First Pwn2Own 2009 Contest Winners Emerge 98
mellowdonkey writes "Last year's CanSecWest hacking contest winner, Charlie Miller, does it again this year in the 2009 Pwn2Own contest. Charlie was the first to compromise Safari this year to win a brand spankin new Macbook. Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well. Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program."
Let me be the first to say (Score:4, Insightful)
Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well.
Wow.
Let me be the second to say (Score:3, Funny)
Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well.
Wow.
Wow.
Re: (Score:1, Redundant)
In this case, shouldn't the moderation be + Redundant?
Re: (Score:3, Insightful)
Re:Let me be the first to say (Score:5, Informative)
Re: (Score:2, Interesting)
He also said that Mac was just as insecure as Windows and that Windows gets attacked mainly because of the number of people using it.
I tried to find some sort of source for this, but instead found this:
Windows 7 PC Outlasts Mac In Security Test [infopackets.com], at PWN2OWN.
Re:Let me be the first to say (Score:4, Informative)
Mac easiest to hack, says $10,000 winner [computerworld.com]
Re: (Score:1, Informative)
Re: (Score:1)
Re: (Score:1, Flamebait)
Re: (Score:2, Informative)
Its got to be pretty easy to find exploits when you've got the source in front of you!
A comparison of high-profile, seriously damaging Apache and IIS exploits would seem to indicate the opposite. Code Red and Nimda both caused a lot of damage, and targeted IIS. Any comparable stories for Apache, which has a larger market share than IIS by any figures I've seen?
Or heck, look at Firefox vs. IE. IE has historically been much less secure, although Firefox has had its share of screwups too. (Of course, the closed-source software does have a larger market share in this case. But then, WebKi
Re: (Score:2)
Of course it only applies if the code in question actually gets looked over by a lot of people. True for high profile things like Apache, but smaller open source projects can't be automatically assumed to be more secure - they may well have no more, or less, people actively reviewing their code than an equivalent program from a normal developer.
Re:Let me be the first to say (Score:5, Funny)
Actually, if I'm remembering correctly, Charlie Miller DID say that he knew of more ways to crack into a mac. He also said that Mac was just as insecure as Windows and that Windows gets attacked mainly because of the number of people using it.
BURN HIM ! BURN THE HERETIC !
Re: (Score:2, Insightful)
No not burn, just leave him and all the other to their windoze spyware nightmare :)
Re: (Score:2)
Yeah, cause I'm sure THIS GUY has the same spyware problems my grandma has. :)
Re:Let me be the first to say (Score:5, Informative)
Since no one has placed what 'owned' means, here's the rules from the canwest site:
2009-03-18-01:00:00 PWN2OWN Final Rules
Well after much discussion and deliberation here is the final cut at scenarios for the PWN2OWN competitions.
Browsers and Associated Test PAltform
Vaio - Windows 7
* IE8
* Firefox
* Chrome
Macintosh
* Safari
* Firefox
Day 1: Default install no additional plugins. User goes to link. .net, quicktime. User goes to link. ... User goes to link
Day 2: flash, java,
Day 3: popular apps such as acrobat reader
What is owned? - code execution within context of application
=====
I'm presuming that code execution is the first step towards owning the whole box, which may or may not be trivial once you got code execution happening within the app.
Re: (Score:1)
What is owned? - code execution within context of application
Does this mean that you win if you execute code in a sandboxed application, even if that means you can't actually harm the user at all?
Re: (Score:2)
The nice thing about this, is that for Firefox, and probably also Safari, the bugs are already fixed.
So all in all, this was a good thing for us all.
The third exploit was a good thing for botnet owners only. ;)
Hmmm.... (Score:3, Insightful)
Well, I'm not surprised it didn't take but a few moments for the contest to be won.
Man can make it, man can break it. That's it.
Re:Hmmm.... (Score:5, Funny)
But Safari was created by the Gods at Apple....
