Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Hack Chrome, Win $20,000

timothy posted more than 3 years ago | from the don't-quit-my-day-job dept.

Chrome 79

CWmike writes "Google will pay $20,000 to the first to exploit its Chrome browser at this year's Pwn2Own hacking contest at CanSecWest in Vancouver, BC, on March 9. At this year's Pwn2Own, researchers will pit exploits against machines running Windows 7 or Mac OS X as they try to bring down Microsoft's IE, Mozilla's Firefox, Apple's Safari and Chrome. The first researchers to hack IE, Firefox and Safari will receive $15,000 and the machine running the browser. The prizes are $5,000 more than those given for exploiting browsers at the last Pwn2Own contest, and three times more than the 2009 awards. 'We've upped the ante this time around and the total cash pool allotted for prizes has risen to a whopping $125,000,' said Aaron Portnoy, the manager of the sponsor, HP TippingPoint's security research team, which set the contest's rules Wednesday in a blog post written by Portnoy."

cancel ×

79 comments

Sorry! There are no comments related to the filter you selected.

of course not on linux (0, Flamebait)

Anonymous Coward | more than 3 years ago | (#35094968)

That wouldn't be fair.

Re:of course not on linux (0)

thetoadwarrior (1268702) | more than 3 years ago | (#35095082)

I presume it would be easier on Windows anyway so who cares?

Slashdot wins (1)

Suki I (1546431) | more than 3 years ago | (#35095276)

I presume it would be easier on Windows anyway so who cares?

My Chrome on Win7 looks all funny in the new Slashdot.

Re:of course not on linux (0)

Anonymous Coward | more than 3 years ago | (#35095702)

Maybe you should compare (1 [google.com] , 2 [google.com] ) Chromium's sandboxing implementations before making that statement. It's consistently had a fledgling half-working SUID build, and AppArmor has been basically ignored by the devs. Security on Chromium seems to start on Windows and then work its way down.

Re:of course not on linux (1, Insightful)

hairyfeet (841228) | more than 3 years ago | (#35095578)

First of all to quote the million pedantics we have here "Linux is a kernel NOT an OS" and second, which fricking one? There are about a bazillion Linux based distros out there, and ANY one they choose will be considered shite by the Linux geeks: Ubuntu? kiddie newb OS according to the guys here.

And then of course is the elephant in the room: Linux is only used by geeks that actually know enough about an OS to work on it and therefor are more secure simply by having more knowledge and experience. It is like the different between an Air Force flight mechanic and the guy that works on airplanes at the backwoods airport, in that one always lives with a wrench in his hand and is constantly working on different things (just like the Linux geeks I know which try different distros like normal people try on clothes) and the other that knows just enough to be dangerous, like the average Windows or Mac user I have to clean up after.

But in the end it is companies like Google that care about this, and with them it all comes down to demographics. Linux users are more likely to use Chromium because they actually care (or even know) about privacy issues, and are likely to tweak everything they run. Windows and Mac users run defaults a good 99.995% of the time and THAT is what companies like Google want to find out: Will their defaults make it easy to hack or not. Linux simply brings nothing to this discussion,anymore than letting someone like me go into the Windows machine and set everything up beforehand so it would be less of a target.

Exploits? (0)

Anonymous Coward | more than 3 years ago | (#35095118)

I'm a bit confused by the article. They use so many buzzwords I'm not sure what they're looking for when they say "hack".

1 vulnerability to escape a sandbox, 1 vulnerability to exploit a bug in chrome, but to what end? Hijacking someone's session data?

Re:Exploits? (1)

MrEricSir (398214) | more than 3 years ago | (#35095188)

Immanentizing the eschaton?

Re:Exploits? (1)

tehcyder (746570) | more than 3 years ago | (#35103458)

That's easy for you to say.

Re:Exploits? (1)

99BottlesOfBeerInMyF (813746) | more than 3 years ago | (#35095196)

Pwn2Own has been going on for years. Just Google the competition and the goal required to win a prize is very clearly explained.

