Forgot your password?
typodupeerror
Chrome Google Security IT

Pinkie Pie Earns $60K At Pwn2Own With Three Chromium 0-Day Exploits 148

Posted by timothy
from the omg-pwnies! dept.
Tackhead writes "Hot on the hooves of Sergey Glazunov's hack 5-minutes into Pwn2Own, an image of an axe-wielding pink pony was the mark of success for a hacker with the handle of Pinkie Pie. Pinkie Pie subtly tweaked Chromium's sandbox design by chaining together three zero-day vulnerabilities, thereby widening his appeal to $60K in prize money, another shot at a job opportunity at the Googleplex, and instantly making Google's $1M Pwnium contest about 20% cooler. (Let the record show that Slashdot was six years ahead of this particular curve, and that April Fool's Day is less than a month away.)"
This discussion has been archived. No new comments can be posted.

Pinkie Pie Earns $60K At Pwn2Own With Three Chromium 0-Day Exploits

Comments Filter:
  • by LiroXIV (2362610) on Saturday March 10, 2012 @10:31PM (#39315635)
    A PARTY!!! (sorry bronies, couldn't resist)
    • Deploy The Party Cannon!
      • by Anonymous Coward

        Wait, who invited Star Swirl the Bearded?

        He's always such a downer!

      • by Ihmhi (1206036)

        Assume the party escort submission position!

      • Re: (Score:2, Interesting)

        by Anonymous Coward

        You know what this calls for?
        Deploy The Party Cannon!

        Well, since [youtube.com] you [youtube.com] asked [youtube.com] nicely [youtube.com], allow me to deploy the Party Cannon like a boss [youtube.com]. PARTY [youtube.com] HARD [youtube.com]! I'm pony and I know it [youtube.com]!

        OK. Virus Alert! [youtube.com] now over, and while we're waiting for the patch, let's watch the Dead Parrot Sketch [youtube.com], chug a mug o' mead and back to Skyrim [youtube.com], Portal [youtube.com], TF2 [youtube.com], or whatever else you're playing tonight.

        And I found all that stuff within ten minutes of random youtube surfing. My brain is full of pinkie pie [mylittlefacewhen.com], and I love it.

        It's like the god

    • it's cool. I appreciate the sentiment.
    • Re: (Score:2, Funny)

      by Anonymous Coward

      This is your singing telegram I hope it find you well
      I found a browser exploit and it's working pretty swell

      Chrome's in version seventeen, but its sandbock's not complete
      I bought myself a vic'try cake, it hope it really sweet

      There will be massive patching i'm sure in a day or three
      And when you've downloaded the fixes, send some thanks to me

      No need to write a check, mr google's was enough
      But hacking not about the cash, but out stuff

      The hole's just in the browser, they'll patch it before too late
      but please oh

    • by pushing-robot (1037830) on Sunday March 11, 2012 @05:57AM (#39316971)

      Pinkie Pie Earns $60K At Pwn2Own With Three Chromium 0-Day Exploits

      Oh, sure, we're laughing now... but this should be a wake-up call.

      While at first glance they seem almost indistinguishable from us, there is actually a vital difference between Ponies and ourselves—educational systems.

      Pony schools are far more intense than ours, especially in the maths and sciences. If you're familiar with the so-called "math" taught in our primary schools, you will agree that this image is disturbing. [imgur.com] Young fillies (and colts, though their society is strongly gender-biased) are also taught a tremendous work ethic and social responsibility virtually from birth; in fact, they are expected to demonstrate exceptional talent and plan a career even before they reach adolescence. Furthermore, Ponies are even taught to take responsibility for the world around them. Their town, their environment...hell, the Sun, Moon and skies might as well be in their charge. They possess a drive that we fail to instill in our own children.

      None of this is particularly surprising when you consider that Equestria is an autocratic state whose leader has a singular fixation on education. While our leaders focus on populism and pork, Equestria sinks more and more resources into teaching even while its infrastructure and government services seem positively primitive.

