Vulnerabilities / Threats
2/3/2011
07:06 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Bets $20,000 You Can't Hack Chrome

A special $20,000 award awaits the Pwn2Own contestant who can hack Google's Chrome browser.

HP TippingPoint on Wednesday announced the dates for its Pwn2Own hacking competition -- March 9-11 in Vancouver -- and that Google has augmented the contest's $105,000 cash award fund with an additional $20,000 for anyone who can compromise the Chrome browser.

Other Web browsers available to potential hackers at the contest will include the latest release candidates of Apple's Safari, Microsoft's Internet Explorer, and Mozilla's Firefox, running on 64-bit systems under either Windows 7 or Mac OS X Snow Leopard.

The laptops used will be either a Sony Vaio, an Alienware m11x, or an Apple MacBook Air 13". For a successful hack of Firefox, Internet Explorer, or Safari, the hacker will win the laptop used and a $15,000 cash prize, along with some other benefits.

If Chrome is hacked -- and this requires escaping the Chrome sandbox using vulnerabilities only in Google-written code -- the competitor will win $20,000 and a Google CR-48 Chrome OS netbook. Perhaps because of the unfinished state of Chrome OS, competitors will not have the option of trying to break into Chrome on a Chrome OS netbook.

Mobile devices will be the other major target. Competitors will have the option of trying to hack into a Dell Venue Pro running Windows 7, an iPhone 4 running iOS, a Blackberry Torch 9800 running Blackberry 6 OS, or Nexus S running Android.

In addition, competitors this year will be able to attack cell phone baseband processors, which send and receive signals from cell towers. This has been an area of active security research, in part due to the availability of software called OpenBTS, which allows users to set up their own cell tower with some relatively inexpensive computer equipment.

As with the browser attacks, Pwn2Own competitors who execute a successful mobile device attack win the device itself and $15,000. Those who think they have the right stuff can register for the contest until February 15.

Awards of this sort appear to be helpful in promoting the controlled release of vulnerabilities. Three months ago, Google expanded its bug bounty program through which it pays $500 to $3,133.70 for previously undiscovered software flaws. Launched in January 2010 to reward those reporting Chrome bugs, the program was expanded to cover the company's Web sites in November.

Google paid out about $14,000 in bounties in January.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.