Vulnerabilities / Threats
2/3/2011
07:06 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Google Bets $20,000 You Can't Hack Chrome

A special $20,000 award awaits the Pwn2Own contestant who can hack Google's Chrome browser.

HP TippingPoint on Wednesday announced the dates for its Pwn2Own hacking competition -- March 9-11 in Vancouver -- and that Google has augmented the contest's $105,000 cash award fund with an additional $20,000 for anyone who can compromise the Chrome browser.

Other Web browsers available to potential hackers at the contest will include the latest release candidates of Apple's Safari, Microsoft's Internet Explorer, and Mozilla's Firefox, running on 64-bit systems under either Windows 7 or Mac OS X Snow Leopard.

The laptops used will be either a Sony Vaio, an Alienware m11x, or an Apple MacBook Air 13". For a successful hack of Firefox, Internet Explorer, or Safari, the hacker will win the laptop used and a $15,000 cash prize, along with some other benefits.

If Chrome is hacked -- and this requires escaping the Chrome sandbox using vulnerabilities only in Google-written code -- the competitor will win $20,000 and a Google CR-48 Chrome OS netbook. Perhaps because of the unfinished state of Chrome OS, competitors will not have the option of trying to break into Chrome on a Chrome OS netbook.

Mobile devices will be the other major target. Competitors will have the option of trying to hack into a Dell Venue Pro running Windows 7, an iPhone 4 running iOS, a Blackberry Torch 9800 running Blackberry 6 OS, or Nexus S running Android.

In addition, competitors this year will be able to attack cell phone baseband processors, which send and receive signals from cell towers. This has been an area of active security research, in part due to the availability of software called OpenBTS, which allows users to set up their own cell tower with some relatively inexpensive computer equipment.

As with the browser attacks, Pwn2Own competitors who execute a successful mobile device attack win the device itself and $15,000. Those who think they have the right stuff can register for the contest until February 15.

Awards of this sort appear to be helpful in promoting the controlled release of vulnerabilities. Three months ago, Google expanded its bug bounty program through which it pays $500 to $3,133.70 for previously undiscovered software flaws. Launched in January 2010 to reward those reporting Chrome bugs, the program was expanded to cover the company's Web sites in November.

Google paid out about $14,000 in bounties in January.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0103
Published: 2014-07-29
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

CVE-2014-0475
Published: 2014-07-29
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

CVE-2014-0889
Published: 2014-07-29
Multiple cross-site scripting (XSS) vulnerabilities in IBM Atlas Suite (aka Atlas Policy Suite), as used in Atlas eDiscovery Process Management through 6.0.3, Disposal and Governance Management for IT through 6.0.3, and Global Retention Policy and Schedule Management through 6.0.3, allow remote atta...

CVE-2014-2226
Published: 2014-07-29
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtains sensitive information via unspecified vectors.

CVE-2014-3020
Published: 2014-07-29
install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.

Best of the Web
Dark Reading Radio