      What does this mean for us? In the short term we'll continue to maintain our dominance in industry, but farther out...simply put, we're fucked. While our children fall farther and father behind, their foals dash ahead. They're already pumping out incredible individuals and technologies that defy belief. I fully expect that the first footprints on Mars...will be hoofprints. But that's not the worst of it. In the next decade, a pony will likely take your job. Soon they'll be running our entire country.

      I know what you're thinking right now: "Oh my god...Ponies, rule?". But the answer is yes, and I can't put too fine a point on it: It's only a matter of time before Ponies totally and completely rule everything. That is—unless you do something about it today. Write to your representatives. Tell them unless we all want to start singing Pony anthems, they can no longer claim to be strong on education while cutting budgets and shirking responsibility.

      Tell them that starting tomorrow, their actions must match their words.

      Tell them they must stop this hippocracy.

  • WebKit (Score:5, Interesting)

    by 93 Escort Wagon (326346) on Saturday March 10, 2012 @10:33PM (#39315649)

    It's interesting that the article implies the flaw is in WebKit rather than, say, JavaScript or Flash. So there'll need to be a similar patch made for Safari (which the article also briefly touches on).

    • Re: (Score:3, Funny)

      by Anonymous Coward

      Frankly, that's impossible.

      Safari is perfect, like everything else Apple makes.

      • I've heard you lot say that countless times, but I've never actually heard a Mac fanboi say it. Way more annoying.

    • Not just webkit but also Google's Sandbox.

      One of the reasons I use Chrome and IE 9 is because of sandboxing. Firefox still does not support it, but there are ways around it. Java had sandboxing too from day 1 and we all know how well that turned out to be the last few years security wise.

      • One of the reasons I use Chrome and IE 9 is because of sandboxing. Firefox still does not support it, but there are ways around it. Java had sandboxing too from day 1 and we all know how well that turned out to be the last few years security wise.

        Such is the case when you compile data to machine-code at run-time, then flag it as executable and run it.

      • by JBMcB (73720)

        This is why, for general web browsing, I use Firefox in a stripped-down VM. A bit extreme, but my main machine has never been infected by anything, and the VM only got hit once. Reverted to a backup image and I was back in business. I hear Sandboxie is nearly as effective as this setup, too.

    • by hairyfeet (841228)
      One thing I can't seem to find in these things is this: did they have ANY kind of AV installed? if so what kind? i know they use the latest version of the OS with all current patches installed (although someone pointed out the other day it looked to be Chrome 11 from the screencaps at pwn2own) but it would be nice to know if it had an AV like virtually every desktop on the planet or if they give them a machine clear of AV or antispy.
      • Re:WebKit (Score:5, Insightful)

        by garaged (579941) on Saturday March 10, 2012 @11:22PM (#39315821) Homepage

        I "see" a lot of linux boxes on daily basis (yeah, that was right) and NONE of them has AV, some of the do have some kind of "enterprise protection", but unless you are talking about an email server, on linux you usually do not have any kind of AV running, and yet I (on daily basis again) use chrome and firefox a lot for fun and profit, so, an exploit for them is important for me, AV or not involved.

      • by Anonymous Coward

        AV's sweet spot is spotting known exploits by scanning files for signatures. Everything else is mostly just snake oil. You pay them money and they make you feel better with their elixir.

        AV software won't work well for Linux viruses because Linux exploits are mostly remote exploits. The AV software can't scan it and match any signatures, and once an exploit gets root access it quickly hides itself. It works better on Windows because the vector is usually attachments.

      • by Lennie (16154)

        If the developer can create a zero-day exploit why would he/she ship a payload which is already recognised by the AV ?

        Also a lot of malware just gets a new version every 15 minutes by the push of a button. The AV vendors can't keep up. Detectionrates are going down.

