Google raised the degree of difficulty for Pwn2Own and Pwnium hacking contestants by patching 10 vulnerabilities in its Web browser last night.
The popular contests, which kick off tomorrow in Vancouver at the CanSecWest Conference, feature millions in prize money for researchers who can crack not only Chrome and the Chromium operating system, but Microsoft’s Internet Explorer, as well as Adobe Reader and Flash, Oracle’s Java platform and others.
Of the 10 vulnerabilities patched in Chrome 25.0.1364.152 for Windows and Linux, six were given Google’s highest severity rating of High; four netted payouts of $1,000 each in Google’s bug bounty program.
Three of the bugs were use-after-free vulnerabilities in browser navigation handling, frame loader and in SVG animations, Google said. It also repaired a memory corruption bug in Web Audio, as well as a memory corruption issue in Indexed DB, and a possible path traversal in database handling.
Pwn2Own and Pwnium 3 will run side by side during CanSecWest. Pwn2Own, the older of the two contests, is offering $100,000 to the first person who can compromise Google Chrome running on Windows 7. The $100,000 prize is the top catch at Pwn2Own; it’s also being offered for an IE 10 compromise on a Windows 8 machine.
Google, meanwhile, runs Pwnium, which this year will focus on the Chrome operating system. Google is offering a Pi full of prize money: $3.14159 million. The attack must be pulled off against a Samsung Series 5 550 Chromebook running the latest stable version of the Chrome OS. Google also is offering up $110,000 each for a “browser or system level compromise in guest mode or as a logged-in user, delivered via a web page” and $150,000 for a “compromise with device persistence — guest to guest with interim reboot, delivered via a web page.”
“We believe these larger rewards reflect the additional challenge involved with tackling the security defenses of Chrome OS, compared to traditional operating systems,” Google said.
