Feeds

Google offers $3.14159 MILLION in prizes for hacking Chrome OS

Third Pwnium contest offers hackers a piece of the pie

Next gen security for virtualised datacentres

Google has announced the target for its third Pwnium hacking contest, to be held at this year's CanSecWest security conference, with $3.14159m in prize money for the researchers who can successfully crack its Chrome OS operating system.

And yes, that figure is derived from the first six digits of π.

The contest, to be held on March 7, will see hackers trying to subvert the operating system on a base specification Samsung 550 Chromebook running Wi-Fi. Google is offering $110,000 for a browser or system level compromise delivered via a web page, and $150,000 if the crack survives a reboot of the system.

In order to claim the cash, researchers must provide Google with the full list of vulnerabilities used in the attack, along with any code used. Partial prizes will be offered for semi-successful hacks, at the Chocolate Factory's discretion.

"We believe these larger rewards reflect the additional challenge involved with tackling the security defenses of Chrome OS, compared to traditional operating systems," said Chris Evans of the Google Chrome security team in a post on the Chromium blog.

Google is already sponsoring the other hacking contest at the conference, Pwn2Own, and is putting its Chrome browser in the firing line with a $100,000 for a successful exploit – plus the laptop that the browser is successfully cracked on.

While the prize money for both contests has never been higher, it's still a very good deal for Google and others who are stumping up the cash. Time and again the security industry has found holes in commercial code that the writers never even dreamed of, and splashing out a few million is well worth it if Google can bolster its defenses further.

The company offered $1m for its first Pwnium contest, and upped that to $2m last year at the second competition at the Hack in the Box conference in Kuala Lumpur. But the Chocolate Factory is unlikely to pay out the full amount this time, since Chrome OS should prove more difficult to crack than Google's browser.

When Google launched the Chrome OS, it boasted that the operating system was the most secure on the market, saying the mix of hardware and software modules on the machines makes a lot of current attack techniques invalid.

That said, the research community has been known to pull some major surprises, and Google might face a bigger payday than it anticipates. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.