Hack Chromebook In Guest Mode, Win $100,000

An anonymous reader writes: Google has once again upped the ante for bug hunters concentrating on Chrome, and is now offering $100,000 to anyone capable of achieving a compromise of a Chromebook or Chromebox (the desktop variant of the Chromebook laptop) with device persistence in guest mode (i.e. guest to guest persistence with interim reboot, delivered via a web page). From Google's Monday announcement: Last year we introduced a $50,000 reward for the persistent compromise of a Chromebook in guest mode. Since we introduced the $50,000 reward, we haven't had a successful submission. That said, great research deserves great awards, so we're putting up a standing six-figure sum, available all year round with no quotas and no maximum reward pool.

Manages high security

[Chrisq]

Manages high security by being very limited. Don't get me wrong, if all you want is a portable machine with a browser then it's great.

Re:

[mwvdlee]

In other words; a perfect match for the 50% (rounding down) of humans that are pretty much computer-illiterate.

Re:

[LichtSpektren]

Nowadays there's a web app version of almost everything. A thin client can do a lot of 2016. When you consider the fact that 90% of the human race just wants to use social media, write emails, shop and watch videos, it's not a bad sell.

Re:

[Scarred Intellect]

What?! You mean there's more to the internet than that!? Outrageous! Nobody ever told me that! Where is this mythical world you speak of? Do I search for it in the Facebook search box, or the YouTube one?

Re:

[infolation]

90% of the human race just wants to use social media, write emails, shop and watch cat videos

FTFY

I was surprised it did EVERYTHING my wife wanted

[raymorris]

My wife got a Chromebook to augment / replace her Linux desktop. I set the Chromebook up to boot Ubuntu, but we went ahead and booted ChromeOS once just to check it out. I was surprised to find she never had any reason to boot into Ubuntu. ChromeOS does everything she wants to do with her computer and it's fast.

Most recently, she's been job hunting. She looks for job on the web, edits her resume in Google Docs, fills out pdf forms, all on ChromeOS. It actually does 90% of what I use my computer for too - em

Re:

[110010001000]

As an added bonus, Google Inc now has a full profile of your and your wife's life. They know she has been looking for a job, everything. And you only had to pay hundreds of dollars for the privilege. So it is a win/win.

Re:

[Shawn Willden]

Nowadays there's a web app version of almost everything. A thin client can do a lot of 2016. When you consider the fact that 90% of the human race just wants to use social media, write emails, shop and watch videos, it's not a bad sell.

Or write documents, build spreadsheets, make presentations, etc. Chromebooks are quite good for the sort of productivity work most people do. I have the option of getting a Pixel2 for work, and it would meet 100% of my work needs, including writing code[*]. Honestly, the only reason I have a Macbook is because I also use it for personal photo and video editing. Oh, and I prefer a local app for tracking my personal finances. I think there are some perfectly adequate online financial management programs, but

Re:

[Ed Tice]

And a limited machine means they can spend more time doing this and less time maintaining the thing. A car is limited compared to an 18 wheeler, too.

Re:

[LichtSpektren]

I've got a great idea for another contest. The Slashdot headline for the submission about it could be, "Use Chromebook Productively, Win $100,000".

As that title states, if somebody can manage to do something even slightly productive (sorry, browsing Facebook doesn't count!) using a Chromebook, they'd get $100,000.

To be honest, I think there's a greater likelihood of a payout in this security challenge than there would be in that productivity challenge.

I'd imagine many reporters, secretaries, actors, interpreters/translators, librarians, web developers, etc. could get by just fine with a browser.

Re:

[IRGlover]

I'll take cash or a cheque, AC. I've written the bulk of numerous research papers, teaching materials and other learning resources on a Chromebook using Google Drive. Great tools for collaboratively writing materials, before exporting the content for some polishing up in a different piece of software.

Re:

[0100010001010011]

Heck I do a good 80% of my Python development through a Jupyter Notebook hosted on one of the other machines in my house. I could get by just fine with a browser and ssh client.

Re:

[Ed Tice]

A limited, functioning machine is better than an unlimited non-functioning machine. You can get many things done with a browser. The point of having a secure guest mode is that you can safely let other people use your device. Also makes it better for setting up things like kiosks.

Re:

[Luthair]

Presumably the persistent compromise would affect any logged in user.

Re:

[Ed Tice]

Which is really the point. Is it safe to let somebody use your device in guest mode? Can you trust the device afterward. And, of course, kiosks. If you can reboot to a known state they would be way easier to maintain. There's a whole cottage industry out there of reimaging devices still.

Re:

[softnewsit]

Root access from guest mode.... what else....

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[LichtSpektren]

question: can you hack a hardened, underpowered Linux workstation without root access. response: no one hacks an OS anymore, they bolt-on worms, social engineering, flash zero-days and javascript bypasses to steal your credit cards and dick pics.

That's nice, but you get $100k if you can hack the OS.

Re:

[pz]

Punctuation: it's your friend.

Re:

[fibonacci8]

I highly doubt he and punctuation are even on speaking terms after that post.

Re:

[macs4all]

Punctuation: it's your friend.

Capitalization: It's your friend.

GhostShell

[Scarred Intellect]

I found a job for GhostShell [slashdot.org]!

Nice to see Google pushing this

[sasparillascott]

Chrome is getting alot more popular with users and schools in particular, its nice to see them pushing on the security like this - up to this point it probably hasn't been worth the time of someone to compromise it (from a marketshare standpoint), but that day is coming. It's good Google is trying to stay ahead of that.