Well, that's a turnup for the books: Google's Chrome browser has been the first to be hacked at the annual Pwn2own competition. Having seen its product being untouchable for the past two years, the company may have become a little overconfident - and offered up to $60,000 to anyone who could hack it at all, up to a limit of $1m.
It was a challenge which a French team, Vupen, was very happy to take - and break. In fact, they hacked Chrome during the first five minutes of the competition, and (under the new rules) took 32 points. It also earns them $20,000 from Chrome for using bugs in Chrome itself to gain "full unsandboxed code execution". Note: A representative for Pwn2own tells us that "Vupen did not compete in the Pwnium competition and therefore will not receive any money from Google.
Also: Google has updated Chrome to fix the hole exploited by the hack. (Thanks @rquick for the link.)
The hack was carried out on the Windows version: according to Justin Schuh, of Google's Chrome team, the exploit "didn't break out of the sandbox… it avoided the sandbox". Update: Pwn2own says that the sandbox-avoiding exploit "is true for the competitor in Pwnium. Vupen's was a full sandbox escape for Pwn2own."
The Twitter feed for the contest (which began at 12 noon Pacific time on Wednesday) indicates that Safari was the next to fall - again by Vupen.
Vupen has attracted some controversy by discovering and then selling vulnerabilities and exploits to government customers - a business that one might think is both lucrative and risky. Chaouki Bekrar, the co-founder and head of research, told ZDNet that "We had to use two vulnerabilities. The first one was to bypass DEP and ASLR on Windows and a second one to break out of the Chrome sandbox."
In fact the Vupen team had achieved this last May, though too late of course for the March-timed Pwn2own. At the time they said that
The user is tricked into visiting a specially crafted web page hosting the exploit which will execute various payloads to ultimately download the Calculator from a remote location and launch it outside the sandbox (at Medium integrity level).
No trickery is needed at the contest, of course, because the teams can direct the browsers to whatever pages they've set up to exploit vulnerabilities. Vupen said that they have come armed with vulnerabilities which will exploit each of the browsers on show - Internet Explorer, Firefox, Chrome and Safari. But they decided to go after Chrome first, Bekrar told ZDNet: "We wanted to show that Chrome was not unbreakable. Last year, we saw a lot of headlines that no one could hack Chrome. We wanted to make sure it was the first to fall this year."
Equally he was complimentary about Chrome, generally seen as possibly the most secure browser because of its hefty sandboxing. "The Chrome sandbox is the most secure sandbox out there," Bekrar told ZDNet. "It's not an easy task to create a full exploit to bypass all the protections in the sandbox. I can say that Chrome is one of the most secure browsers available."
An interesting point for Vupen is that all of the hacks used at Pwn2own are meant then to be disclosed publicly - which implies that they have either sold them already to customers (who will have been told to make use of them by this date, or may be feeling a little narked), or that they're just polishing their reputation by hacking everything in sight. With day one over, Vupen looks to be far ahead of the rest. Update: Pwn2own tells us that "Everything Vupen displays at Pwn2own was created especially for this competition. The exploits were not previously sold to customers."
There's a page with the progress of the Pwn2own competition. Vupen is miles ahead of everyone at present with 124 points. The competition ends on Friday 9 March.
The competition, which has been running for a number of years, has usually seen Apple's Safari being the first to fall (usually at the hands of fabled ex-NSA hacker Charlie Miller), with Firefox and Internet Explorer surviving longer. The advent of Chrome in the past few years has changed the landscape: its sandboxing and general security model has made it proof against repeated attacks. (The browsers run on the latest, fully-patched versions of Windows or Mac OSX; this year, it's Windows 7 and Lion.)
