{"id":700613,"date":"2012-03-07T13:28:34","date_gmt":"2012-03-07T13:28:34","guid":{"rendered":"https:\/\/www.zdnet.com\/article\/cansecwest-pwnium-google-chrome-hacked-with-sandbox-bypass\/"},"modified":"2012-03-07T13:28:34","modified_gmt":"2012-03-07T13:28:34","slug":"cansecwest-pwnium-google-chrome-hacked-with-sandbox-bypass","status":"publish","type":"post","link":"https:\/\/www.zdnet.com\/article\/cansecwest-pwnium-google-chrome-hacked-with-sandbox-bypass\/","title":{"rendered":"CanSecWest Pwnium: Google Chrome hacked with sandbox bypass"},"content":{"rendered":"\n

<\/span><\/a><\/p>\n\n\n\n

VANCOUVER — A Russian university student hacked into a fully patched Windows 7 machine (64-bit) using a remote code execution vulnerability\/exploit in Google’s Chrome web browser.<\/p>\n\n\n\n

The attack, which included a Chrome sandbox bypass, was the handiwork of Sergey Glazunov, a security researcher who regularly finds and reports Chrome security holes.<\/p>\n\n\n\n

<\/span><\/a><\/p>\n\n\n\n

Glazunov scored a $60,000 payday for the exploit, which targeted two distinct zero-day vulnerabilities<\/a> in the Chrome extension sub-system. \u00a0The cash prize was part of Google’s new Pwnium hacker contest which is being run this year as an alternative to the more well-known Pwn2Own challenge.<\/p>\n\n\n\n

According to Justin Schuh, a member of the Chrome security team, Glazunov’s exploit was specific to Chrome and bypassed the browser sandbox entirely. \u00a0“It didn’t break out of the sandbox [but] it avoided the sandbox,” Schuh said in an interview.<\/p>\n\n\n\n

[ SEE:\u00a0Charlie Miller skipping Pwn2Own as new rules change hacking game ]<\/h3>\n\n\n\n

“It was an impressive exploit. \u00a0It required a deep understanding of how Chrome works,” Schuh added.\u00a0“This is not a trivial thing to do. \u00a0It’s a very difficult and that’s why we’re paying $60,000.<\/p>\n\n\n\n

Glazunov is a regular contributor to Google’s bug bounty program and Schuh raved about the quality of his research work.<\/p>\n\n\n\n

Schuh said Glazunov once submitted a similar sandbox bypass bug but stressed that these kinds of full code execution that executes code outside the browser sandbox form a very small percentage of bug submissions.<\/p>\n\n\n\n

Google’s Sundar Pichai says the company is “working fast on a fix”<\/a> that will \u00a0be pushed out via the browser’s automatic update utility.<\/p>\n","protected":false},"excerpt":{"rendered":"

