For Google’s bug bounty accountants, lightning just struck twice.
In September 2016, an anonymous hacker called Gzob Qq earned $100,000 (£75,000) for reporting a critical “persistent compromise” exploit of Google’s Chrome OS, used by Chromebooks.
Twelve months on and the same researcher was wired an identical pay out for reporting – yes! – a second critical persistent compromise of Google’s Chrome OS.
By this point you might think Google was regretting its 2014 boast that it could confidently double its maximum payout for Chrome OS hacks to $100,000 because “since we introduced the $50,000 reward, we haven’t had a successful submission.”
More likely, it wasn’t regretting it at all because isn’t being told about nasty vulnerabilities the whole point of bug bounties?
By Chromebook standards the latest issue is a biggie: an exploit chain comprising an impressive five CVE vulnerabilities that would allow an attacker to remotely pwn the system via a web page.
Rated as high severity, these are: an out of bounds memory access in Chrome’s V8 JavaScript engine (CVE-2017-15401), a privilege escalation in PageState (CVE-2017-15402), a command injection in network_diag (CVE-2017-15403), a symlink traversal in crash_reporter (CVE-2017-15404), and a symlink traversal in cryptohomed (CVE-2017-15405).
Anyone running the stable channel who turned on their Chromebook or Chromebox on or after 27 October would have received an automatic update to version 62.0.3202.74 (or later) so the issue can be fixed by nothing more taxing than a 10-second reboot.
That update, incidentally, also fixed another high-priority flaw, CVE-2017-15400, as well as cured the cascade of Wi-Fi vulnerabilities making up KRACK.
Which all goes to show that while the Chrome OS has suffered far fewer flaws than the “full service” Windows and Apple platforms it would like to supplant, it doesn’t suffer from no flaws at all.
And the number of flaws seems to be increasing as the platform gets more attention.
A few weeks back, the platform was caught by a critical vulnerability (CVE-2017-15361) found in Infineon Trusted Platform Modules (TPMs), rapidly fixed by an update. That issue also affected many PCs, but because Chromebooks use TPMs by design they were smack in the firing line.
Not to mention, there’s also been angst about the small but expanding number of mainly nuisance Chrome extensions – like cryptocurrency miners, adware and web redirectors – targeting the platform’s users from inside Google’s Web Store.
But let’s return to the notion that the bug bounty program is paying off for Google.
A turning point was the record $150,000 Google handed to “celebrity” hacker George Hotz for finding a clutch of high-severity ChromeOS flaws at Google’s Pwnium event held during CanSecWest 2014.
By the time Google turned Pwnium into a year-round bounty programme, lightbulbs lit up inside Google at the PR possibilities. Nowadays you can hardly move for the company’s bounty programmes.
There’s even one to pay people to tell Google about rogue apps inside its Play Store, something the company has been having trouble stopping on its own.
Bug bounties have come a long way since the days a decade ago when critics convinced themselves that offering money for flaws might result in a bidding war won by criminals which, of course, was going to happen anyway.
For Google and others, it’s become a cost-effective way to crowdsource vulnerabilities without having to employ expensive researchers to do it full time.
Google particularly likes bug bounties for Chrome OS because it draws attention to how easy (automated and rapid deployment, installation on mirrored partition) the whole patching and update cycle is on Chromebooks compared to Windows PCs.
Chromebooks aren’t invulnerable. But at least when flaws strike, it’s Google’s problem to worry about, not the users.
Matt
Nothing, literally nothing, in the InfoSec world says “I don’t know what I’m talking about” like using “pwn”. Except maybe claiming that you’re on the forefront of an industry that started a good decade before you claim.
Paul Ducklin
Tell that to the sponsors of competitions like PWN2OWN. And tell it to Google, who once ran their own PWNIUM competition for, errr, pwning Chromium.
Language is alive, my friend, and is allowed to acquire new words. Except “InfoSec”. That’s not a word. Not even the unkool kids capitalise that S.
(Here’s a thing. Did you know that egregious used to mean precisely the opposite of what it means today? It meant superlatively decent, not outrageously bad. So words can change their meaning too. That has nothing to do with information security, but then neither did your comment, and that got published.)
purescience2016
I always capitalize the ‘S’ in InfoSec. To do otherwise it’s ignorant. Anybody who programs should find it a natural thing to do. It’s a common, even standard practice to use this capitalization scheme when naming variables and these standards often translate over to the hacker community.
Paul Ducklin
Of course, this isn’t “the hacker community”, English isn’t a programming language, and we try to write in plain English anyway. So we would recommend simply saying “information security”. Non-programmers are sometimes more literate than you think and are often capable of understanding words even when they are written out in full.
PS. Do you habitually write eMail and TaxiCab, and do you consider it ignorant when people write them out all in lower case? Didn’t think so :-)
John E Dunn
Not to mention that using ‘own’ instead gets you exactly the same response.
Paul Ducklin
I just checked my trusty Oxford Dictionary of English, and its cousin the New Oxford American Dictionary, and…guess what? Pwn is right there. It’s tagged as “informal” but is officially defined as “utterly defeat” or “completely get the better of”. And it’s officially pronounced to rhyme with, well, with “own”.
Mark Stockley
In the dictionary, under pwned, it says “see this thread”.
Bond
😁
John E Dunn
“Except maybe claiming that you’re on the forefront of an industry that started a good decade before you claim.”
Which I didn’t say. But I stand by the worry bit – If the wider tech industry had been worried about cybersecurity in 2003, we might be living in a different world.
SteveC#
Now if they could do this properly for the Android OS.
Bob Stromberg
I’ve always been puzzled by the assertion that Chromebooks update themselves automatically. My wife’s Chromebook (a Google Pixel from 2013) does not do so. Once a week or so, I check what is on Windows called the Notifications Area and look at the shutdown icon. If it indicates a reboot is needed, I reboot. If not, I leave it running. I just checked Chrome OS’s “notifications” to see if somehow I had turned off notifications for updates requiring a reboot, and did not find such a thing.
If anybody can clarify, I’d appreciate it.