Only a week after Google began offering cash for exploits in its Chrome browser, French security group VUPEN was able to take down the browser within the first five minutes of this year’s Pwn2Own hacker competition. The competition takes place within CanSecWest, a security conference held annually in Vancouver. Google decided to hold its hacker contest, Pwnium, separately from CanSecWest this year over concerns that hackers wouldn’t have to divulge their exploits to vendors prior to the start of the convention.
Image credit: ZD Net
The French security company was able to work around Chrome’s most touted security feature, the sandbox, which allows the browser to effectively compartmentalize itself away from critical files on a user’s computer. VUPEN wrote at tweet shedding some light on the methods used in hacking the browser with Windows 7: “Code execution and sandbox escape (medium integrity process resulted).” As the Chrome team works furiously to patch its currently-cracked browser, it seems unlikely to be enough detail for anyone looking to cause web browsing menace.
The browser had remained untouched at the competition for the past three years. In an interview with ZD Net, VUPEN’s cofounder, Chaouki Bekrar, said that it was the browser’s prestige that made them want to show the Chrome exploit first. “We wanted to show that Chrome was not unbreakable. Last year, we saw a lot of headlines that no one could hack Chrome. We wanted to make sure it was the first to fall this year.”
According to Google’s competition, VUPEN will receive $20,000, a “consolation reward” for breaking the browser with outside exploits. Later the same day, Google Chrome researcher Sergey Glazunov earned the coveted $60,000 prize for his exploit that worked directly within Chrome’s own code to work around the sandbox. According to Google’s Pwnium live app, the patch for Glazunov’s exploit has already been released.
With these two quick hits in a row, it looks like Germany might have to find another web browser upon which to bestow its government’s Most Secure title.
