Google Chrome Pwned by VUPEN aka Sandbox/ASLR/DEP Bypass

Iron Forum for english speaking people

Post Reply
Huggz
Posts: 32
Joined: Tue May 03, 2011 4:18 pm

Google Chrome Pwned by VUPEN aka Sandbox/ASLR/DEP Bypass

Post by Huggz »

We are (un)happy to announce that we have officially Pwned Google Chrome and its sandbox.

The exploit shown in this video is one of the most sophisticated codes we have seen and created so far as it bypasses all security features including ASLR/DEP/Sandbox (and without exploiting a Windows kernel vulnerability), it is silent (no crash after executing the payload), it relies on undisclosed (0day) vulnerabilities discovered by VUPEN and it works on all Windows systems (32-bit and x64).

The video shows the exploit in action with Google Chrome v11.0.696.65 on Microsoft Windows 7 SP1 (x64). The user is tricked into visiting a specially crafted web page hosting the exploit which will execute various payloads to ultimately download the Calculator from a remote location and launch it outside the sandbox (at Medium integrity level).

While Chrome has one of the most secure sandboxes and has always survived the Pwn2Own contest during the last three years, we have now uncovered a reliable way to execute arbitrary code on any default installation of Chrome despite its sandbox, ASLR and DEP.

For security reasons, the exploit code and technical details of the underlying vulnerabilities will not be publicly disclosed. They are exclusively shared with our Government customers as part of our vulnerability research services.

Update: The exploit works on both Chrome versions 11.x and 12.x. It was tested with Chrome v11.0.696.65 and v12.0.742.30.

:ironvschrome
Video on youtube http://www.youtube.com/watch?v=c8cQ0yU8 ... r_embedded

http://www.vupen.com/demos/VUPEN_Pwning_Chrome.php
Freddie
Posts: 1
Joined: Fri May 13, 2011 10:50 am

Re: Google Chrome Pwned by VUPEN aka Sandbox/ASLR/DEP Bypass

Post by Freddie »

Does it work with UAC on? Does it work as LUA? Does it work while run inside Sandboxie?
User avatar
SRWare
Site Admin
Posts: 3247
Joined: Sat Jan 19, 2008 4:16 am

Re: Google Chrome Pwned by VUPEN aka Sandbox/ASLR/DEP Bypass

Post by SRWare »

Freddie wrote:Does it work with UAC on? Does it work as LUA? Does it work while run inside Sandboxie?
http://www.golem.de/1105/83469.html

Google tells that the sandbox was not cracked. VUPEN just found a bug in the integrated flash plugin.

Since Iron does not use this, you should be safe.
Iron-Updates via Twitter: http://twitter.com/srware

Donations via Paypal and Bitcoin:
http://iron-start.com/spenden.php
Nirose
Posts: 6
Joined: Fri Mar 25, 2011 2:32 am

Re: Google Chrome Pwned by VUPEN aka Sandbox/ASLR/DEP Bypass

Post by Nirose »

Another reason to drop Chrome and go with Iron. :ironvschrome
Huggz
Posts: 32
Joined: Tue May 03, 2011 4:18 pm

Re: Google Chrome Pwned by VUPEN aka Sandbox/ASLR/DEP Bypass

Post by Huggz »

If bypass of Chrome's sandbox indeed used a new Flash vulnerability in the browser, then it's both a Flash bug and a Chrome hack, says security researcher Dan Kaminksy.

The Google Chrome browser hack revealed this week could come down to a dispute over third-party software: A Google security expert says a zero-day flaw discovered by VUPEN Security researchers to bypass the browser's sandbox actually lies in Adobe Flash. But VUPEN isn't budging on its claims that its researchers successfully "owned" the browser software itself.
But for now, only VUPEN and its "three-letter" government agency customers know the details about the two zero-day vulnerabilities that VUPEN says it exploited and successfully used to bypass Chrome's sandbox and other security features.

"Nobody knows how we bypassed Google Chrome's sandbox except us and our customers, and any claim is a pure speculation," says Chaouki Bekrar, CEO and head of research at VUPEN. "We will not reveal the details on how we achieved the full compromise of Chrome and its sandbox. We can, however, say that we did use the default and built-in attack surface of the browser without using a Windows kernel vulnerability. All users of Chrome should be aware now that this browser can be fully hacked despite its famous sandbox and despite all the marketing that Google has been doing around its security."
Bekrar would neither confirm nor deny whether his firm found the bug in Chrome's Flash plug-in implementation, which comes with the browser. But he did say this when asked about it: "Google Chrome sandboxes all its default plug-ins; thus, exploiting a plug-in vulnerability is not enough to bypass the sandbox."

Google, meanwhile, is challenging VUPEN's claims of a bug in Chrome. Google security researcher Tavis Ormandy said in a Twitter post that "VUPEN misunderstood how sandboxing worked in chrome, and only had a flash bug."
A Google spokesperson said the Chrome team is still investigating VUPEN's claim that it hacked Chrome's famed sandbox feature. Chrome's sandbox, along with its use of Microsoft's DEP and ASLR technologies, thus far has made the browser relatively impenetrable to hackers. :ironvschrome
RWUK
Posts: 48
Joined: Sat Dec 18, 2010 11:53 pm

Re: Google Chrome Pwned by VUPEN aka Sandbox/ASLR/DEP Bypass

Post by RWUK »

Huggz wrote:.............
Do you have a link to where you got the text in your post?
SRWare wrote:VUPEN just found a bug in the integrated flash plugin.

Since Iron does not use this, you should be safe.
Can you please explain a little about the difference between Chrome's 'integrated flash plugin' and the flash plugin (Shockwave as my version says) that comes in Iron?
Post Reply