Revealed: Chrome Really Was Exploited At Pwnium 2013 102
Posted
by
timothy
from the for-some-values-of-exploited dept.
from the for-some-values-of-exploited dept.
Freshly Exhumed writes with an "inconvenient truth" as reported at Internet News: "Google Chrome running Chrome OS was hailed as being a survivor in the Pwnium/Pwn2own event that hacked IE, Firefox and Chrome browsers on Windows. Apple's Safari running on Mac OS X was not hacked and neither (apparently) was Chrome on Chrome OS. Google disclosed [Monday] morning that Chrome on Chrome OS had in fact been exploited — albeit, unreliably. The same researcher that took Google's money last year for exploiting Chrome, known publicly only as 'PinkiePie' was awarded $40,000 for exploiting Chrome/Chrome OS via a Linux kernel bug, config file error and a video parsing flaw." Asks Freshly Exhumed: "So, was it really Google Chrome, or was Linux to blame?"
Linux or Chrome? (Score:4, Insightful)
Wasn't it both? They're both a component in the same vector.
The answer is: Yes (Score:4, Insightful)
The kernel shouldn't have had the bug, so Linux is to blame.
Chrome OS is built on Linux by choice, not necessity (they could have used FreeBSD, Minix, or even done a UI replacement of Windows if they wanted to spend more $$$), so... since they didn't fix the bug in their chosen, and open source OS, it's their fault too.
Blame doesn't always have to fall on one party, it can fall on multiple parties who all didn't do due diligence, or no parties when the problem was from nature, and nobody could have reasonably predicted it.
Re:The answer is: Yes (Score:5, Insightful)
Re:Linux or Chrome? (Score:5, Insightful)
Re:Misleading (Score:5, Insightful)
You don't seem to understand how Pwn2Own works. People don't arrive at the contest, pick an OS/Browser and then start looking for an exploit.
They begin weeks in advance looking for exploits. IF they find one, then they go to the contest and select the appropriate platform and demonstrate the exploit. Their demonstration may fail, because the versions of the software on the contest platform might be different from what they were practicing with.
That no one "attempted to hack" OSX and Safari at the competition this year is because in the past few weeks of trying, no one has found an exploit for it. It's certainly not the case that they could have won the prize, but couldn't be bothered.
Who gives a fuck ? (Score:3, Insightful)
I mean apart from academic curiosity, who does give a fuck if the fault should be blamed on Linux or on Chrome ?!
The REAL ACTUAL IMPORTANT part is that the problem got discovered, so you can expect that the kernel, the config file parser and the video decoder (or the video driver if it's hardware accelerated) will get patched, sent upstream and then a wave of updates will be pushed to all the various distributions affected by said bugs.
The world will be a safer place AND THAT'S WHAT MATTERS for everyone.
Not only that, but thanks to the open nature of the whole stack (Linux kernel, rest of the ChromeOS distro, Chrome browser, or to be more precise the -ium variations of these), it's possible to scan the rest of the source to see if similar problems exist elsewere, maybe change policies or update tools to better detect such problems, inform the contributors of the affected slices of code... So a discovered exploit can even help making an even safier place.
There's no point in playing the blame game, when there are much more interesting things to do with the exploit.
Re:Linux or Chrome? (Score:5, Insightful)
Re:PinkiePie (Score:3, Insightful)
Appropriate too. Pinkie Pie has a reputation for breaking the fourth wall and using that as a readily available exploit. Normal reality and it's laws of physics simply don't apply.
Re:Linux or Chrome? (Score:5, Insightful)
Obvious troll article (Score:2, Insightful)
It's up to you who to blame. (Score:4, Insightful)
The blame falls to neither or both of them. It's completelly up to you.
If you are a Linux developer you want to make that sure it remains secure even if Chrome fucks up. If you are a Chrome developer, you want to make sure you have covered all your bases for all the different OS you are developing for. If you are a fanboy, you want to blame whatever product you aren't a fan of. If you are just a practical person, you care little about the blaming game and simply chose dependinig on which platform you are more invested in, Linux or Chorme.
PS: I still can't believe Google named its browser after an internal technology of Mozilla. Hell, I still can't believe MS named its VM after a TLD.