GOOGLE OFFERING REWARD FOR CHROME HACK

Google is offering a $20,000 cash prize for any would-be hacker that can successfully exploit the Cr-48 Chrome laptop via a vulnerability and sandbox escape (using the Chrome web browser).

This is all part of CanSecWest’s Pwn2Own competition, which sees some of the world’s best security researchers and hackers go up against popular web browsers in attempt to thwart their security.

The successful hack must include a sandbox escape. Kernel bugs and other 3rd party plug-ins are also not allowed (other than the default built-in PDF support).

Last year Google boasted that its Chrome browser was the only one left standing after a barrage of hacking attempts failed, but with an added cash prize up for grabs this year there will certainly be a frenzy of activity around the browser.

GOOGLE TO PAY CASH REWARDS FOR BUGS

Google has decided to start offering more cash rewards for all the bug hunters out there.

Although a reward program has been in place for the Chromium open source project since January, Google has now decided to expand the scheme to include its other web properties. Those properties include:

*.google.com
*.youtube.com
*.blogger.com
*.orkut.com
If you’re wondering what bugs are worthy of a reward Google is keeping things very open by stating:

Any serious bug which directly affects the confidentiality or integrity of user data may be in scope.

You won’t earn cash for any of the following, though:

attacks against Google’s corporate infrastructure
social engineering and physical attacks
denial of service bugs
non-web application vulnerabilities, including vulnerabilities in client applications
SEO blackhat techniques
vulnerabilities in Google-branded websites hosted by third parties
bugs in technologies recently acquired by Google
As to how much you can earn, the rewards are substantial if you report regularly or hit a goldmine of bugs Google will payout multiple times for. The guidelines are as follows:

The base reward for qualifying bugs is $500. If the rewards panel finds a particular bug to be severe or unusually clever, rewards of up to $3,133.7 may be issued. The panel may also decide a single report actually constitutes multiple bugs requiring reward, or that multiple reports constitute only a single reward.

Anyone deciding to give their reward to charity will see the amount matched by Google. [Geek]