Re:Exploits? (1)

Suki I (1546431) | more than 3 years ago | (#35095298)

I'm a bit confused by the article. They use so many buzzwords I'm not sure what they're looking for when they say "hack".

1 vulnerability to escape a sandbox, 1 vulnerability to exploit a bug in chrome, but to what end? Hijacking someone's session data?

Golf may be involved. Perhaps a taxi driver golfing, with a driver.

Re:Exploits? (1)

Stenchwarrior (1335051) | more than 3 years ago | (#35095674)

They have to hack the browsers from the cloud while using public apps and in a virtual environment, all the while staying well within the green limits set forth by the cyber industry. If they win they get $15,000 and a set of e-nano replicators.

The machine is a prize? (3, Funny)

MrEricSir (398214) | more than 3 years ago | (#35095148)

The list of prizes includes "... the machine running the browser."

Who would be dumb enough to use a computer they won from a hacking contest?

Re:The machine is a prize? (2)

Rinnon (1474161) | more than 3 years ago | (#35095246)

That's a kind of silly question. It's not like a door that has been broken open and won't close. They'll probably take it home, install Linux on it, maybe change the MAC address on the NIC, and it's basically a new machine.

Re:The machine is a prize? (2)

MrEricSir (398214) | more than 3 years ago | (#35095350)

Not if the hardware was compromised.

Re:The machine is a prize? (0)

Anonymous Coward | more than 3 years ago | (#35095668)

Not if the hardware was compromised.

How would the hardware be compromised from a browser exploit?

Re:The machine is a prize? (0)

Anonymous Coward | more than 3 years ago | (#35095908)

Code injection, elevation to standard user, elevation to super user, flaw to direct HW access, firmware compromise?

Man, exploits are getting complex nowadays...

Re:The machine is a prize? (1, Insightful)

MrEricSir (398214) | more than 3 years ago | (#35095920)

*facepalm*

Re:The machine is a prize? (1)

tehcyder (746570) | more than 3 years ago | (#35103496)

simple, you bring up a DOS prompt and ask the user to type in "format c:"

Re:The machine is a prize? (1)

nzac (1822298) | more than 3 years ago | (#35095904)

I know browser hackers are not necessarily quite as skilled as (open)bsd hackers (but have success much more often) but i would think that the effort to make a hardware exploit that is undetectable to a winner would be more effort than its worth (it would have to survive a motherboard inspection and behave like the regular component almost all of the time) when it is likely that most hacking would be done from a desktop.

Or if you think hacking the browser did the damage i think they win when they can execute some arbitrary code on the other machine (not that damaging unless the excitable was intended to do so)

Re:The machine is a prize? (0)

Anonymous Coward | more than 3 years ago | (#35096604)

... the effort to make a hardware exploit that is undetectable to a winner would be more effort than its worth ...

au contraire!
a hardware rootkit on the machine of the contests winner is surely something...

Re:The machine is a prize? (2)

Riceballsan (816702) | more than 3 years ago | (#35097594)

That puts it roughly at the same level of safety as any laptop you buy. If the hardware was comprimised, The government, the chip manufacturers, the QC people, the government could be requiring a hidden back door, any number of possible vectors are a higher possibility then some insane uber hacker planting a hardware level attack through a network connection in the plain view of several other hackers, that somehow finds it worth his time to plant a bug intended for the winner, but is not worth his time to just use his knowlege to get $20,000 and win the laptop himself.

Re:The machine is a prize? (1)

dudpixel (1429789) | more than 3 years ago | (#35099686)

who says you have to connect it to the internet?

Re:The machine is a prize? (1)

commodore64_love (1445365) | more than 3 years ago | (#35095474)

I'd take it. I don't mind non-virgin machines.

random question:
  - I'm running the non-google Chromium right now. Any reason to upgrade to Chrome?

Re:The machine is a prize? (1)

BisexualPuppy (914772) | more than 3 years ago | (#35095940)

No shit, Sherlock ?

Re:The machine is a prize? (1)

LordLimecat (1103839) | more than 3 years ago | (#35103412)

Why would you need to change the mac address?

Its like people think that someone else knowing your NIC's MAC is a security issue; you cant even discover a MAC address once you go through a router.