VANCOUVER — A Russian university student hacked into a fully patched Windows 7 machine (64-bit) using a remote code execution vulnerability\/exploit in Google’s Chrome web browser. The attack, which included a Chrome sandbox bypass, was the handiwork of Sergey Glazunov, a security researcher who regularly finds and reports Chrome security holes. Glazunov scored a $60,000…<\/p>\n","protected":false},"author":3682,"featured_media":629472,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","zd_disclosure__hide":false,"zd_disclosure__custom_text":"","zd_display_date":"2012-03-07 13:28:34","zd_display_date_auto_update":false,"_zd_suppress_exco_video":false,"zd_dek":"The attack, which included a Chrome sandbox bypass, was the handiwork of Sergey Glazunov, a security researcher who regularly finds and reports Chrome security holes.","zd_promo_hed":"","zd_promo_dek":"The attack, which included a Chrome sandbox bypass, was the handiwork of Sergey Glazunov, a security researcher who regularly finds and reports Chrome security holes.","zd_liveblog__start_date":"","zd_liveblog__end_date":"","zd_post_footer_pattern":0,"zd_post_redirect_id":0,"zd_post_redirect_status":410,"zd_post_redirect_enabled":false,"_offer_group_id":0,"zd_update_timeline":[],"zd_revision_type":"","_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","zd_hero__type":"","zd_hero__image_id":0,"zd_hero__image_caption":"","zd_hero__image_credit":"","zd_hero__image_alt":"","zd_hero__video_data":[],"zd_toc__enabled":false,"zd_toc__override":false,"zd_toc__title":"Table of Contents","zd_toc__list":"[]","zd_post_flag__disable_featured_image":true,"zd_post_flag__hide_from_discovery":false,"zd_post_flag__disable_image_zoom":false},"categories":[8697,8851,8819,8652,8675],"tags":[],"zd_collection":[],"zd_type":[436],"zd_post_attributes":[],"zd_product":[],"zd_internal":[],"class_list":["post-700613","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-developer","category-enterprise-software","category-executive","category-google","category-tech-and-work","zd_type-custom"],"acf":[],"authorship":[3682],"parsely":{"version":"1.1.0","canonical_url":"https:\/\/zdnet.com\/article\/cansecwest-pwnium-google-chrome-hacked-with-sandbox-bypass\/","meta":{"@context":"https:\/\/schema.org","@type":"NewsArticle","headline":"CanSecWest Pwnium: Google Chrome hacked with sandbox bypass","url":"http:\/\/www.zdnet.com\/article\/cansecwest-pwnium-google-chrome-hacked-with-sandbox-bypass\/","mainEntityOfPage":{"@type":"WebPage","@id":"http:\/\/www.zdnet.com\/article\/cansecwest-pwnium-google-chrome-hacked-with-sandbox-bypass\/"},"thumbnailUrl":"https:\/\/www.zdnet.com\/wp-content\/uploads\/sites\/3\/zd-defaultimage-blog_8f53d9.jpg?w=150&h=150&crop=1","image":{"@type":"ImageObject","url":"https:\/\/www.zdnet.com\/wp-content\/uploads\/sites\/3\/zd-defaultimage-blog_8f53d9.jpg"},"articleSection":"Developer","author":[{"@type":"Person","name":"Ryan Naraine"}],"creator":["Ryan Naraine"],"publisher":{"@type":"Organization","name":"ZDNET","logo":"https:\/\/www.zdnet.com\/wp-content\/uploads\/sites\/3\/cropped-ZDNET-512Yellow.png"},"keywords":[],"dateCreated":"2012-03-07T13:28:34Z","datePublished":"2012-03-07T13:28:34Z","dateModified":"2012-03-07T13:28:34Z"},"rendered":"\n\n\n\n\n\n","tracker_url":"https:\/\/cdn.parsely.com\/keys\/zdnet.com\/p.js"},"authorship_editors":[],"authorship_reviewers":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/www.zdnet.com\/wp-content\/uploads\/sites\/3\/zd-defaultimage-blog_8f53d9.jpg","_links":{"self":[{"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/posts\/700613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/users\/3682"}],"replies":[{"embeddable":true,"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/comments?post=700613"}],"version-history":[{"count":0,"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/posts\/700613\/revisions"}],"wp:authorship":[{"embeddable":true,"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/users\/3682"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/media\/629472"}],"wp:attachment":[{"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/media?parent=700613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/categories?post=700613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/tags?post=700613"},{"taxonomy":"zd_collection","embeddable":true,"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/zd_collection?post=700613"},{"taxonomy":"zd_type","embeddable":true,"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/zd_type?post=700613"},{"taxonomy":"zd_post_attributes","embeddable":true,"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/zd_post_attributes?post=700613"},{"taxonomy":"zd_product","embeddable":true,"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/zd_product?post=700613"},{"taxonomy":"zd_internal","embeddable":true,"href":"https:\/\/www.zdnet.com\/wp-json\/wp\/v2\/zd_internal?post=700613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}