Chrome OS /sbin/crash_reporter Symlink Traversal

Chrome OS: symlink traversal issue in /sbin/crashreporter Tested on: Version 69.0.3473.0 Official Build dev 64-bit CreateDirectoryWithSettings in https://chromium.googlesource.com/chromiumos/platform2/+/master/crash-reporter/crashcollector.cc107 is executed by /sbin/crashreporter every time a...

Crouton - Chromium OS Universal Chroot Environment

crouton is a set of scripts that bundle up into an easy-to-use, Chromium OS-centric chroot generator. Currently Ubuntu and Debian are supported using debootstrap behind the scenes, but "Chromium OS Debian, Ubuntu, and Probably Other Distros Eventually Chroot Environment" doesn't acronymize as wel...

Google Pwnium 4 to Offer $2.7M in Prizes at CanSecWest

Building on the success of the last couple of years, Google plans to offer more than $2.7 million in potential rewards in the next iteration of its Pwnium hacking competition at this year’s CanSecWest conference in Vancouver. The company has run the contest in parallel with the older Pwn2Own...

Default Password (facepunch) for 'chronos' Account

The account 'chronos' on the remote host has the password 'facepunch'. An attacker may leverage this issue to gain access to the affected system. Note that some builds of Chromium OS are known to use these credentials and allow one to gain root access with 'sudo'. %NASLMINLEVEL 70300 C Tenable...

Mozilla Code *sighs*

Mozilla Code sighs I reported a memory corruption vulnerability in Mozilla Codesighs, a "set of tools to help you determine the code and data size of shared libraries and executables. Once you can measure the code and data size, then you can measure drifts in size as code changes occur". Mozilla...

On Google Chromium OS, Microsoft Finding Flaws in Chrome and the Adobe Flash Controversy

Dennis Fisher and Ryan Naraine discuss the security bits of the Google Chromium OS, Microsoft finding a flaw in Google Chrome Frame, the Adobe Flash controversy and the ridiculous end to the France v. Ireland World Cup qualifier. SHOW NOTES Inside The Google Chrome OS Security Model Microsoft Fin...