Chrome cracked at Pwn2Own and Pwnium contests

Google's Chrome browser was the primary to fall on the annual Pwn2Own exploit contest on the CanSecWest conference.

According to media reports, Chrome was compromised by a bunch of researchers from French security firm Vupen, after it was earlier compromised as part of Google's own Pwnium contest, earning a $60,000 reward from the corporate. In accordance with Threatpost, Sergey Glazunov was awarded by Google for the primary exploit.

As reported by SC Magazine, Google is offering cash prizes totalling $1m and a Chromebook to those that successfully exploit its browser after it split off from Pwn2Own and arrange its own, Chrome-specific hacking contest this year.

A change inside the rules at Pwn2Own "to make it less like a lottery" and provides all competitors a chance to prove their skills on-site (or remotely) has proved to be controversial.

Google's security team said that it withdrew its sponsorship when it discovered that contestants were permitted to go into Pwn2Own while not having to disclose full exploits (or perhaps all the bugs used) to vendors.

Threatpost claimed that during previous years, contestants had to pre-register and the organisers from TippingPoint's Zero Day Initiative knew what number participants there will be. Vupen was the sole team to start the contest this year.

According to The Verge, Vupen's method took good thing about two zero-day exploits and a baited website arrange through the hack. Once the pc visited the location, the exploit ran and spread out the Chrome calculator extension outside of the browser's sandbox, demonstrating complete control of the up-to-date 64-bit Windows 7 box. Vupen's team was led by co-founder and head of study Chaouki Bekrar.

Talking to ZDNet, Bekrar said his team worked for roughly six weeks find and write both vulnerabilities, one that bypassed DEP and ASLR on Windows and the opposite to wreck out of the Chrome sandbox.

He declined to claim if any of the exploits targeted third-party code within the browser, saying that it was "a use-after-free vulnerability in the default installation of Chrome".

Bekrar also said that his team came equipped for zero-day flaws for the entire four major browsers â€" Google Chrome, Microsoft Internet Explorer, Apple Safari and Mozilla Firefox â€" however decided to head after Chrome first after it was left uncracked last year.

“We desired to show that Chrome was not unbreakable. Last year, we saw lots of headlines that no person could hack Chrome. We needed to ensure it was the primary to fall this year,” he said. He also said that it'll sell the rights to the DEP and ASLR Windows bypass, nevertheless it won't surrender the sandbox escape.

He said: “We are keeping that non-public, keeping it for our customers.”

The conference is going down in Vancouver, Canada.