        Just a few days ago someone asked me to look at a Windows machine which had malware, I uploaded the binary to virustotal and virscan and they both mentioned things like: 7 out of 34 scanners recognise it. Most of the virusscanners that did recogn

        • by hairyfeet (841228)
          Should have tried either Avast or Comodo IS (have been using Avast but recently switched back to Comodo as i like their terms better and they don't pop up crap like Avast does) as both of those have really nice sandboxing. Comodo goes one further if you'd like by tying into Comodo SecureDNS (which you can optionally have only run on Comodo Dragon in case you like your local DNS for gaming) and I've found that with a combo of Win 7 with ASLR and DEP along with Dragon sandboxing by the AV its pretty damned ha
          • by Lennie (16154)

            Comodo and Avast are both on the list of virustotal.com and virscan.org they both didn't recognise it.

            The whole AV-industry is a mess.

            I've already seen it happen years ago on my mailservers, you get a new virus-/malware-variant every 15 minutes or so. They aren't recognised yet by the AV-vendor. It takes more time for the AV-vendors to come up with a signature than the bad guys can generate new variants. By the time the AV vendor has a signature a new variant already exists and the bad guys stopped sending

      • by smash (1351)

        Having AV installed is missing the point. AV is like an airbag in your car. If your brakes fail and you have an accident, it limits damage to you.

        The point of pwn2own is to find vulnerabilities in the browser. i.e., in the above scenario, you could compare it to making sure the brakes work on your car. AV definitions are never 100% up to date - the whole notion of a "0-day" exploit is that it hasn't been published, hence the AV defs will likely not catch it. If the browser was secure in the first pl

    • Re: (Score:3, Informative)

      by Anonymous Coward

      Well, I don't know which of the linked articles *you* read, but the one I read clearly stated that the first attack vector was a flaw in the Flash plug-in. Chrome's sandbox apparently was then unable to protect the system against the haywire Flash plug-in. So not a flaw in WebKit, to all probability, but three others in Chrome. The article didn't state whether they counted the flaw in the Flash plug-in, but even if they did there are probably at least two flaws in the sandbox.
      As it stands, it confirms what

      • Re:WebKit (Score:4, Informative)

        by Mr Z (6791) on Sunday March 11, 2012 @01:55AM (#39316325) Homepage Journal

        Putting "Flash" under "Privacy" makes sense if you understand how much of the Flash out there really gets used. Flash apps can store a fair bit of data locally on your HD without setting a normal HTTP cookie, [wikipedia.org] which makes tiny, invisible Flash apps handy for tracking purposes.

        While the average web surfer doesn't think about Flash in that way, it's not too surprising a company that makes its fortunes on ad revenue and customer profiling understands its real role on the Web.

        This is why I run flash-block, and only unblock the very occasional app and/or game I care to interact with, and not the half dozen other ones on the same page that don't seem to do anything interesting to me.

      • websites shouldn't rely on [Flash Player] (offer alternative functionality such as downloads or HTML 5 video)

        For a vector animation or a game that was made in Flash or another SWF-making tool, what would such "downloads" be, other than the SWF itself? A vector animation such as "Badger Badger Badger" would become ten times bigger in bytes if automatically converted to WebM or MP4, and a game would become a playthrough video.

  • by Scarletdown (886459) on Saturday March 10, 2012 @10:34PM (#39315657) Journal

    OMG!!! Ponies!!!

  • Be Creative!

    Why don't you have a banner that says "Optimized for IE 6! Enjoy the new support the best browser available. [saveie6.com] . Link a whole bunch of articles including the one at arstechnica that showed IE 6 usage jumped last month.

    Go dig up some CSS from Slashdot 2002 era from slashcode. Let us officeworkers use it for a day or need to click "compatibility mode" for IE 8 and 9. You have the code?

    Maybe put the blue colors of XP mode in its colors.

  • Pwn2Own rocks. (Score:4, Insightful)

    by LordLimecat (1103839) on Saturday March 10, 2012 @10:52PM (#39315719)

    The best thing about Pwn2Own is that it can be a shot of reality for anyone who gets overly confident in how awesome their favorite OS or browser is. Im a huge fan of Chrome and was hoping it would stand up without any 0-days, but its great that Pwn2Own brought to light the reality that there is no "secure web browsing experience" outside of Lynx (and Im willing to bet that could be 0-day'd too).