Re:The machine is a prize? (1)

tehcyder (746570) | more than 3 years ago | (#35103470)

That's a kind of silly question. It's not like a door that has been broken open and won't close. They'll probably take it home, install Linux on it, maybe change the MAC address on the NIC, and it's basically a new machine.

They'll install Linux in a door?!

Now I'm confused too.

Re:The machine is a prize? (0)

Anonymous Coward | more than 3 years ago | (#35095252)

People can certainly reformat the PC if they want to and the problem is solved.

Re:The machine is a prize? (4, Funny)

TaoPhoenix (980487) | more than 3 years ago | (#35095256)

"I'll take Things to do with faulty Sandy Bridge machines for 200 Alex".

Re:The machine is a prize? (1)

nzac (1822298) | more than 3 years ago | (#35095268)

Why?? You would have a rather good understanding of what you just did to the computer so you can fix it.

Or if you are worried about being traced as a hacker the hard drive would immediately be formatted and os reinstalled and if you are especially paranoid or do illegal hacking change the MAC address.

Re:The machine is a prize? (0)

Anonymous Coward | more than 3 years ago | (#35095320)

do illegal hacking change the MAC address.

It's a contest where people are invited to compete to break into the machine. What is so illegal about it? And change the MAC address? What for?? They are not stealing the machine!! And MAC address is fixed to the motherboard. Might as well change BIOS version - would be same useless effect.

Re:The machine is a prize? (1)

nzac (1822298) | more than 3 years ago | (#35095406)

note the if conditional statement >> if(paranoid || illegal hacker)
if he was he might see the need to do this

google mac address changer for me. I don’t know the specifics but its not on the motherboard its on network hardware so proof of concept would be to swap out the hardware.

Re:The machine is a prize? (1)

wed128 (722152) | more than 3 years ago | (#35095654)

you can spoof a mac address in software anyway; the ifconfig ether command for instance.

Re:The machine is a prize? (0)

Anonymous Coward | more than 3 years ago | (#35095460)

Your comment makes me very sad as to what Slashdot has become...

Re:The machine is a prize? (1)

eviljolly (411836) | more than 3 years ago | (#35095492)

From what I understand, the people receiving the machine would be the ones hacking it in the first place. I don't think there would be a problem.

Re:The machine is a prize? (0)

Anonymous Coward | more than 3 years ago | (#35095794)

Do you trash the computer you own every time you run Windows Update or your OS' equivalent? Idiot.

P.S.: Woosh all you want, it's a shitty joke so I replied anyway just in case.

Re:The machine is a prize? (1)

MrEricSir (398214) | more than 3 years ago | (#35095882)

Windows Update can't solder a keylogger into my USB subsystem, so even if I used Windows, I wouldn't be too worried about that.

Re:The machine is a prize? (1)

allusionist (983106) | more than 3 years ago | (#35097532)

Let's start with the fact that as the WINNER of the contest, they were the ones who hacked it before we get into the other absurdities of that statement.

Oh, and remember that this is only a contest, so they're just trying to get through the security, not actually do anything damaging once they're in.

Re:The machine is a prize? (1)

YoshiDan (1834392) | more than 3 years ago | (#35099318)

The details of the exploit used in the competition aren't released until after the vendor has released a patch to fix it...

Cat and Mouse (1)

Arch_Android (1989386) | more than 3 years ago | (#35095152)

While I applaud their efforts, the truth of it is that there's always another exploit to fix.

Re:Cat and Mouse (0)

Anonymous Coward | more than 3 years ago | (#35095218)

According to TFA, they've been offering a prize at this contest for hacking Chrome since 2009 and no one has yet taken it.

Re:Cat and Mouse (1)

samuel.hurley (1220378) | more than 3 years ago | (#35095966)

Plus, its sort of a bad deal for the contestants, isn't it? Expand many man-hours of effort groping for a prize that probably won't materialize. No one is guaranteed to 'win,' but Google is guaranteed to get lots of free labour! Just a thought before you enter into something like this...

