Teen Wins Google Chrome Hack Contest

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
I'll bet Google responds to his job application this time.

Just hours before the end of Google’s $1 million hack challenge, a teenager who once applied to work at Google without getting a response, hacked the company’s Chrome browser using three zero-day vulnerabilities, one of which allowed him to escape the browser’s security sandbox.
Click to expand...
 
Cool for him, and Chrome users. If they hadn't offered the money it might've been a bug for who-knows-how-long, right?
 
Sometimes that's just what it takes to secure a quality and good paying job! Congrats to him or to Pinkie Pie!
 
Eisenblut said:
Yes, because there are absolutely no zero-day exploits lurking in any other browser.
Click to expand...

Well yeah there is exploits in other browsers it's stupid comment actually. I just dislike chrome for the way it's setup.

The best sandbox you can have is probably a VM. I'd like to see a VM exploit exploit the host.
 
pclov3r said:
Well yeah there is exploits in other browsers it's stupid comment actually. I just dislike chrome for the way it's setup.
Click to expand...
So, you dislike it for reasons not related to the reason that you stated was the reason why you do not use it. Completely irrelevant reasons, actually. Bravo.
 
pclov3r said:
The best sandbox you can have is probably a VM. I'd like to see a VM exploit exploit the host.
Click to expand...
Actually, there are some exploits for that too.

And I don't see what kind of security it would bring. More isolation? Yes, but you will want to save or upload files with your browser, so you need some kind of access. And the juicy stuff (stealing passwords, cookies, or simply running a botnet) will still be possible in that VM.

At least the Chrome sandbox tries to isolate processes and limit their interaction without bothering the user. Of course, it doesn't really work, and I hope the Chrome developers will some day grow up and understand a sandbox isn't everything.

Chrome is still a joke, anyway: https://code.google.com/p/chromium/issues/detail?id=41467
 
I bet they don't respond to his app. It takes more than a single skill to be successful. A young teenager in that work environment could be toxic and he probably doesn't have the soft skills required.
 
Huh? He didn't want to be identified because his employer hadn't authorized the activity...??

Was he hacking Chrome while on his lunch breaks? Is he someones slave? This excuse makes no sense.
 
Azhar said:
After getting a cool million, I'm going to pay off my car and house and do nothing for a couple years. :-P

Google can keep trying to hire me if they want, but I'll be too busy doing nothing.
Click to expand...

After taxes a million doesn't go as far as it used to. A million dollars puts you into the tax rates of the evil rich, so depending on what state you live in, your overall tax rate (fed/state/local) could be around 50% or more.
 
He's in the running for 60K, the million dollars is that total prize purse.

As far as browser security goes, from what I've seen Chrome is one of the strong contenders, I'll stick with it.
 
He probably just doesn't want the attention he might get from the government if he's a well known hacker.
 
PaperclipGod said:
Huh? He didn't want to be identified because his employer hadn't authorized the activity...??

Was he hacking Chrome while on his lunch breaks? Is he someones slave? This excuse makes no sense.
Click to expand...

Some employers lay claim to all IP you produce during your contract for employment. Such as some video game studios. So yea, it does make sense.
 
nutzo said:
After taxes a million doesn't go as far as it used to. A million dollars puts you into the tax rates of the evil rich, so depending on what state you live in, your overall tax rate (fed/state/local) could be around 50% or more.
Click to expand...

Still, $500,000 is about 6.5 years of income to me :-P
 
Azhar said:
Still, $500,000 is about 6.5 years of income to me :-P
Click to expand...

But not enough to retire on when you are still young. Of course if he only gets $60K, that might be enough to pay for half his college.

I laugh when I hear a lottery winner telling everyone they are going to buy a house, a new car, thier mother a new house, etc, when they won less than $1,000,000. Even if they have enough after taxes to buy all this, they will have spent everything, and still have to come up with living expense, property tax, etc every year.


