Google announced on Monday that it would pay $1 million in cash awards to anyone who can hack its Chrome browser during its Pwnium security challenge next week in Vancouver at the CanSecWest conference.
Google has pledged to pay multiple awards in the amounts of $60,000, $40,000 and $20,000, depending on the severity of the exploits, up to $1 million. Winners will also receive a Chromebook.
“We require each set of exploit bugs to be reliable, fully functional end to end, disjoint, of critical impact, present in the latest versions and genuinely ’0-day,’ i.e. not known to us or previously shared with third parties,” Google wrote on its blog.
The exploits must work against Windows 7 machines running the Chrome browser.
$60,000 – “Full Chrome exploit”: Chrome / Win7 local OS user account persistence using only bugs in Chrome itself.
$40,000 – “Partial Chrome exploit”: Chrome / Win7 local OS user account persistence using at least one bug in Chrome itself, plus other bugs. For example, a WebKit bug combined with a Windows sandbox bug.
$20,000 – “Consolation reward, Flash / Windows / other”: Chrome / Win7 local OS user account persistence that does not use bugs in Chrome. For example, bugs in one or more of Flash, Windows or a driver. These exploits are not specific to Chrome and will be a threat to users of any web browser. Although not specifically Chrome’s issue, we’ve decided to offer consolation prizes because these findings still help us toward our mission of making the entire web safer.
Google’s hack challenge will run alongside the $15,000 Pwn2Own contest that runs each year at CanSecWest, which challenges researchers to exploit vulnerabilities in fully patched browsers and other software.
Last year, Google offered a $20,000 bounty, on top of the base $15,000 Pwn2Own prize, for anyone who successfully downed Chrome, but there were no takers. Chrome is currently the only browser eligible for the Pwn2Own contest that has never been brought down, Ars Technica notes. Contestants have indicated that difficulties bypassing Google’s security sandbox is the reason they’ve avoided the browser and focused on the Internet Explorer and Safari browsers instead.
Google is offering up to $1 million in prizes for successfully hacking the Chrome web browser.
On Monday Google said it is now shelling out up to $1 million worth of rewards for anyone who can crack open its Chrome web browser.
According to Chris Evans and Justin Schuh of the Google Chrome Security Team, the biggest cash prize of $60,000 will go to those who discover a “full Chrome exploit” using bugs found only within Chrome itself. $40,000 will be awarded to those who perform a partial Chrome exploit using at least one Chrome bug plus other OS bugs (a WebKit bug combined with a Windows sandbox bug, for example).
“Originally, our plan was to sponsor as part of this year’s Pwn2Own competition,” the Google Chrome Security team said on Monday. “Unfortunately, we decided to withdraw our sponsorship when we discovered that contestants are permitted to enter Pwn2Own without having to reveal full exploits (or even all of the bugs used!) to vendors. Full exploits have been handed over in previous years, but it’s an explicit non-requirement in this year’s contest, and that’s worrisome.”
Thus, Google is now offering rewards for hacking its web browser outside the Pwn2Own competition. In addition to the Full Chrome Exploit and Partial Chrome Exploit categories, Google will also offer $20,000 to those who fall under the “Consolation reward, Flash / Windows / other” category, or rather, those who discover bugs that could threaten users in any browser including bugs in one or more of Flash, Windows or a device driver.
The team said Google is offering consolation prizes because these findings help propel the company’s overall mission to make the entire web safer to crawl no matter what browser is used.
“We will issue multiple rewards per category, up to the $1 million limit, on a first-come-first served basis,” the blog reads. “There is no splitting of winnings or ‘winner takes all.’ We require each set of exploit bugs to be reliable, fully functional end to end, disjoint, of critical impact, present in the latest versions and genuinely ’0-day,’ i.e. not known to us or previously shared with third parties. Contestant’s exploits must be submitted to and judged by Google before being submitted anywhere else.”
All winners will also receive a Chromebook, the team said.