Google Chrome Pwned by VUPEN aka Sandbox/ASLR/DEP Bypass

Google Chrome Pwned by VUPEN aka Sandbox/ASLR/DEP Bypass

www.vupen.com

We are (un)happy to announce that we have officially Pwned Google Chrome and its sandbox.

The exploit shown in this video is one of the most sophisticated codes we have seen and created so far as it bypasses all security features including ASLR/DEP/Sandbox (and without exploiting a Windows kernel vulnerability), it is silent (no crash after executing the payload), it relies on undisclosed (0day) vulnerabilities discovered by VUPEN and it works on all Windows systems (32-bit and x64).....

......For security reasons, the exploit code and technical details of the underlying vulnerabilities

(visit the link for the full news article)

If you're not using windows, (and google chrome) you're ok.
But if you are using windows with google chrome, you may want to think about going back to Firefox as your browser.

What I find most troubling.. is not the exploit itself..
but the last comment made..

"For security reasons, the exploit code and technical details of the underlying vulnerabilities will not be publicly disclosed. They are exclusively shared with our Government customers as part of our vulnerability research services."

ummmm, what?
So you won't share with anyone but the Govt? lol
Why do they need to know the technicalities of this exploit? O_o

Anyway, Be safe...
The govt. now knows how to exploit windows machines using google chrome as their browser.

Lame.

Glad I don't use windows.

www.vupen.com
(visit the link for the full news article)

Video:This video shows a sophisticated 0-Day exploit created by VUPEN to execute arbitrary code on Google Chrome bypassing its sandbox, ASLR and DEP.

IMO, they've been able to this for quite some time now, they are just finally getting around to telling us common folk. I'm using Chrome right now, and don't plan on changing, not out of ignorance, but out of the belief that whether or not they admit it, they can exploit any browser on any operating system. Chrome, firefox, safari, IE, its all just a bunch of code and script that can be manipulated by those that know how.

Hackers who help any gov are lame and should be hacked out of existence. Original hacking was about freedom of information. Not helping big bro exploit us. They should release the information to everyone like every other hacker would do. Bunch of gov script kids.

reply to post by raiders247


Well I don't *fully* disagree, but that's not quite the point.
Just because there is good probability that someone, somewhere, somehow, could exploit and compromise ones system..
Doesn't mean they just accept it, and give whoever it is, an even easier time.
and you can bet.... that it will get into other hands... not just govt.. (if it hasn't already).
So, Everyone is going to do what they feel is best, and that's cool.
I'm just sharing what I find,
whoever wants the info, cool,
whoever doesn't, also cool.
Thanks for the post.

Originally posted by Chesster
Hackers who help any gov are lame and should be hacked out of existence. Original hacking was about freedom of information. Not helping big bro exploit us. They should release the information to everyone like every other hacker would do. Bunch of gov script kids.

lol, Can't disagree with you.
well... as incompetent as these fools are..
Someone will probably steal it from them (or buy it from them) soon anyway. lol

Thanks for the post.

Originally posted by Ahmose
If you're not using windows, (and google chrome) you're ok.
But if you are using windows with google chrome, you may want to think about going back to Firefox as your browser.

That's a little scary.

I thought about trying Chrome with windows, however, I ran across an article explaining that installing Chrome actually modified the Windows OS kernel. Firefox definitely doesn't do that, and I thought it odd that an application should need to modify the OS kernel. I don't know the reason, maybe it was to make Chrome faster or something, but I was concerned about security vulnerabilities with Chrome, so I decided to stick with Firefox. After reading your thread, now I'm glad I did!

Apparently, they are under government contract to analyze and report on vulnerabilities that can impact government information systems and the private computers of government employees that can, by proxy lead to a compromise of government information systems.

Government and military institutions are lagging network and information technology horribly. Working with communications gear in the military is like working at a museum of electronics. It's about the same with computers in use by the military - and even worse in non-defense government services.

They are really doing all they can just to try and stay abreast of changes and security threats.

Though most issues in government and military are classic in nature - disgruntled employees walk out of the building with a laptop or a key-ring full of flash drives that contain invaluable records of persons, addresses, and other information that is sold on the black market for more than most people will make in a lifetime.

That said - computers are not magic boxes and hackers are not magicians. A combination of solidly-written programs/code and common sense on the part of users can go a very long way in protecting one's self from malicious and unwanted code.

Sure - any time data is sent from one computer to another and placed into RAM, it is theoretically possible for it to be run without the user's consent. Fortunately - software and hardware developers get big business deals by being able to demonstrate their ability to develop systems that are resistant to various 'low-level' exploits of the hardware and higher level exploits of software/operating system. Surprisingly, businesses - like banks and corporate offices - want to purchase systems that are difficult to hack into.

In this case - Google apparently dropped the ball pretty hard. That's something you've got to watch out for when working as a team of programmers. You can accomplish far more in far less time than a single programmer, but you're also more likely to run into this type of issue - errors/stability issues as well as code exploits.

Last i knew, "Vupen" was a "white hat" security company.

Yet, they aren't letting google in on specifics?

"We'll just keep it secret, other than telling the govt."