Quote: "Roughly one-third of lottery winners find themselves in serious financial trouble or bankrupt within five years of turning in their lucky numbers, according to Chelmsford wealth counselor Szifra Birke."
 
nutzo said:
Quote: "Roughly one-third of lottery winners find themselves in serious financial trouble or bankrupt within five years of turning in their lucky numbers, according to Chelmsford wealth counselor Szifra Birke."
Click to expand...

Most likely because anyone with any real financial sense doesn't play the lotto. :D
 
nutzo said:
But not enough to retire on when you are still young. Of course if he only gets $60K, that might be enough to pay for half his college.

I laugh when I hear a lottery winner telling everyone they are going to buy a house, a new car, thier mother a new house, etc, when they won less than $1,000,000. Even if they have enough after taxes to buy all this, they will have spent everything, and still have to come up with living expense, property tax, etc every year.


Quote: "Roughly one-third of lottery winners find themselves in serious financial trouble or bankrupt within five years of turning in their lucky numbers, according to Chelmsford wealth counselor Szifra Birke."
Click to expand...

I'm 39 and long done with college - paid off too. My income is in the 80k bracket, hence the 6.5 years approximation.

I'm not talking retirement. I'm talking a nice long vacation. I'm tired.
 
Hmm 500k. Pay off house, plus do the upgrades we've always wanted. New cars for the Mrs and myself. Some kind of luxury vacation for 2 weeks... like rent a Carribean island for 2 weeks. Then back to work and the remaining 300k goes in the retirement fund. Oh I suppose I'd have to throw 50k to help Mom with her debt and a new car. OK, 250 into the retirement fund.

Ok time for me to put the crack pipe away...

The thing about the lottery winners screwing themselves over financially likely had no financial sense to start with. You don't talk about job quitting money unless it's over 3 million after taxes. And even then you're investing almost all of that to try to live off the interest. Damn crack pipe, go away....
 
pankkake said:
And I don't see what kind of security it would bring. More isolation? Yes, but you will want to save or upload files with your browser, so you need some kind of access. And the juicy stuff (stealing passwords, cookies, or simply running a botnet) will still be possible in that VM.
Click to expand...

A VM wouldn't necessarily offer more isolation. Sandboxed processes are pretty much locked down full stop. The escapes here are by bouncing off of things like the download manager and stuff - a VM wouldn't save you from that just like a sandbox doesn't because the problem is in the communication channel you added, not the sandbox itself.

At least the Chrome sandbox tries to isolate processes and limit their interaction without bothering the user. Of course, it doesn't really work, and I hope the Chrome developers will some day grow up and understand a sandbox isn't everything.
Click to expand...

But it does work, quite well in fact. But the biggest reason to use it is because WebKit isn't thread safe. If you don't want one tab to block all your other tabs you have to use processes, there isn't any other way with WebKit. That's why WebKit themselves have started adding a multi-process architecture called WebKit2 (terrible name - it doesn't replace webkit, it's a layer on top of webkit). The newest version of Safari uses it. Although in typical Apple fashion they couldn't re-use Chrome's model and instead had to make their own - which took forever and slowed down development of WebKit.
 
Skripka said:
Some employers lay claim to all IP you produce during your contract for employment. Such as some video game studios. So yea, it does make sense.
Click to expand...

Yup. For all the stupid rules California has, this is something they got right. Some states (like CA) say that practice is not allowed. If you create something on your own time using no company property, the company can't make any claim whatsoever on owning it. The fact that that is allowed in other states is just ridiculous. Surprisingly it looks like only 7 states have such laws ( http://answers.onstartups.com/quest...lectual-property-rights-to-the-st/20126#20126 )

Of course, the real solution is to just get rid of this ridiculously stupid notion of "IP" in the first place. If you recognize that software patents are actually *idea* patents, and ideas can't be patentable or owned, then you solve this whole mess.
 
Azhar said:
Still, $500,000 is about 6.5 years of income to me :-P
Click to expand...

