporting Chrome bugs, the program was expanded to cover the company's Web sites in November.

Google paid out about $14,000 in bounties in January.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-0460
Published: 2014-04-16
The init script in kbd, possibly 1.14.1 and earlier, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/defkeymap.map.

CVE-2011-0993
Published: 2014-04-16
SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.

CVE-2011-3180
Published: 2014-04-16
kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

CVE-2011-4089
Published: 2014-04-16
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.

CVE-2011-4192
Published: 2014-04-16
kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double quotes in kiwi_oemtitle of .profile."

Best of the Web