Slashdot Log In
Next Pwn2Own Contest Targets IE8, Firefox, iPhone
Posted by
timothy
on Wed Feb 11, 2009 05:43 PM
from the better-there-than-in-the-wild dept.
from the better-there-than-in-the-wild dept.
Windows Secrets writes "After two straight years of taking dead aim at Macbooks and Windows-powered machines, hackers at this year's CanSecWest conference will have shiny new targets: Web browsers and mobile phones. According to CanSecWest organisers, there will be two separate Pwn2Own competitions this year — one pitting hackers against IE8, Firefox 3 and Safari and another targeting Google Android, Apple iPhone, Nokia Symbian and Windows Mobile."
Related Stories
Submission: Pwn2Own contest targets IE8, Firefox, iPhone by Anonymous Coward
[+]
First Pwn2Own 2009 Contest Winners Emerge 98 comments
mellowdonkey writes "Last year's CanSecWest hacking contest winner, Charlie Miller, does it again this year in the 2009 Pwn2Own contest. Charlie was the first to compromise Safari this year to win a brand spankin new Macbook. Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well. Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program."
[+]
Mobile: All Five Smartphones Survive Pwn2Own Contest 144 comments
CWmike writes "Although three of the four browsers that were targets in the PWN2OWN hacking contest quickly fell to a pair of researchers, none of the smartphones were successfully exploited. TippingPoint had offered $10,000 for each exploit on any of the phones, which included the iPhone and the BlackBerry, as well as phones running the Windows Mobile, Symbian and Android operating systems. 'With the mobile devices so limited on memory and processing power, a lot of [researchers'] main exploit techniques are not able to work,' said TippingPoint's Terri Forslof. 'Take, for example, [Charlie] Miller's Safari exploit,' referring to Miller's 10-second hack of a MacBook via an unpatched Safari vulnerability that he'd known about for more than a year. 'People wondered why wouldn't it work on the iPhone, why didn't he go for the $10,000?' she said. 'The vulnerability is absolutely there, but it's a lot tougher to exploit on the iPhone.'"
Chrome was the only browser at the contest that was not successfully exploited. We previously discussed day one of the contest, and a summary of day two is available as well.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Unbalanced? (Score:5, Interesting)
Am I the only one who wonders if the design of this contest doesn't create an unbalanced playing field? It's often struck me that if the computers are "Pwn2Own", then the participants are going to focus more heavily on "pwning" the system they want to take home with them. e.g. Given a choice between a Vaio running Windows and a MacBook Pro running OS X, I know I would rather have the MacBook Pro. Thus I'm not going to try as hard to crack the Windows system because the system I REALLY want is the Mac.
Maybe it's just me. Maybe there are an equal number of equally talented individuals who's only disagreement is the preference of their machine. But somehow I don't think it's that easy.
Re:Unbalanced? (Score:4, Funny)
Parent
Re: (Score:3, Funny)
Re: (Score:3, Funny)
second prize: two copies of IE8.
Re: (Score:2)
I can't believe that got modded Funny - that joke is probably older than the transistor.
Re:Unbalanced? (Score:4, Funny)
Parent
Re:Unbalanced? (Score:5, Insightful)
Apple has a history of virtually 100% secure operating systems, especially OS X that is going on almost a decade without a single virus or worm.
FTFA:
In 2007, New York-based security researcher Dino Dai Zovi teamed up with Shane Macaulay to hijack a MacBook Pro via a flaw in Apple's QuickTime software. A year later, hacker Charlie Miller needed just two minutes to exploit a Safari bug to win that contest.
Parent
Re:Unbalanced? (Score:5, Insightful)
fwiw, all the successful attacks I've seen were due to privilege escalation for a local user. The key difference most people are talking about is being secure over a network, from a remote attacker. Viruses don't really even count here, just worms. It's a lot more important to be secure from the 35 million people out on the internet than from the 2 that have an account on your computer.
Windows has been shown to fail miserably, repeatedly, and in epic ways in this respect. OS X has yet to be owned remotely. Correct me if I'm wrong here, I'd like to heat about it.
Parent
Re: (Score:1, Insightful)
how about both the examples in the parent post? One is where you load a malicious webpage when you have quicktime installed (almost everyone) and the other is loading a malicious webpage in safari without needing any extra stuff installed.