    • Re:Pwn2Own rocks. (Score:5, Interesting)

      by Billly Gates (198444) on Saturday March 10, 2012 @11:13PM (#39315781) Journal

      One downside is many are reporting on ZDNet, that the IE 9 exploit that was shown yesterday has new trojans already working for it.

      Since it is a 0 day exploit it is undetectable by any anti virus scanner yet and all you need to do is search under Google Image and you are instantly infected without clicking on anything.

      Google at least patched the last one in 24 hours, but I do not trust other browsers or users to patch that quick.

    • Re:Pwn2Own rocks. (Score:4, Insightful)

      by Teckla (630646) on Saturday March 10, 2012 @11:52PM (#39315923)

      ...but its great that Pwn2Own brought to light the reality that there is no "secure web browsing experience"...

      It seems to me there must be fundamental problems with the web browser technologies themselves. The web has been extremely popular for a long time now, and it seems no company, no matter how talented, no matter how serious, no matter how security focused, no matter how well staffed, no matter how much money, can make a secure web browser. This is getting ridiculous!

      Yes, I'm seriously thinking web technologies themselves are to blame. Overly complex? Over engineered? Fundamentally flawed? Complexity is the enemy of security. It's time for a re-think.

      What do other people think? Is it time to trash the old and invent something new, something mere mortals can embrace, and actually create secure implementations?

      • by Anonymous Coward

        Not so sure about the technologies, as the pace of browser development. Security, I think, takes time and thought, which the designers and programmers are not allowed in the interests of getting the next release with new features out.

      • Re:Pwn2Own rocks. (Score:4, Insightful)

        by Anonymous Coward on Sunday March 11, 2012 @12:16AM (#39316021)

        As AC above hinted at, and I believe I quote from some famous computer book or another, "If the structural properties of steel changed 20% every ten years, then Civil Engineering as a discipline would look a lot different."

        Point being, you can have breakneck advancement or inherently secure code, but not both at the same time.

      • Re:Pwn2Own rocks. (Score:4, Interesting)

        by bloodhawk (813939) on Sunday March 11, 2012 @12:39AM (#39316095)

        Is it time to trash the old and invent something new, something mere mortals can embrace, and actually create secure implementations?

        The funny part about your post is your idea of a solution is actually the current problem. Technology is changing so fast that No one can have a modern popular functional end user browser while being secure. Security IS HARD, No matter how good a programmer you are you can't possibly imagine every possible type of new exploit technique that will be created tomorrow, next week or next year. It is even harder if every few years you have to rewrite everything, your idea would just bring about a raft of new security issues..

        • by Thing 1 (178996)

          The funny part about your post is your idea of a solution is actually the current problem.

          As has been true of the Simpsons for some time, there is often a relevant XKCD comic. [xkcd.com]

      • by Sycraft-fu (314770) on Sunday March 11, 2012 @03:03AM (#39316565)

        You can to accept that virtual security is the same as physical security and cannot be perfect in the real world.

        See with physical security, we've known this forever. You can't design the unbeatable system. No matter what you design, someone can figure out a way to overcome it, through brute force if necessary. You can't secure something to perfection. So you don't try, you design security to repel any likely threat you you rely on defense in depth so that if one layer fails, the whole system doesn't fail.

        However many geeks seem to have talked themselves in to the idea that you can have perfect virtual security. Just use browser X on OS Y and there is no way anything evil can get you, kind of thing. Well I think that is false. You can't have perfect virtual security. Instead, you just have to make it as good as you can against the threat you are likely to face, and then have defense in depth.

        Patch your OS and browser, run an on access virus scanner, run a client firewall, have a network firewall, run as a deprivileged user, use things like ASLR and DEP, be safe about your browsing, monitor your system, etc. Don't rely on a single thing to keep you safe, rely on many. Realize that all your layers have defects. Fix them when found, but understand there is no perfection.

        This whining that nobody can build something perfect is just stupid. No, they can't, we never have, never will. Deal with it. We don't move out of our houses because they aren't perfectly secure, we aren't going to stop using our computer because they aren't perfectly secure. Get good layered defense and stay on top of it. That is all you can do, all we've ever been able to do.

