Vulnerabilities / Threats
2/3/2011
07:06 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Bets $20,000 You Can't Hack Chrome

A special $20,000 award awaits the Pwn2Own contestant who can hack Google's Chrome browser.

HP TippingPoint on Wednesday announced the dates for its Pwn2Own hacking competition -- March 9-11 in Vancouver -- and that Google has augmented the contest's $105,000 cash award fund with an additional $20,000 for anyone who can compromise the Chrome browser.

Other Web browsers available to potential hackers at the contest will include the latest release candidates of Apple's Safari, Microsoft's Internet Explorer, and Mozilla's Firefox, running on 64-bit systems under either Windows 7 or Mac OS X Snow Leopard.

The laptops used will be either a Sony Vaio, an Alienware m11x, or an Apple MacBook Air 13". For a successful hack of Firefox, Internet Explorer, or Safari, the hacker will win the laptop used and a $15,000 cash prize, along with some other benefits.

If Chrome is hacked -- and this requires escaping the Chrome sandbox using vulnerabilities only in Google-written code -- the competitor will win $20,000 and a Google CR-48 Chrome OS netbook. Perhaps because of the unfinished state of Chrome OS, competitors will not have the option of trying to break into Chrome on a Chrome OS netbook.

Mobile devices will be the other major target. Competitors will have the option of trying to hack into a Dell Venue Pro running Windows 7, an iPhone 4 running iOS, a Blackberry Torch 9800 running Blackberry 6 OS, or Nexus S running Android.

In addition, competitors this year will be able to attack cell phone baseband processors, which send and receive signals from cell towers. This has been an area of active security research, in part due to the availability of software called OpenBTS, which allows users to set up their own cell tower with some relatively inexpensive computer equipment.

As with the browser attacks, Pwn2Own competitors who execute a successful mobile device attack win the device itself and $15,000. Those who think they have the right stuff can register for the contest until February 15.

Awards of this sort appear to be helpful in promoting the controlled release of vulnerabilities. Three months ago, Google expanded its bug bounty program through which it pays $500 to $3,133.70 for previously undiscovered software flaws. Launched in January 2010 to reward those reporting Chrome bugs, the program was expanded to cover the company's Web sites in November.

Google paid out about $14,000 in bounties in January.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7896
Published: 2015-03-03
Multiple cross-site scripting (XSS) vulnerabilities in HP XP P9000 Command View Advanced Edition Software Online Help, as used in HP Device Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Tiered Storage Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Replication Manager 6.x and 7.x before ...

CVE-2014-9283
Published: 2015-03-03
The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

CVE-2014-9683
Published: 2015-03-03
Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

CVE-2015-0656
Published: 2015-03-03
Cross-site scripting (XSS) vulnerability in the login page in Cisco Network Analysis Module (NAM) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCum81269.

CVE-2015-0890
Published: 2015-03-03
The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.