Google offers $20,000 for a Chrome hack
Written by Harry Fairhead   
Thursday, 03 February 2011

Google offers $20,000 for a Chrome exploit, but is it a fair test? In the real world the rules of hacking aren't quite so controlled.

Most programmers just wait for their loyal users to report bugs and security problems, but Google is so confident that its Chrome browser is watertight that it is offering a bounty of $20,000 to anyone who can hack into it.

The bounty is being offered as part of the annual  Pwn2Own contest which invites hackers to break into Internet Explorer, Firefox and Safari and Chrome, with cash prizes for each plus a laptop.

The rules for the challenge  are tough, however. To win the $20,000 offered by Google the exploit has to be completed on the first day of the 3-day competition and has to escape the Chrome sandbox to access the rest of the system. The exploit also has to make use of a vulnerability that is within pure Google code - if the trick is to use someone else's weak code to get into Chrome then it doesn't qualify for the big prize. 

 

chrome

On days 2 and 3 of the competition you can still win  $10,000 and in this case you can use problems with non-Google code. Google is also offering $10,000 for a Chrome bug.  Throughout the contest the use of plug-in vulnerabilities is prohibited - that would be too easy.

This is the second year that Google has offered the prize and in last year's contest it was the only browser left unhacked.  If the competitors find a flaw then they have to keep it to themselves until Google decides to tell the world about it.

If there is no successful hack what exactly does this prove? Google will no doubt tell everyone that Chrome is extraordinarily secure but in the real world the attack wouldn't be constrained to a short period of time and it would make use of non-Google code and plug-ins are well known for being flaky.

So fun - yes, but realistic - no.

Registration for the contest closes on 15 February. For full rules and to enter see the Tipping Point's announcement. 

Banner


Couchbase Adds Vector Search
07/03/2024

Couchbase is adding support for vector search across its entire product line including Capella, Enterprise Server, and Mobile. Support has also been added for retrieval-augmented generation (RAG) tech [ ... ]



Visual Studio 17.9 Now Generally Available
18/03/2024

Visual Studio 17.9 is now fully available with AI assistance and better extensibility. The first preview of 17.10 has also been made available in preview.


More News

Last Updated ( Tuesday, 28 February 2012 )