All Chrome OS hack attempts fail at Pwnium 3

http://www.geek.com/articles/geek-pick/all-chrome-os-hack-attempts-fail-at-pwnium-3-2013038/

by memoryfailure • 13 years ago

85 28 13 years ago

geek.com

drivebyacct22• 13 years ago

Plain Chrome in Linux faired similarly didn't it?

mtgx• 13 years ago

So the other Chrome hacks were managed through Windows/Mac OS exploits?

drivebyacct22• 13 years ago

Maybe it was just attacked on Windows, the only reference I can find is not super technical and references "zero-days" in the browser itself.

ukdm2• 13 years ago

"Chrome was compromised using similar methods to the IE10 and Firefox attacks. MWR Labs bypassed Chrome’s sandbox and used a Windows kernel vulnerability in Windows 7 to elevate privileges as well as execute commands outside of the sandbox. In addition to executing code, MWR researchers were able to read memory and find the base addresses of certain .DLL files."

http://www.geek.com/articles/geek-pick/internet-explorer-10-...

hollerith• 13 years ago

Since that page does not mention Linux, I cannot imagine what relevance it has to grandparent.

justinschuh2• 13 years ago

As one of the owners of the Chrome Windows sandbox, that level of inaccuracy hurts to read. The correct statement is that Nils and Jon's pwn2own exploit bypassed the sandbox by using a Windows kernel vulnerability that's exposed in every process on the system. You can argue about the extent to which you should be able to rely on the kernel to enforce its guarantees, but the component that failed isn't a point of debate.

zobzu• 13 years ago

also, minix didnt get pwned.

fabriceleal• 13 years ago

... but nobody talks about this! Shamefull.

zellyn• 13 years ago

This comment made me unreasonably happy.

qwertzlcoatl• 13 years ago

The fact that the total prize money is Pi million dollars is adorable.

pardner• 13 years ago

That's irrational, sorry.

10dpd• 13 years ago

At least its not imaginary...

dakimov2• 13 years ago

Money is always rational.

youngerdryas• 13 years ago

But for a 100m radius it is accurate to 36 microns.

codex• 13 years ago

I'm not sure hackers brought their "A" game to this event. In contrast to earlier events, winners must disclose their methods to participate in return for only $150,000 per exploit. A black hat hacker could make much more from their methods, and a white hat hacker could as well--in consulting fees.

magicalist• 13 years ago

You're thinking of Pwn2Own. Pwnium has always required disclosure, while Pwn2Own only required full disclosure for the first time this year.

And $150,000 is actually getting quite close to what you could make for an exploit of a browser on the black market, especially with all those Java and Flash plugins still running all over the world, depressing exploit prices as long as they're available.

dakimov2• 13 years ago

Are their rates that high? How much do those hackers earn then?

naner• 13 years ago

It seems like there would not be a huge payday for Chrome OS exploits since hardly anyone uses the OS.

benologist2• 13 years ago

Submitter is a spam account by Ziff Davis (geek.com / extremetech.com / pcmag.com / etc), one of a few they use to spam HN.

OGinparadise• 13 years ago

You may be unto something http://news.ycombinator.com/submitted?id=memoryfailure

natrius• 13 years ago

I've never understood why people care about this. Lots of people submit their own stuff. All I care about is the quality of the articles and discussion, which is orthogonal to the identity of the submitter.

benologist2• 13 years ago

Why would you not care if people are here to exploit you and the rest of this community?

Almost nobody unaffiliated submits their crap in spite of a year+ of spamming with about 8 different accounts so obviously their work is not even very relevant.

Systematic spam by these guys and a handful of other sites drowns out content real users find legitimately interesting.

gtr32x• 13 years ago

This website is horrendous. While opening the page, a overlay banner flashes across the content area at snail speed but high enough that I cannot accurately click the close button while it's moving (well i can try but I'm risking clicking on the actual ad itself). It took a total of 10 seconds for it to completely cross the page before I was able to start reading the content.

I think this kind of ad serves absolutely no purpose. Even if I wanted to read it before I wouldn't now, and it totally killed the website's credibility for me.

All Chrome OS hack attempts fail at Pwnium 3

Related Stories