Pwn2Own 2009 - Chrome is the only web browser to survive
Pwn2Own is an annual computer hacking contest, which probably means none of my readers are even remotely interested in this post, but I’m still going to write it ;-P I’ll try to make it easy to understand though (hopefully, this way at least somebody will read it :]).
Basically, the rules of the competition go something along the lines of - try to hack into the computers the organizers provide and if you manage, you get the computer you hacked into and some prize money. The detailed rules change a bit every year though.
This year the browser targets were IE8, Firefox, and Chrome installed on a Sony Vaio running Windows 7 as well as Safari and Firefox installed on a Macbook running Mac OS X. These had to be hacked into by supplying a link - clicking on it should compromise the machine. They also had some mobile devices this year, but I’m totally clueless about mobile devices, so I’m not going to cover them ;-P All of the systems and devices were fully patched with the latest security updates.
Before I go any further I’d better explain some computer security jargon. You’re going to come across two terms - vulnerability and exploit. A vulnerability is an area in which the application is potentially at risk, but the actual risk comes from the exploit (which uses the vulnerability). It’s an important distinction. These days writing the exploit is usually much more difficult than finding the vulnerability and you might need to use more than one vulnerability to write code that will allow you to hack into a computer. There are also plenty of known vulnerabilities that have never been exploited.
The competition always lasts three days - every day the rules are slightly loosened to make it easier to hack the computer (if it’s still standing that is). On day one this year hackers had to hack into a default installation of the web browsers with no additional plug-ins or software (it’s much easier when say the flash plug-in is installed - Macromedia is unfortunately not too concerned with security). Traditionally, Safari on Mac OS X is the first to fall and this year was no exception. It took two minutes. More interestingly, IE8 fell on the first day too, as did Firefox. A little embarrassing as IE8 was only released this month, but they reacted to it very quickly. They verified the bug in about 12h and are already working on a fix (the days when critical security bugs took weeks or months to patch are long gone).
The most interesting thing for me though was that Google’s web browser, Chrome, did not fall at all - even during the following days when additional plug-ins and applications were installed.
Chris Miller, who was the one to hack into Safari in two minutes gave a very interesting interview. There’s a couple of things he said that I found very informative. Here he talks about how insecure Mac OS X is:
Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don?t do. Hacking into Macs is so much easier. You don?t have to jump through hoops and deal with all the anti-exploit mitigations you?d find in Windows.
It?s more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesn?t have anti-exploit stuff built into it.
(…)It?s clear that all three browsers (Safari, IE and Firefox) have bugs. Code execution holes everywhere. But that?s only half the equation. The other half is exploiting it. There?s almost no hurdle to jump through on Mac OS X.
Here he says a bit about Nils’ sweep of exploiting all three of the most popular browsers:
On a scale of 1-10, how impressive was the Nils? sweep of exploiting all three main browsers
I was surprised. For IE 8, I?d give him a 9 out of 10. For Safari, maybe a 2. It?s just too easy to pop Safari. For Firefox on Windows, I give him a 10. That was the most impressive of the three. It?s really hard to exploit Firefox on Windows.
And here he talks a bit about Chrome:
Google Chrome was the one target left standing. Surprised?
There are bugs in Chrome but they?re very hard to exploit. I have a Chrome vulnerability right now but I don?t know how to exploit it. It?s really hard. They?ve got that sandbox model that?s hard to get out of. With Chrome, it?s a combination of things ? you can?t execute on the heap, the OS protections in Windows and the Sandbox.
I heard a lot of critical voices about Chrome when it came out initially - in particular people seemed to be disappointed with the lack of innovative functionality. The sandbox feature was mentioned, but it sounds like it’s much more effective than it was made out to be.