Feeds

Google offers $3.14159 MILLION in prizes for hacking Chrome OS

Third Pwnium contest offers hackers a piece of the pie

Beginner's guide to SSL certificates

Google has announced the target for its third Pwnium hacking contest, to be held at this year's CanSecWest security conference, with $3.14159m in prize money for the researchers who can successfully crack its Chrome OS operating system.

And yes, that figure is derived from the first six digits of π.

The contest, to be held on March 7, will see hackers trying to subvert the operating system on a base specification Samsung 550 Chromebook running Wi-Fi. Google is offering $110,000 for a browser or system level compromise delivered via a web page, and $150,000 if the crack survives a reboot of the system.

In order to claim the cash, researchers must provide Google with the full list of vulnerabilities used in the attack, along with any code used. Partial prizes will be offered for semi-successful hacks, at the Chocolate Factory's discretion.

"We believe these larger rewards reflect the additional challenge involved with tackling the security defenses of Chrome OS, compared to traditional operating systems," said Chris Evans of the Google Chrome security team in a post on the Chromium blog.

Google is already sponsoring the other hacking contest at the conference, Pwn2Own, and is putting its Chrome browser in the firing line with a $100,000 for a successful exploit – plus the laptop that the browser is successfully cracked on.

While the prize money for both contests has never been higher, it's still a very good deal for Google and others who are stumping up the cash. Time and again the security industry has found holes in commercial code that the writers never even dreamed of, and splashing out a few million is well worth it if Google can bolster its defenses further.

The company offered $1m for its first Pwnium contest, and upped that to $2m last year at the second competition at the Hack in the Box conference in Kuala Lumpur. But the Chocolate Factory is unlikely to pay out the full amount this time, since Chrome OS should prove more difficult to crack than Google's browser.

When Google launched the Chrome OS, it boasted that the operating system was the most secure on the market, saying the mix of hardware and software modules on the machines makes a lot of current attack techniques invalid.

That said, the research community has been known to pull some major surprises, and Google might face a bigger payday than it anticipates. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.