Re: (Score:3, Interesting)
OS X has yet to be owned remotely. Correct me if I'm wrong here, I'd like to heat about it.
You are wrong.
The original jailbreaking of the iPhone was based on a tiff handling vulnerability in the Safari browser - this could be exploited remotely until the hole was fixed, simply by visiting a website.
http://www.iphone-hacks.com/2007/10/10/iphone-111-jailbroken-again-using-tiff-exploit/ [iphone-hacks.com]
I would be surprised if there are not more holes in the Safari browser which ships with the iPhone (and its desktop equivalent), indeed I've read about a few more since (can't be bothered to look them all up just now)
Re: (Score:3, Insightful)
Now OS X has been less vulnerable to worms spreading automatically compared to Window
Please provide one example of a worm that spreads automatically on OS X.
Saying "less vulnerable" makes it sound like windows and os x even have some remote similarity. "hundreds of examples" vs "no examples" hardly qualifies you to say "less vulnerable".
Hearing someone say my right shoe is merely "less likely to spontaneously explode" than an unexploded munition from WW2. leads an uninformed observer to question the safet
Re: (Score:1)
>
Hearing someone say my right shoe is merely "less likely to spontaneously explode" than an unexploded munition from WW2. leads an uninformed observer to question the safety of my shoe. It's deceptive.
Yeah, because it's not deceptive to claim that an operating system has no exploitable flaws without source code, let alone a formal proof, that that is so...I think "less vulnerable" is an entirely accurate assessment. And I wouldn't take those shoes on a plane with you...last guy who did that got thrown in jail for the rest of eternity.
Re: (Score:2)
Please provide one example of a worm that spreads automatically on OS X.
OK. Because of people like you, anti-virus vendors have created a worm for OS X (I believe there are other examples):
http://www.symantec.com/security_response/writeup.jsp?docid=2006-021715-3051-99 [symantec.com]
It's not a commercial worm, but this sort of worm is possible on OS X, just more difficult. You talk as if this sort of exploit is impossible somehow on OS X, it is not.
Quite apart from that, you were wrong to say it has not been owned remotely - it has on multiple occasions had remote exploits via the browser. The
Re: (Score:2)
Thank you for the link - I had a suspicion there were one or two proof of concept viruses for the mac, and now I can see one.
But I do have to argue your point about browser exploits. Here you are requiring the user's active assistance, and are only spreading "one step" per user assist.
For practical purposes, they behave almost identical to trojan horse applications, or possibly email-payload viruses. I suppose browser exploits sit in the middleground between trojans and viruses. Not as automatic, but cer
Re: (Score:1)
Re: (Score:2)
Because no virus mean secure? Since when? But I guess I shouldn't bother answering.
Re: (Score:1)
Apple has a history of virtually 100% secure operating systems, especially OS X
Especially OS X? Leaving aside the debate of whether that's true, what other "virtually 100% secure" operating systems has Apple released? Your memory of their history seems to leave out "classic" MacOS, which had viruses, and didn't even support memory protection.
Re: (Score:3, Funny)
We all know that Windows Mobile and IE8 will come out on top as they are far superior to the competition.
Re: (Score:3, Insightful)
But I thought OS X is inherently more secure, and the perceived security has nothing to do with it being a less tempting target than Windows.
Or at least, that's what everybody tells me...
Re: (Score:2)
Re:Unbalanced? (Score:5, Insightful)
The current security situation of the platform is not an XOR matter. It is inherently more secure thanks in large part to tested Unix/BSD bits and very few backwards compatibility hacks that later end up used as vulnerabilities, but at the same time there are vulnerabilities that have not been found because not nearly as many people poke at it as they do Windows. If as many people poked at Mac OS X as they did Windows I'm sure we'd see more vulnerabilities in the wild, but I have no reason to believe there would be as many as we see with Windows.
As for the contest at hand, I'd be shocked if they didn't break it. Browsers are a mess, and this goes for IE8, Firefox, and Safari. They'll most certainly get Safari to trigger a remote code execution situation, the bigger challenge will be finding a local privilege escalation flaw to combine that with to actually own the system.
