CanSecWest Pwnium: Google Chrome hacked with sandbox bypass

Summary:The attack, which included a Chrome sandbox bypass, was the handiwork of Sergey Glazunov, a security researcher who regularly finds and reports Chrome security holes.

VANCOUVER -- A Russian university student hacked into a fully patched Windows 7 machine (64-bit) using a remote code execution vulnerability/exploit in Google's Chrome web browser.

The attack, which included a Chrome sandbox bypass, was the handiwork of Sergey Glazunov, a security researcher who regularly finds and reports Chrome security holes.

follow Ryan Naraine on twitter

Glazunov scored a $60,000 payday for the exploit, which targeted two distinct zero-day vulnerabilities in the Chrome extension sub-system.  The cash prize was part of Google's new Pwnium hacker contest which is being run this year as an alternative to the more well-known Pwn2Own challenge.

According to Justin Schuh, a member of the Chrome security team, Glazunov's exploit was specific to Chrome and bypassed the browser sandbox entirely.  "It didn't break out of the sandbox [but] it avoided the sandbox," Schuh said in an interview.

[ SEE: Charlie Miller skipping Pwn2Own as new rules change hacking game ]

Schuh described the attack as "very impressive" and made it clear that the exploit "could have done anything" on the infected machine.  "He (Glazunov) executed code with full permission of the logged on user."

"It was an impressive exploit.  It required a deep understanding of how Chrome works," Schuh added. "This is not a trivial thing to do.  It's a very difficult and that's why we're paying $60,000.

Glazunov is a regular contributor to Google's bug bounty program and Schuh raved about the quality of his research work.

Schuh said Glazunov once submitted a similar sandbox bypass bug but stressed that these kinds of full code execution that executes code outside the browser sandbox form a very small percentage of bug submissions.

Google's Sundar Pichai says the company is "working fast on a fix" that will  be pushed out via the browser's automatic update utility.

Topics: Apps, Browser, CXO, Google, IT Employment

About

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content managem... Full Bio

zdnet_core.socialButton.googleLabel Contact Disclosure

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.