Vupen Security Pawns Google Chrome
Article by George Norman
On 12 May 2011
Google Chrome web browser has made a name for itself by being one of, if not the fastest browser on the market today. The browser also made a name for itself by offering a properly good level of security; what I mean by that is that for the past three years it survived the Pwn2Own contest, computer hacking contest held at the annual CanSecWest security conference, beginning in 2007 and sponsored by TippingPoint.

Chrome’s restrictive sandbox and other security measures meant that Pwn2own contestants could not pwn the browser. They could pwn other browsers, like Microsoft’s Internet Explorer, Apple’s Safari or Mozilla’s Firefox, but not Google’s Chrome.

Advertising

The news is that Chrome’s reputation of being unpwnable has been broken by Vupen Security, world leader in vulnerability research for defensive and offensive security. Vupen announced that it pwned Chrome, that it came up with a sophisticated exploit, the most sophisticated one Vupen has ever come up with, exploit that bypasses Chrome’s sandbox and other security features, including DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization).

Vupen explained that the exploit it came up with does not exploit a Windows kernel vulnerability; it exploits an undisclosed 0-day vulnerability discovered by Vupen, vulnerability that works on all 32-bit and 64-bit Windows systems. The exploit is silent, there’s no crash after executing the payload; it works on Chrome 11.X and 12.X.

“We are (un)happy to announce that we have officially Pwned Google Chrome and its sandbox,” said Vupen. “While Chrome has one of the most secure sandboxes and has always survived the Pwn2Own contest during the last three years, we have now uncovered a reliable way to execute arbitrary code on any default installation of Chrome despite its sandbox, ASLR and DEP.”

A video that presents the Vupen-uncovered exploit in action is available on YouTube here.
In the video a user of Chrome 11.0.696.65 on Windows 7 SP1 is tricked into visiting a malicious website that hosts Vupen’s exploit. The exploit code downloads a Calculator program from a remote location and launches it outside Chrome’s sandbox.



Tags: Google, Chrome, Security
About the author: George Norman
George is a news editor.
You can follow him on Google+, Facebook or Twitter

I Hope you LIKE this blog post! Thank you!
What do YOU have to say about this
blog comments powered by Disqus
Popular News
By George Norman on 17 Aug 2017
With the blockbuster movie season upon us, Sony decided to celebrate the occasion with a sale: the Attack of the Blockbusters Sale that offers discounts of up to 50% (60% if you’re a PlayStation Plus member) on a ton of PS4 video games.
By George Norman on 17 Aug 2017
Samsung’s new T5 portable solid-state drive (PSSD) uses the latest 64-layer V-NAND technology, offers between 250GB and 2TB of storage capacity, has a lightweight and shock-resistant design that’s smaller than the average business card, and delivers industry-leading transfer speeds of up to 540 MB/s.
Related News
By George Norman on 21 Jun 2017
Fidget spinners, the toys that the internet loves to hate, have managed to grab Google’s attention. The search engine is offering a virtual fidget on desktop as well as mobile. Simply search for "spinner" and Google Search will bring up a fidget spinner quick answer card.
By George Norman on 09 Aug 2017
Android started out as an underdog, as the mobile operating system that nobody took seriously. Big-name tech companies laughed it off and critics said it would fail miserably, but Android proved them all wrong and become the powerhouse that it is today.
By George Norman on 14 Aug 2017
Opera Max, the Android app that uses compression technology to help you save data and get up to 50% more from your data plan, has been discontinued. The app is no longer featured on Opera.com and it’s no longer listed on Google Play.
By George Norman on 10 Jul 2017
With technology constantly evolving, many devices become obsolete and get replaced with something that's better, smaller, and probably a lot shinier.
Sponsored Links
Hot Software Updates
Top Downloads
Become A Fan!
Link To Us!
Vupen Security Pawns Google Chrome
HTML Linking Code