… to learn how to better "fortify" Chrome against attacks and to understand how an exploit is crafted. Brilliant idea – every browser should be doing this.
At hacking contest, Google Chrome falls to third zero-day attack (Updated):
Google's Chrome browser on Friday fell to a zero-day attack that pierced its vaunted security sandbox, the third such attack in as many days at a contest designed to test its resistance to real-world threats.
A teenage hacker who identified himself only as PinkiePie said he spent the past week and half working on the attack. It combined three previously unknown vulnerabilities to gain full system access to a Dell Inspiron laptop that ran a fully patched version of Chrome on top of the most up-to-date version of Windows 7. He spent the past three days holed up in hotel rooms and conference areas refining the attack so it would break out of the sandbox, which was designed to prevent code-execution attacks like his, even when security bugs are identified.
...
PinkiePie said all three of the vulnerabilities resided in code that's native to Chrome. That meant it qualified for a $60,000 prize, the top reward for the Pwnium contest Google sponsored at the CanSecWest conference in Vancouver. Members of the Chrome security team started analyzing the exploit and vulnerability details within minutes of the hack. Less than 24 hours later, Google put a fix into its distribution pipeline.
...
Google is offering prizes of $60,000, $40,000 and $20,000 under the competition in an attempt to learn new strategies for fortifying Chrome against attacks that expose sensitive user data or take control of user machines. PinkiePie is only the second contestant to enter the contest. Both have demonstrated attacks that allowed them to take control of Chrome users' machines when they do nothing more than browse to an attack site.
On Wednesday, a Russian researcher named Sergey Glaznov bundled two vulnerabilities into his own remote code-execution attack. Less than 24 hours later, Google shipped an update fixing the holes. At the separate Pwn2Own contest a few feet away, a team of researchers successfully exploited Chrome on Wednesday.It's now almost certain that attack relied on Adobe Flash to break out of the safety perimeter.
The five vulnerabilities exposed during the third and final day of the contest are miniscule compared to the overall number of bugs Chrome's security team fixes each year. A member of the team said the value of Pwnium isn't in the number of bugs that come to light, but rather in the insights that come from watching how a reliable exploit is able to slip through carefully crafted defenses.
No comments:
Post a Comment