Vulnerabilities / Threats
2/3/2011
07:06 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Bets $20,000 You Can't Hack Chrome

A special $20,000 award awaits the Pwn2Own contestant who can hack Google's Chrome browser.

HP TippingPoint on Wednesday announced the dates for its Pwn2Own hacking competition -- March 9-11 in Vancouver -- and that Google has augmented the contest's $105,000 cash award fund with an additional $20,000 for anyone who can compromise the Chrome browser.

Other Web browsers available to potential hackers at the contest will include the latest release candidates of Apple's Safari, Microsoft's Internet Explorer, and Mozilla's Firefox, running on 64-bit systems under either Windows 7 or Mac OS X Snow Leopard.

The laptops used will be either a Sony Vaio, an Alienware m11x, or an Apple MacBook Air 13". For a successful hack of Firefox, Internet Explorer, or Safari, the hacker will win the laptop used and a $15,000 cash prize, along with some other benefits.

If Chrome is hacked -- and this requires escaping the Chrome sandbox using vulnerabilities only in Google-written code -- the competitor will win $20,000 and a Google CR-48 Chrome OS netbook. Perhaps because of the unfinished state of Chrome OS, competitors will not have the option of trying to break into Chrome on a Chrome OS netbook.

Mobile devices will be the other major target. Competitors will have the option of trying to hack into a Dell Venue Pro running Windows 7, an iPhone 4 running iOS, a Blackberry Torch 9800 running Blackberry 6 OS, or Nexus S running Android.

In addition, competitors this year will be able to attack cell phone baseband processors, which send and receive signals from cell towers. This has been an area of active security research, in part due to the availability of software called OpenBTS, which allows users to set up their own cell tower with some relatively inexpensive computer equipment.

As with the browser attacks, Pwn2Own competitors who execute a successful mobile device attack win the device itself and $15,000. Those who think they have the right stuff can register for the contest until February 15.

Awards of this sort appear to be helpful in promoting the controlled release of vulnerabilities. Three months ago, Google expanded its bug bounty program through which it pays $500 to $3,133.70 for previously undiscovered software flaws. Launched in January 2010 to reward those reporting Chrome bugs, the program was expanded to cover the company's Web sites in November.

Google paid out about $14,000 in bounties in January.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0607
Published: 2014-07-24
Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.

CVE-2014-1419
Published: 2014-07-24
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.

CVE-2014-2360
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.

CVE-2014-2361
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.

CVE-2014-2362
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.