Hack Chrome, Win $20,000 (2)

John Hasler (414242) | more than 3 years ago | (#35095272)

Shouldn't the prize be a free copy of Chrome?

Oh. Wait...

Re:Hack Chrome, Win $20,000 (1)

rainbow9898 (1988456) | more than 3 years ago | (#35101212)

Thanks for showing up such fabulous information. I have bookmarked you and will remain in line with your new posts. I like this post, keep writing and give informative post...! escort delhi [hotmodelindelhi.com]

Chrome stands tall (4, Insightful)

Randyll (1914386) | more than 3 years ago | (#35095416)

Chrome has never been hacked, which is not surprising, because the contest requires the contestant to exploit a Chrome bug and escape the sandbox while doing so. This is a far greater challenge than merely exploiting a browser bug that lets you do whatever, because if you find an exploit in Chrome the odds are high you will run into the sandbox [google.com] and be stopped outright.

Re:Chrome stands tall (1)

commodore64_love (1445365) | more than 3 years ago | (#35095580)

>>>Chrome has never been hacked

Impressive. Are there any other browsers that can claim that distinction? SeaMonkey? Opera? Amiga Origyn? Mozilla TimberWolf?

Re:Chrome stands tall (1)

icebraining (1313345) | more than 3 years ago | (#35097410)

Not Opera, apparently: https://www.alternativ-testing.fr/blog/index.php?post%2F2011%2F%5BCVE-XXXX-XXXX%5D-Opera-11-Integer-Truncation-Vulnerability [alternativ-testing.fr]

But in general, plenty, but none with that user base.

Re:Chrome stands tall (0)

Anonymous Coward | more than 3 years ago | (#35097624)

Chrome had a 140 vulnerabilities reported just last year, so by that metric, you are a troll.

Re:Chrome stands tall (0)

Anonymous Coward | more than 3 years ago | (#35098942)

Opera is probably the most secure browser around, but I don't know that it hasn't ever been hacked. Still, every past vulnerability for Opera has required a user to do such significant work that there may as well not even be an issue. Opera is also fast to release patches.

Re:Chrome stands tall (0)

Anonymous Coward | more than 3 years ago | (#35095608)

It's do-able. I had my version of chrome hacked and loaded with malware before. It was a credential scanner that ran in the cache (I only ever saw it when running chrome), so it didn't escape the sandbox, but it was still a nasty little piece of software.

Re:Chrome stands tall (2, Informative)

Anonymous Coward | more than 3 years ago | (#35096158)

Yeah, people sometimes forget about this when talking about sandboxes. The sandbox might prevent malware from escaping to the OS or to another tab process, but it WON'T prevent it from masquerading as the tab session, and snooping on whatever you're doing in that tab. Even if things like form input/submission were moved to the broker, the malware could just rewrite the DOM, since parsing is typically done with least permissions. It's just a short-lived malware infection, existing only in memory.

Re:Chrome stands tall (0)

Anonymous Coward | more than 3 years ago | (#35111404)

Please stop the trolling, because that's not even remotely how the Chrome sandbox works. The Chrome renderer process can't even read or write to the filesystem directly. So, what you describe is impossible by design. That's not to say damage can't be done from inside the sandbox; it certainly can, but nothing like the story you concocted.

Re:Chrome stands tall (0)

lennier (44736) | more than 3 years ago | (#35096786)

Chrome has never been hacked

Except for the one time when Bobby Quine and Automatic Jack picked up that Russian icebreaker from the Finn, but the whole Sprawl thinks that's just a legend now.

Re:Chrome stands tall (0)

Anonymous Coward | more than 3 years ago | (#35099598)

Chrome has never been hacked

interesting theory... maybe you're confusing chrome for a mac. (snicker)

Unhackable eh? (1)

JustAnotherIdiot (1980292) | more than 3 years ago | (#35095536)

Whenever I see "un" attached to an adjective, I'm inclined to believe it to be false. Unsinkable ship my foot.

Re:Unhackable eh? (1)

Sigma 7 (266129) | more than 3 years ago | (#35095708)

Whenever I see "un" attached to an adjective, I'm inclined to believe it to be false.