Parent
Re: (Score:3, Interesting)
Actually I think this might be part of the plan. Right now one of the things that might make Windows less desireable is that it is a bit of a security risk and (apparently) not as hard to crack. So the big flashy prize is something that people want because it's supposedly more secure or otherwise better (or at least sells itself that way) and it's going to get a bit more attention. So maybe more people discover security issues for the desired prize during contests like this which vendors can ultimately fix
Re:Unbalanced? (Score:5, Interesting)
Parent
Re: (Score:2)
Unless that something bad is gonorrhea.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2, Informative)
You're working on the premise that these guys value MacBook Pro more than a Sony. I'm pretty sure that they easily afford a MacBook Pro. I'm sure that Motivation here is actually cracking the system rather than owning the laptop.
Re: (Score:2)
This is good no? Macs still don't get targeted enough in the wild for their weaknesses to be apparent. Windows gets raped. I'm on the 'windows is inherently less secure' side of the fence, but until the market share of OSes reaches a point where it's viable for black hats to attack both MS and Apple (and others ofc, but not relevant here), it's a hard point to prove.
Re:Unbalanced? (Score:5, Insightful)
I know you're trying to be funny but, even the NT kernel is secure. Almost every single exploit will come in via applications, this is true for Mac, Linux/Unix and Windows.
Parent
Re: (Score:2)
2Own (Score:4, Funny)
Re: (Score:1, Funny)
Yeah, I think I'll wait for this year's Pwning4Ponies instead.
Wonder if it requires the iPhone to be jailbroken (Score:5, Interesting)
Re: (Score:1, Funny)
Last year they didn't accept my precondition that the root password be set to blank before attempting to hack it.
How much attention does this get? (Score:3, Insightful)
How much attention does this contest actually get? While there are lots of upstanding people who will participate, I would be surprised if there weren't quite a few talented individuals who will not be participating.
I mean, if you're a blackhat, an exploit for any of these targets is worth a lot more than a laptop or a mobile phone.
Re:How much attention does this get? (Score:4, Insightful)
The blackhats try to exploit the whole contest so that nobody can win. :)
Then they continue to use the holes they only they know about.
Parent
My experience.... (Score:5, Interesting)
Last year I DJ'd for the CanSecWest dinner party, and I was kinda amused to see that a lot of the people who were at the conference were ex-blackhats anyway. A good number of them had criminal records and were now raking in hella money working on the legit side (a shitload more than they made during their blackhat careers). I even met a couple of them at a 2600 meeting once.
Hackers are hackers, regardless of which side of the legal coin they fall on. The exploits used are known to anybody with the resources to find them. In fact, last year nobody took home the Linux box not because they couldn't find any exploits, but because there was so much more effort and time involved in breaking the linux systems that everybody just went for the OSX or Windows machines. Versions of this contest probably exist in the blackhat world, but are a lot less publicized because they don't have industry heavyweights like Cisco or Microsoft sponsoring it.
Parent
Re: (Score:1)
Real hackers aren't in it for the money.
- SR
Spose so, but... (Score:3, Interesting)
If a conglomorate offers you a six+ figure salary to do what you essentially do for fun, are you really going to say no?
Isn't the OS still important? (Score:2)
Doesn't the underline operating system still assist with the overall security of a browser? ie. can't a more secure OS make escalation of a browser hack more difficult?
Re: (Score:2, Interesting)
In this case I believe IE8 has a lead in this contest as they all will be running on in Windows, but IE8 will probably get to run in sandbox mode.
My bets are:
1- Safari
2- IE8
3- Firefox
or:
1- Safari
2- Firefox
3- IE8
Re: (Score:3, Funny)
Doesn't the underline operating system still assist with the overall security of a browser?
Only if it hasn't been upgraded to the italic operating system.
Obligatory XKCD (Score:4, Funny)
http://xkcd.com/166/ [xkcd.com]
Re: (Score:1)
Re: (Score:1)
Opera?... (Score:2)
According to Secunia it had the smallest number of volnurabilities, plus Opera Software somehow likes too boast about security...would be a good contendant and verification of their claims (and don't say that Opera has negligible share, IN YOUR MARKET, there are many where it's quite big (which accidentally are often the healthy ones not dominated by EI/with IE below 50% for some time)