Google Gambles $20K that Chrome Can't be Cracked

[Franzer]

http://www.pcworld.com/businesscente...e_cracked.html

Google is so confident that its Chrome Web browser can't be hacked that it is willing to put $20,000 cash and a Chrome CR-48 notebook on the line to prove it. At the 2011 Pwn2Own contest, held in conjunction with the CanSecWest security conference in Vancouver next month, Google will put its money where its proverbial mouth is.
Google's use of Chrome as the name of both its browser and its OS is creating some confusion. There are some false reports that Google is offering the bounty for successfully cracking its Chrome OS-based CR-48 notebook. The Google CR-48 notebook will be awarded along with the $20,000 for a successful attack against the Chrome Web browser, but the Pwn2Own info clearly states that the notebook is merely a prize. There will be no attacks mounted against the Chrome OS, and the target Chrome Web browser will actually be running on the latest 64-bit release of either Windows 7 or Mac OS X.

The Chrome Web browser is the only participating browser with built-in sandbox protection. The sandbox segregates untrusted or potentially malicious scripts so they are unable to impact the core browser, or the underlying PC. Because of the sandbox, it will take some extra effort for an attack against the Chrome Web browser to be considered a success.

According to posted details about the Pwn2Own contest, a successful attack against Chrome will be measured over a few days. "On day 1, Google will offer $20,000 USD and the CR-48 if a contestant can pop the browser and escape the sandbox using vulnerabilities purely present in Google-written code. If competitors are unsuccessful, on day 2 and 3 the ZDI will offer $10,000 USD for a sandbox escape in non-Google code and Google will offer $10,000 USD for the Chrome bug. Either way, plugins other than the built-in PDF support are out of scope."
Google's $20k award is the largest ever offered at the annual Pwn2Own contest, and also the first time that a Web browser vendor has stepped up to contribute to the Pwn2Own cash pool. Perhaps the bravado is inspired by the fact that this will be the third year that Chrome will be targeted, yet it has remained un-cracked in years past.

Compare that to Apple's Safari Web browser, which is perennially cracked in minutes--if not seconds. But, even Firefox and Internet Explorer have fallen prey to Pwn2Own attacks. Only Chrome remains unscathed...so far. We'll see if $20,000 is enough incentive for an enterprising hacker to find a crack in its armor.

Sounds pretty interesting, and pretty cool of google, i hope someone can do it.

[Jotaru]

They really should just offer a job to anyone able to do stuff like this

[Senji]

They really should just offer a job to anyone able to do stuff like this

This happens often.

[dejet]

yup, if you are good. They will pick you up and give you a job lol. that $20,000 comes with meeting important people if you happen to do it I bet.

A job would not be to far behind.

[rog]

They really should just offer a job to anyone able to do stuff like this

That is likely the main reason they are offering the money.

[Darus Grey]

They're probably not too interested in offering someone a job. The real incentive to these challenges is to get "black market" techniques. They know it'll be cracked, they know it IS cracked, they're not stupid.

A good browser exploit can go for $10,000-$50,000+ in blackhat circles amongst the people who actually run zombie networks, once their inhouse teams have stamped out as many exploits as they can discover in the open, they have to offer larger cash rewards to get some people to come forward with the secret ones, because otherwise they'll never come out; there's a large cash incentive to KEEP them secret.

[Ramor]

They're probably not too interested in offering someone a job. The real incentive to these challenges is to get "black market" techniques. They know it'll be cracked, they know it IS cracked, they're not stupid.

A good browser exploit can go for $10,000-$50,000+ in blackhat circles amongst the people who actually run zombie networks, once their inhouse teams have stamped out as many exploits as they can discover in the open, they have to offer larger cash rewards to get some people to come forward with the secret ones, because otherwise they'll never come out; there's a large cash incentive to KEEP them secret.

pretty interesting, especially considering that 20k to google is probably nothing more than a pissdrop in the bucket of their near infinite income, hopefully a few good people (or person) will pick up the cash while fucking over some of the assholes that would use the exploits for spam and whatnot.

but what exactly is the purpose of people cracking it and how does it relate to 'zombie' networks? wouldn't it almost be more convenient for people running zombie networks to create their own browser (not that that would be an easy task) to use the way they want?

[Darus Grey]

but what exactly is the purpose of people cracking it and how does it relate to 'zombie' networks? wouldn't it almost be more convenient for people running zombie networks to create their own browser (not that that would be an easy task) to use the way they want?

I don't understand what you're getting at, at all. The people who run zombie networks/botnets want YOU to be using an exploitable browser.

Who would anyone want to use a browser specifically developed by hackers to infiltrate your computer? (probably a lot of people...lol...but still).

[Ramor]

I don't understand what you're getting at, at all. The people who run zombie networks/botnets want YOU to be using an exploitable browser.

Who would anyone want to use a browser specifically developed by hackers to infiltrate your computer? (probably a lot of people...lol...but still).

oh alright I totally misunderstood why they would have wanted a hackable browser, I thought it was more beneficial from their side of things (as in if it was hackable then for them it was easier to run their zombie slaves)

edit: kind of a derp moment now that i look back on it, but what can i say i have them from time to time.

[Priran]

Google is so confident that its Chrome Web browser can't be hacked that it is willing to put $20,000 cash and a Chrome CR-48 notebook on the line to prove it.

http://img577.imageshack.us/img577/1319/79452636.jpg

How much is Google worth again? Like 50 billion or something? The company Superbowl party's wing budget is probably over $20k.