Last year, VUPEN released a video to demonstrate a successful sandbox escape against Chrome but Google challenged the validity of that hack, claiming it exploited third-party code, believed to be the Adobe Flash plugin. 'Our exploit worked against the default installation so it really doesn't matter if it's third-party code anyway.' 'It was a use-after-free vulnerability in the default installation of Chrome,' he said.

A security sandbox lets you observe and analyze threats in an isolated and safe environment. For some types of malware or vulnerabilities (e.g., APT), direct human interaction during analysis is required. The first one was to bypass DEP and ASLR on Windows and a second one to break out of the Chrome sandbox.'īekrar declined to say if any of the exploits targeted third-party code in the browser. A web browser sandbox lets you run browser applications in isolated environments, to block browser-based malware from spreading to the network. Innovative cloud-based sandbox with full interactive access It is not enough to run a suspicious file on a testing system to be sure in its safety. In an interview, Bekrar said his team worked for about six weeks to find the vulnerabilities and write the exploits. As part of the new competition format, VUPEN will earn 32 points for the successful Chrome exploit. Make sure that the browser that you are using to work with the Sandbox web interface does not modify the Referrer header of an HTTP POST request.

VUPEN co-founder and head of research Chaouki Bekrar and his team used a pair of zero-day vulnerabilities to take complete control of a fully patched 64-bit Windows 7 (SP1) machine.

Browser sandbox