Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Pwn2Own organizer predicts Chrome will survive first day

Gregg Keizer | Feb. 4, 2011
But sandboxed browser may fall second or third day when hacking rules change

The rest of the cash -- $15,000 for the first exploit of each browser, and another $60,000 for Pwn2Own's mobile hacking track -- came from TippingPoint.

Because Google put up its money for the Chrome part of the browser challenge, Portnoy modified the rules after getting feedback from former contest winners and other security researchers, then came up with the first day-second/third days split.

Portnoy and Vreugdenhil maintained that Chrome is hackable.

"Chrome uses WebKit, that's its major weakness," said Portnoy. "And the sandbox has to rely on the underlying OS to provide security that [Google] doesn't have a way to mitigate. That increases the attack surface considerably. We know [Chrome vulnerabilities] are out there."

And sandbox escape techniques, whether in general or for Chrome specifically, are "fairly well known," Portnoy said.

"But it's not trivial to find an underlying vulnerability [to escape the sandbox]," said Vreugdenhil, who is qualified to talk about exploit difficulties.

Last year, Vreugdenhil used two different Windows vulnerabilities at Pwn2Own to bypass Windows 7's ASLR and DEP defensive technologies so he could hack IE for a $10,000 prize. At the time Portnoy called Vreugdenhil's work "technically impressive."

While TippingPoint hopes that the bigger prize for Chrome will convince researchers to take on Google's browser, Portnoy is expecting that anyone armed with a WebKit vulnerability will aim at Safari first.

"If you're coming to Pwn2Own [with a WebKit vulnerability], your first target is Safari because it's running on a weaker OS and you're not dealing with a sandbox," said Portnoy.

At last year's Pwn2Own, Firefox, IE and Safari were compromised on the first day of the contest, but Chrome was untouched throughout. Three-time winner Charlie Miller grabbed $10,000 for hacking Safari on Mac OS X, while a German computer science student, who goes only by his first name of Nils, compromised Firefox on Windows 7. Like Vreugdenhil, Nils had to evade Windows' ASLR and DEP protections.

TippingPoint's expecting more hacking fireworks this year.

"Perhaps this year, attackers will decide to capitalize on their Chrome vulnerabilities," said Portnoy.

 

Previous Page  1  2 

Sign up for Computerworld eNewsletters.