Google patches $310K worth of Chrome, Chrome OS bugs

Steve Dii · 2014-03-17T21:50:36+00:00

Ifuatayo ni moja ya mashindano duniani yanayo-u-shape ulimwengu wa teknolojia. Natamani sana siku moja nione Watanzania wengi wanashiriki kwenye mashindano kama haya, I hope siku moja itakuja kuwa... Google on Friday patched several vulnerabilities in Chrome and Chrome OS within 48 hours of their disclosures at last week's Pwn2Own and Pwnium hacking contests. While all four targeted browsers -- Chrome, Apple's Safari, Mozilla's Firefox and Microsoft's Internet Explorer -- fell to researchers at the cash prize contest, Google's was the only one to have fixed flaws as of Sunday. Four vulnerabilities were patched in Chrome to close the holes used by a team from Vupen -- the French vulnerability research firm and seller of zero-day bugs to government and law enforcement agencies -- and an anonymous researcher. Both had cracked Chrome on Thursday afternoon at Pwn2Own, the Zero Day Initiative (ZDI)-sponsored hacking contest. Google posted its usual terse descriptions of the four bugs exploited by Vupen and the unnamed researcher in a short note about an available update for Chrome 33. The Mountain View, Calif. search giant also promised to publish more about the two successful hacks of Chrome. "We anticipate landing additional changes and hardening measures for these vulnerabilities in the near future," wrote Anthony Laforge, technical program manager for Chrome, on the release note. "We also believe that both submissions are works of art and deserve wider sharing and recognition. We plan to do technical reports on both Pwn2Own submissions in the future." Google did the same last year in a write-up two months after others cracked Chrome at 2013's Pwn2Own. Vupen won $100,000 for its Chrome hack -- part of a record $400,000 awarded the team -- while the anonymous researcher walked away with $60,000. The latter's award had been reduced because his or her attack had relied in part on a vulnerability that had been revealed the day before at Pwnium, Google's own challenge. All told, ZDI -- the bug bounty program operated by HP TippingPoint -- and co-sponsor Google paid out $850,000 in prize money at last week's Pwn2Own, nearly twice the amount of the prior record from last year. Google also patched seven vulnerabilities, including a rare bug rated "critical," the company's highest threat ranking, in Chrome OS, the browser-based operating system that powers the inexpensive Chromebook laptops. Those vulnerabilities were disclosed Wednesday at Pwnium, the other hacking contest at CanSecWest, the security conference that took place in Vancouver, British Columbia last week. Unlike Pwn2Own, Pwnium was a Google-only contest. George Hotz, also known as "geohot," a noted iPhone and Sony PlayStation 3 hacker, was handed $150,000 by Google for a four-vulnerability chain that Google called "an epic Pwnium competition win." Hotz also participated in Pwn2Own, where he was one of four teams or individuals to bring down Firefox for a $50,000 cash prize. The other Pwnium contestant, "Pinkie Pie," a researcher who has won several prizes, used two vulnerabilities to partially hack Chrome within Chrome OS, but Google has not yet set an award. As with the Chrome exploits applied in Pwn2Own, those aimed at Chrome OS will be revealed in greater detail at a later date, Google said. Source: Google patches $310K worth of Chrome, Chrome OS bugs - Computerworld Extras: Chrome Releases: Stable Channel Update Steve Dii

Thread starter Steve Dii
Start date Mar 18, 2014

Steve Dii

JamiiForums uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.

Accept Learn more…

Back

Top Bottom

Forums

New posts

Google patches $310K worth of Chrome, Chrome OS bugs

Steve Dii

JF-Expert Member

Our Community

Regional Communities