Even unstable [wikipedia.org] ?

(Affected players did have a workaround, but it wasn't on the official support pages.)

Good to hear (1, Interesting)

amn108 (1231606) | more than 3 years ago | (#35095626)

It's good to hear that we finally can link the pwnage and the ownage together. It's only fair, after all (ref. owning the machine you just pwned)

Nice prizes, wrong ideas (0)

Anonymous Coward | more than 3 years ago | (#35095730)

Writing browser specific attacks is going about it the wrong way. Sure, you might come up with a vector that works for N% of the current browsing population, but you will score a higher percentage of that population if you target a plugin they are all likely going to have installed without knowing, such as PDF, Flash, or Java. Once you hit those plugins, it is very likely you've already escaped the sandbox and can now perform a more traditional attack on the machine itself.

Re:Nice prizes, wrong ideas (0)

Anonymous Coward | more than 3 years ago | (#35097098)

Unfortunately for Flash, you now have (I think) two variants: IE/Mozilla and Chrome's. Chrome's Flash build uses its own native sandboxing architecture. IE's should have been the same. Microsoft probably fucked that one up by not working with Adobe (not that anyone should need to babysit Adobe...).

Same story for PDF, almost. Chrome has a Google-built, proprietary, sandboxed PDF plugin. And anyway, the first thing I do on any machine when deciding to install Acrobat, is to disable Adobe's crappy PDF plugin: that shit doesn't ever need to run inside the browser.

Re:Nice prizes, wrong ideas (0)

Anonymous Coward | more than 3 years ago | (#35097208)

And I forgot one more thing. In Chrome:

about:flags > Click to play: enable
Options -> Under the Hood -> Content settings... -> Plug-ins: Click to play

Learn to love it.

Not to imply exploit authors should be concerned about this. They shouldn't. The average user will never do the above. But IMO it's inevitable that browsers will make this the default choice for plugins someday.

Microsoft Copied... HA! (2)

kellyb9 (954229) | more than 3 years ago | (#35095812)

I hacked it to make Bing come up with the same results as Google... Please send me a check or a money order.

Or.... (0)

Anonymous Coward | more than 3 years ago | (#35096518)

Hack Chrome. Keep quiet about it. Sell it to criminals for a lot more.

Why go to a contest? (0)

Anonymous Coward | more than 3 years ago | (#35096538)

If I'm good enough to exploit a browser, then I can surely find more profitable ways than a mere 20,000 dollars.

Especially when you consider the taxes. Sure, I might have to do ILLEGAL things to make money, but for some people the reward would trump the risk of being caught.

Re:Why go to a contest? (1)

perryizgr8 (1370173) | more than 3 years ago | (#35102394)

for me, risk-reward logic gets skewed if i have to do something that i consider wrong( whatever that means). even if presented with great rewards and low risk i might choose not to do something if i find it immoral.
i expect the majority of people to think likewise.

So how does this all work? (1)

origin2k (302035) | more than 3 years ago | (#35096606)

I'm curious, how does this contest work? You sign up for a 30 minute spot. Do they allow the security researcher to sit at the system to compromise and operate it or does the security researcher direct a user to visit some url with a potential exploit? Part of the contest is to exploit the browser so I am guessing that the browser needs someone operating it and fetching well crafted html etc. from some where.

The phone stuff looks interesting as they are looking for drive by exploits as well as browser exploits.

Re:So how does this all work? (0)

Anonymous Coward | more than 3 years ago | (#35097378)

http://tinyurl.com/6h8qmk5

Re:So how does this all work? (1)

kent_eh (543303) | more than 3 years ago | (#35100190)

No, the attacks come over the network (in the case of the wireless devices, over the air).

There's pretty much no challenge attacking a system you have physical access to.

sure win? (1)

Have Brain Will Rent (1031664) | more than 3 years ago | (#35096640)

The rules aren't clear... can I use a gun?

Re:sure win? (1)

thehodapp (1931332) | more than 3 years ago | (#35100268)

No, but knives less than 5 inches and certain hatchets are allowed for the hacking part.