Doesn't seem very "white-hat" to me...
You?

Unless my understanding of "white-hat" is entirely skewed..
Which i don't believe it is... lol

Weird.

reply to post by Aim64C


Good post Aim64C.
Thanks for adding it.

reply to post by Ahmose


I will keep using Chrome for two reasons:

1:

While Chrome has one of the most secure sandboxes and has always survived the Pwn2Own contest during the last three years

This doesn't sound like a consistently bad product with a poor security history to me.

2: I trust Google to do what it does. What it does is attempt to take over and run the cloud. It can't do that if it doesn't have impeccable security. They know this and I have no doubt it will be fixed in the next upgrade.

This is just how these things work. Problems are found, problems are fixed. No programmer is god (Though many would argue the fact) and can't foresee every single potential issue. It is how they respond to a found vulnerability and how hard it was to find that vulnerability that matter.

Besides I am willing to take a little risk for performance. I'm a sports car guy, not a Volvo guy.

reply to post by Arbitrageur




The only real reason Ive used Chromium browser for the past year or so was because it was soo much faster than FF, even though FF is the best, in my opinion.

However, Since FireFox 4 was released not long ago..
It is very nice, and much faster!
It can actually keep up with Chrome/Chromium now, So that's what I've been using the past couple weeks.

I never liked switching from FF to something from google..
But it was just soo much faster, I couldn't help it. lol
Now I think I can go back to using the browser whose philosophies i most "resonate" with..

Have you upgraded to FF4 yet?

Thanks for the post.

reply to post by Jinglelord


lol, Again, No disagreement from me.
(other than I do not "trust" google fully)

But that is the same reason Ive been using Chrom(ium) for the past year.. It's great performance.
But FF4 has really done great in the performance dept! I'm starting to like using Firefox again. lol
(See previous post.).

reply to post by Ahmose


I used FF until I tried Chrome and never looked back because of the overwhelming speed. I have to use IE proprietary applications and just cringe the patience test I'm about to get.

I'll try FF4 since it sounds like they got speedy again. Thanks for the tip!

Back to the subject: I really don't think we will ever get 100% security on the net and if security is an overwhelming concern there we always have the Symantecs and McAfees of the world to put a huge slow tank over everything we do.

Since VUPEN has become a bit of a topic in this thread and has roused the wearing of tin-foil hats:

www.vupen.com...

Here is also another interesting article:

www.zdnet.com...

February 2, 2011, 2:55pm PST

Google is offering a $20,000 cash prize for any hacker who can successfully compromise a Windows 7 machine via a vulnerability — and sandbox escape — in its Chrome web browser.

The prize is part of this year’s CanSecWest Pwn2Own contest, which will pit some of the world’s best security researchers and exploit writers against popular web browsers and mobile devices. During last year’s contest, Google Chrome was the only browser left standing but with the enhanced cash prize — and publicity that goes along with a successful Chrome netbook hack — there is a strong likelihood that someone will take aim at Chrome this year.

Puts this in a little better perspective.

www.zdnet.com...

VUPEN released a video of the exploit in action to demonstrate a drive-by download attack that successfully launches the calculator app without any user action.

The exploit shown in this video is one of the most sophisticated codes we have seen and created so far as it bypasses all security features including ASLR/DEP/Sandbox (and without exploiting a Windows kernel vulnerability), it is silent (no crash after executing the payload), it relies on undisclosed (0day) vulnerabilities discovered by VUPEN and it works on all Windows systems (32-bit and x64).

VUPEN, which sells vulnerability and exploit information to business and government customers, does not plan to provide technical details of the attack to anyone, including Google.

VUPEN made headlines in March this year when a team of its researchers hacked into Apple’s MacBook via a Safari vulnerability to win the CanSecWest PWN2Own contest.

Hmm... perhaps I gave them a bit too much lee-way when I said they were under government contract.

It's their business to be able to infiltrate systems for a customer. Sort of a mercenary-hacker business. Certainly the new face of corporate espionage - possibly even sabotage. Shadowrun, anyone?

Originally posted by Ahmose
Have you upgraded to FF4 yet?

Thanks for the post.

reply to post by Ahmose


I never use Chrome and don't use my Comodo Dragon very often, but do we know if Dragon has this same vulnerability since is based on chrome?

Would appreciate knowing if Comodo has addressed this or not.

No love for Opera?

I have to admit that Chrome is fast, and I'm using it right now.
I'm usually alternate between Opera and Chrome but, I guess I'll be going back to Opera.

DEP was suppost to be a HARDWARE prevention of the CPU executing statements in memory flagged as DATA ONLY.

Guess either the hardware failed or the memory was not actually flagged as DATA ONLY.

As for ASLR, there to prevent buffer overrunning into another implanted instruction into the next addresses (which should also fail with DEP enabled).

So all this hardware protection, failed.

Originally posted by Amaryllis
No love for Opera?

I have to admit that Chrome is fast, and I'm using it right now.
I'm usually alternate between Opera and Chrome but, I guess I'll be going back to Opera.

Opera's nice, but it starts to use toooo much memory and ends up crashing.

My computer isn't that old and doesn't have any viruses either.