        • by Teckla (630646)

          This whining that nobody can build something perfect is just stupid.

          I don't think anyone reasonable is asking for perfection -- I think that's a red herring designed to denigrate people who suggest that perhaps -- just perhaps -- web browser technology is below reasonable expectations.

          For most pieces of software, some reasonable level of defects is expected, otherwise software development costs would be extremely high, and we would be using software with a lot less features. Software having some bugs is the trade-off the vast majority of us are willing make.

          However, I think

        • by smash (1351)

          You forgot the essential aspect: have backups. At some point, it is likely that if you have valuable data, you may well be hacked, irrespective of whatever precautions you have taken. Humans are fallible, and sooner or later someone is going to put a trojan out there that will fool you, and you will get owned.

          Make sure you have backups (so you can recover) and that any confidential data is encrypted (to minimize likelihood of stolen data being used against you).

      • Re:Pwn2Own rocks. (Score:4, Insightful)

        by Wrath0fb0b (302444) on Sunday March 11, 2012 @05:41AM (#39316945)

        Yes, I'm seriously thinking web technologies themselves are to blame. Overly complex? Over engineered? Fundamentally flawed? Complexity is the enemy of security. It's time for a re-think.

        Complexity is required to perform arbitrary tasks in a dynamically programmable fashion -- which is essentially what modern HTML/Javascript essentially provides. You can't take something like that are "re-think" it into something less complex than some fundamental measure of the complexity of the application for which it is intended. Either the browser has to be able to perform those functions or users are going to have to accept a web with drastically limited capabilities.

        In a broader sense, this is a symptom of the annoying idea that some combination of clever engineering and design decisions can destroy complexity and replace it with something simple. This is superficially true but really what's happening is not that complexity is destroyed, only that it is hidden away -- it's a sort of "conservation of complexity": you can shuffle it around between various layers and (hopefully) hide it from the end user but it's still got to be there somewhere. Consider a cell-phone, it's an insanely complex system involving a all kinds of RF, some arcane protocol, software running on the mobile device, software running the backhaul -- just thinking about it for a second is enough to give you a headache. What the user sees when they dial a number isn't complex not because we've made all those things easy, only because we've relocated it somewhere else.,

        The same thing happens in the case of a browser -- I log into gmail and Google dynamically instructs my computer ("over the wire") how to create an entire GUI program that interacts with their server. That's nothing short of amazing and when you say "browsers are overly complex and over-engineering" what you are essentially saying that they should not be able to do that because that complexity came fundamentally and inexorably from the statement of the required functionality. No simple system could every do that ....

      • by sFurbo (1361249)
        It is a corrolary of Gödels incompleteness theorem that, if the virus detection is not allowed to change the OS, it is impossible to make a virus detection program that can find all viruses that change the OS. It is not just hard to make a secure computer, it is impossible. You might be able to make it arbitrarily hard to crack, but you can't make it impossible. There is no secure implementation.
      • by BZ (40346)

        There _is_ a fundamental problem with web technologies. It's called "web developers want more features". So browsers add features, and then you get combinatorial explosion of feature interactions and resulting complexity.

        You can, of course, try to trash the old and invent something new. It's been tried; see XHTML2. Good luck with that!

    • by c++0xFF (1758032)

      But, at least now we know there are three fewer 0-day exploits than before. That's something, isn't it?

    • by utkonos (2104836)
      You're new to the intertubes, huh? Lynx has been as unsafe as any browser from time [exploit-db.com] to time [juniper.net].
  • The code isn't in a sandbox if it can escape.

    A lot of (desktop) hardware supports virtualization at the hardware level -- This doesn't mean executing a different set of opcodes, it means running an OS inside of an OS. We need hypervisory control at the application level. As long as your application code is running in the same environment as everything else with no hardware supported barriers, then it's not actually in a sandbox.

