Google loves to brag about how secure its Chrome browser is, and the results of last year's Pwn2Own hacking competition only gave the company more ammo. Well, at this year's event, some hackers wanted to feed Google humble pie—and they did.
As ZDNet reports, security researcher Chaouki Bekrar and his team managed to take "complete control of a fully patched 64-bit Windows 7 (SP1) machine" using two zero-day vulnerabilities in Google's browser. Chaouki said the feat took six weeks of preparatory work that involved locating the vulnerabilities and writing code to exploit them.
Chrome ended up being the first browser to fall at the competition yesterday. "We wanted to show that Chrome was not unbreakable. Last year, we saw a lot of headlines that no one could hack Chrome. We wanted to make sure it was the first to fall this year," said Bekrar. The hacking competition was part of this year's CanSecWest conference, which is still going on today and tomorrow in Vancouver, Canada.
There was more on the line than hacker cred and some free PR for Bekrar, of course. Google is actively encouraging hackers to find holes in Chrome. Last month, the company said it would be offering $1 million in prizes for hackers who find holes in the browser. Finding a "full Chrome exploit" entails a $60,000 prize, and Google throws in a free Chromebook. Cash prizes are also awarded for the discovery of security holes involving other software but liable to affect Chrome users. (Thanks to TR reader SH SOTN for the link.)
|1. Ryszard - $603||2. Hdfisise - $600||3. Andrew Lauritzen - $502|
|4. the - $306||5. SomeOtherGeek - $300||6. Ryu Connor - $250|
|7. Anonymous Gerbil - $150||8. dashbarron - $150||9. webkido13 - $135|
|10. cygnus1 - $126|
|Run with PowerColor's Devil 13 Dual Core R9 390 graphics card||53|
|We are live on Twitch talking Skylake with David Kanter||0|
|The gaping maw of Lian Li's PC-V33 is ready to swallow ATX mobos||8|
|Huawei leapfrogs Apple with pressure-sensitive Mate S phone||25|
|Tune in for our Skylake live stream tonight with David Kanter||21|
|Get the speed you need with Toshiba Q300 SSDs||9|
|ZenWatch 2 runs Android Wear Asus-style||15|
|Asus previews ROG Swift PG348Q and PG279Q G-Sync monitors||28|
|Wanted for review: AMD's Radeon R9 Nano||171|