$500K...Hmmm, pay off house, buy new cars, pay kids college fund and then its back to work on Monday. Doesn't go far in today's world.
 
I wonder if he's with in the ranks of [H] forums? So which one of you guy is the hacker :cool:
 
Thug Esquire said:
Lmao, well-trolled.
Click to expand...

Actually, the impetus behind trolling is carefully-crafted, believable deception of your audience which draws them further and deeper into a given altercation. Given the inherently shallow nature of this assertion -- suggesting that a product created of a group of human beings is necessarily infallible -- it is clearly not "trolling" (itself an inherently meaningless, memetic neologism), but rather, the inadequate aspersions cast off by a puerile, undeveloped mind.

Your predisposition towards others in that you seemingly readily laud them with praise upon having manufactured a statement which you feel adheres to the criteria of a particular social phenomenon is quite telling: you employ no conscious thought processes. You are merely a product of your environment, the collected responses to a variety of external stimuli.

You are a component. Back to the machine, cog.
 
precariousgray said:
Actually, the impetus behind trolling is carefully-crafted, believable deception of your audience which draws them further and deeper into a given altercation. Given the inherently shallow nature of this assertion -- suggesting that a product created of a group of human beings is necessarily infallible -- it is clearly not "trolling" (itself an inherently meaningless, memetic neologism), but rather, the inadequate aspersions cast off by a puerile, undeveloped mind.

Your predisposition towards others in that you seemingly readily laud them with praise upon having manufactured a statement which you feel adheres to the criteria of a particular social phenomenon is quite telling: you employ no conscious thought processes. You are merely a product of your environment, the collected responses to a variety of external stimuli.

You are a component. Back to the machine, cog.
Click to expand...

http://files.sharenator.com/buzz_killington_191x300_re_so_troll-s191x300-152037-580.jpg

Yup, this seems about right.
 
BBA said:
$500K...Hmmm, pay off house, buy new cars, pay kids college fund and then its back to work on Monday. Doesn't go far in today's world.
Click to expand...

$500,000 is a hell of a lot more than what the average American make in several years. If you can't budget $500,000 in 5 or 6 years then you have spending issues, today's world notwithstanding.
 
BBA said:
$500K...Hmmm, pay off house, buy new cars, pay kids college fund and then its back to work on Monday. Doesn't go far in today's world.
Click to expand...

I could make 500K work well for 3-4 years of no employment. Foreclosed home for 120K, 1 new car for 30K, college fund? 25K each at most, I never even had money for college, my kids better get aid/scholarships and then work off any left over loans.

Sometimes I wish I stayed in the hacking business when I was younger but I mysteriously ended up in graphics design and networking. Bah!
 
Azhar said:
$500,000 is a hell of a lot more than what the average American make in several years. If you can't budget $500,000 in 5 or 6 years then you have spending issues, today's world notwithstanding.
Click to expand...

Well, he did say things like paying off a house. You could make payments over 5-6 years, sure, but if you suddenly find yourself with a huge chunk of money it's in your best interest to pay it off asap to avoid interest. And college is expensive.

NickJames said:
Sometimes I wish I stayed in the hacking business when I was younger but I mysteriously ended up in graphics design and networking. Bah!
Click to expand...

Well, you're talking about $500k when the guy is only getting $60k before taxes.
 
kllrnohj said:
Well, he did say things like paying off a house. You could make payments over 5-6 years, sure, but if you suddenly find yourself with a huge chunk of money it's in your best interest to pay it off asap to avoid interest. And college is expensive.



Well, you're talking about $500k when the guy is only getting $60k before taxes.
Click to expand...

Well my house is about $150,000 (owe about $100k left) and I owe about $11,500 on my car, so that leaves me with $388,500. So that's 4.9 years of normal income after everything's paid up.

So I think 3 years is a healthy estimate of being able to take a vacation before finding work again. Granted, when you're home more, your utility bills will be higher :-P
 
You must log in or register to reply here.
Back
Top