    We compile sections of JavaScript to machine code in data memory, mark the resulting data as code and execute it. It only takes one well placed buffer overflow to get some of your memory corrupted, before data is executed as code. The corruption need not result from JavaScript to affect the JS engine. Additionally, if said JavaScript or HTML or ANY untrusted source of data is being used by native code at the same security level as the application then any bug in that native code (eg: flash, SVG, HTML5 rendering, video/sound codecs, etc) can be an open door out of the "sandbox". This is similar to how such a bug in kernel level code can give you kernel level access... Such is the case for application level code as well.

    Data Execution Prevention (DEP [wikipedia.org]) can be used to prevent executing data as code (eg to prevent buffer overflow data from being executed), but since the design of JavaScript makes implementations so slow and we're trying to do so much with it we actually need to execute the data as code. To gain performance we forfeit one of best tools that a "sandbox" can have.

    Many that gloat over their browser performance benchmarks wilfully trade security for speed, leaving other more sensible individuals (who may instead throw hardware at a speed issue) without an option... Better browser code can't execute "faster". The hardware runs at the same speed. It can only execute less. That is: more efficiently... More speed requires better hardware, not software.

    I would welcome a slower software only VM option (no just in time compiling to machine code), this way hardware DEP could be used to enforce sandboxing more strictly. Until then: My browser runs in its own OS within a hardware supported VM. I start from a fresh known-good VM image before I do anything important on the web. THAT'S a sandbox. Consequently, these restrictions mean I won't do anything important on today's mobile devices...

    P.S.
    Security researcher red-flags bolded for your convenience.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      It's also possible to break out of hardware VMs. Why? Because there's no such thing as a hardware VM. There's hardware-enhanced VMs, but there's still driver and other code which has to interact with the guest OS, thus opening vectors for attack with a much larger attack surface than between two discrete boxes. There have been such exploits published, there are no doubt many unpublished, and there will be more in the future.

      Sorry to rain on your parade.

      • by jdogalt (961241) on Sunday March 11, 2012 @01:02AM (#39316137) Journal

        To further rain on the "VMs, even hardware ones, aren't exploitable" parade, the history of hacking the PS3 is always a fun read-

        http://wiki.ps2dev.org/ps3:rsx [ps2dev.org]

        "
        FIFO workaround

        The hack consists of asking the Hypervisor to return without waiting for a blit to end. After the Hypervisor returns there is a small length of time during which the FIFO or FIFO registers can be modified before the GPU has finished reading the command. This will occur when a large blit is decomposed into many smaller 1024×1024 blits by the Hypervisor. The last operation pushed to the FIFO by the Hypervisor is a wait for the GPU engine to go idle. By skipping this operation, it is possible to enqueue more commands to the FIFO for the GPU to execute. So the hack consists in either patching the last operation with a NOP, or changing the FIFO write pointer to stop earlier.
        "

      • by Thing 1 (178996)

        It's also possible to break out of hardware VMs. Why? Because there's no such thing as a hardware VM. There's hardware-enhanced VMs, but [...]

        I have the image of software breaking out of hardware VMs and becoming a person (perhaps in a robot first, then after Gepetto...).

        Sorry to parade on your rain. :)

    • Wow, you wrote a very long post to say 'I don't know what I am talking about'.

      Every process is sandboxed in a hardware VM. It is using a different instruction set which is restricted from doing anything related to I/O. No process can do anything other than touch its own memory and issue system calls. If it wants to open a socket or access the filesystem, it must issue a system call and then the kernel decides whether to permit this.

      Modern browsers (including Chrome) make use of this by running the

  • That guy just got himz a j-o-b.

  • finally : )
  • it's getting annoying. 0-day means exploited the day the vulnerability is exposed. You can have a 0-day exploit. There is no such thing as a 0-day vulnerability.

    • by Pahroza (24427)

      So the guy or gal who discovers a vulnerability, writes some malicious code around it, and then throws both into the wild, isn't using a 0 day exploit?

      • by sqldr (838964)

        they are doing exactly that. they have created a 0-day exploit for a vulnerability.

"Well hello there Charlie Brown, you blockhead." -- Lucy Van Pelt

Working...