Don't trust Chrome with more than $20k (2)

fizzup (788545) | more than 3 years ago | (#35098470)

What I get from this is that Google is so certain of Chrome's security, they're willing to trust $20k on that security. The lesson you can take from this is not to do anything with the Chrome browser that would put you at risk of losing more than $20k. After all, the authors won't risk more than that. Of course, other authors are even less certain of their browser's security...

Re:Don't trust Chrome with more than $20k (0)

Anonymous Coward | more than 3 years ago | (#35098676)

Actually, I think Google is perhaps most convinced of its insecurity. This isn't for bragging rights; if (when) some serious flaw is found in Chromium, no one will be saying to Google, "aren't you embarrassed now?" Incentives like this simply encourages relatively unknown hackers who before had scant motivation to temporarily work for Google (most of it for free... although I doubt that was an inspiration).

Re:Don't trust Chrome with more than $20k (0)

Anonymous Coward | more than 3 years ago | (#35099116)

I believe you're using the term risk in the wrong context here. Google isn't risking anything. The browser is in the wild already, the code is as free as it could ever potentially be. What they are doing is challenging anyone and everyone to hack it. As incentive for someone to complete that challenge, they're willing to give someone free money. From the perspective of and end user, they're willing to give away $20,000 to improve their my security and experience while I use their browser. Take off your tin-foil hat and exit in an orderly fashion.

Re:Don't trust Chrome with more than $20k (0)

Anonymous Coward | more than 3 years ago | (#35103164)

I highly doubt that the coders are the ones deciding how much money is involved.

but no Linux? (1)

thehodapp (1931332) | more than 3 years ago | (#35100218)

Why no love for Linux? I personally think it would be much more interesting to see if they could hack Chrome (or Firefox) on a Linux based OS (like Ubuntu). Although I suspect it would actually be easier because less testing is done on those platforms (or at least less development).

Re:but no Linux? (0)

Anonymous Coward | more than 3 years ago | (#35102358)

The reason Linux is absent is that its hard to hack. Hacking Linux through Chromes sandbox is even harder.

Waste of time and money (1)

cheros (223479) | more than 3 years ago | (#35101508)

This is pure marketing. If they want to prove to me it's secure, ask for a public code review and reward those who find clear problems, and compile from that reworked code.

A "pass" from a hacking contest only shows that at a specific point in time, a specific set of people with specific skills were either unable to break a specific version of the software or unwilling to tell the organisers what they found so they could exploit that later for much more profit.

Any occurrence of the word "specific" indicates a variable that will invalidate the result of that contest - pass or fail.

But hey, it looks good in the press, I guess..

Re:Waste of time and money (1)

n0-0p (325773) | more than 3 years ago | (#35111926)

This is pure marketing. If they want to prove to me it's secure, ask for a public code review and reward those who find clear problems, and compile from that reworked code.

The codebase (minus PDF, Flash, and branding) is open source. Google pays out anywhere from $500 to $3113.70 to anyone who reports Chrome/Chromium security vulnerabilities to them. And if you look at the release notes on Chrome and Safari it's obvious that Google has a full-time team searching for and fixing security issues in both Chrome and WebKit. I'm not sure what else you want them to do, because they're already going well beyond anything you suggested.

Re:Waste of time and money (1)

cheros (223479) | more than 3 years ago | (#35123910)

Maybe stop marketing gimmicks? There are two direct problems with what they do here:

1 - it gives others the impression that hack contests are the way to assure security. This is the same as corporate execs relying on audit to assure the security of an IT platform instead of making sure they have solid fundamentals in place so that no retro-fitting is required.

2 - it takes away the focus from the fact that they do indeed do the preparing work as well. They could make more work of the whole process instead of just focusing on the result with this stunt. It propagates an approach that is, frankly, not the best thing to promote if you want people to think about security.

Not enough cash (1)

dugeen (1224138) | more than 3 years ago | (#35101878)

They'd have to pay me USD 20,000 just to get me to *use* Chrome again, never mind hack it. Software that secretly creates 3 separate scheduled tasks to reinstall its update program if it's deleted is indistinguishable from malware.
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>