Re:Hmmm.... (Score:5, Funny)
Firefox Three for the Elven-kings under the sky,
IE Seven for the Dwarf-lords in their halls of stone,
Netscape Nine for Mortal Men doomed to die,
One Safari for the Dark Lord on his dark throne
In the Land of Apple where the Shadows lie.
One Browser to rule them all, One Browser to find them,
One Browser to bring them all and in the darkness bind them
In the Land of Apple where the Shadows lie.
Re: (Score:2)
Re: (Score:3, Interesting)
Yeah, but from what I read, the attack was via a PERL regex library used by the javascript engine. So it was in something Apple just used and not something they wrote from scratch. <sarcasm> I'm sure had Apple written the whole thing from scratch, there'd be no bugs...</sarcasm>
Re: (Score:2)
Yeah, but from what I read, the attack was via a PERL regex library used by the javascript engine. So it was in something Apple just used and not something they wrote from scratch. <sarcasm> I'm sure had Apple written the whole thing from scratch, there'd be no bugs...</sarcasm>
While we're conjecturing wildly (well, you didn't cite) Apple has a history of failing to keep their Open Source components current, especially perl modules (there was a discussion here recently about manually-updated perl modules being whacked by an Apple 'update'.)
Re:Hmmm.... (Score:4, Informative)
Re: (Score:3, Funny)
heh, my memory had conflated pcre and perl. That'll teach me to look shit up.
Re: (Score:2)
Re: (Score:2)
No kidding. Basically it was a draw from the summary's hat for who won the computers, from what I can gather. At least, that's the impression I'm getting...
It's also very unclear what constitutes "pwned". Even reading the rules, "code execution in the context of the application" or something... Does that mean these exploits are actually usable to do something malicious, or do they just, say, crash the browser?
Re: (Score:2)
Re: (Score:3, Insightful)
Yes.
The code executed by the contestant may not be malicious, it is only meant to showcase the exploit being used. If I were a contestant, I would not run malicious code on the laptop I was hoping to take home with me! Maybe download a Kubuntu .iso and Wubi.exe, and execute Wubi.....
Used in the wild, the exploit would almost certainly be used to execute malicious code, I'd think.
Re: (Score:3, Insightful)
It's also very unclear what constitutes "pwned". Even reading the rules, "code execution in the context of the application" or something... Does that mean these exploits are actually usable to do something malicious, or do they just, say, crash the browser?
Seems pretty cut and dry to me, it means they were able to inject their own code into the processes memory and get it too execute. So no privilege escalation but you can now do whatever said application would theoretically been able to do.
Re: (Score:3, Insightful)
thats why its time for andriod style security on the desktop , firefox should ONLY be able to write to a downloads folder & its profile, OO should ONLY be able to read/write to disk, NO network access,.
Re: (Score:2)
Re: (Score:1)
"Android style security"??? It's a sad day on /. when someone calls mandatory access control "android style security".
Re: (Score:2, Interesting)
thats why its time for andriod style security on the desktop , firefox should ONLY be able to write to a downloads folder & its profile
So what if the user uses "Save Page As..."? You'd have to have an infrastructure that allows spawning a file picker as a separate app with its own permissions. What if the user customizes the directory for storing the web cache? What if Firefox creates an executable in a prohibited location and then runs it? Etc. Firefox is an awfully big application; it would be hard to pin it down with hard-and-fast rules on what directories it can access.
OO should ONLY be able to read/write to disk, NO network access,.
That's a real impediment. Just write out your malicious scrip
Re: (Score:1)
Re: (Score:2)
I think most slashdotters can understand the implications of what happens when an application running as root get compromised. Those that don't probably work at Microsoft :-).
Re:WTF ? (Score:4, Insightful)
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
I'd like to see a browser stabilized so that more work can be done on the security. I always wonder, how can they may a secure browser if they are constantly adding features to it?
What else do we need for a browser to do?
I'm serious, what else do we really need a browser to do? Can we stop for awhile and work on making one more secure?
Re: (Score:2)
Re:WTF ? (Score:4, Insightful)
there are just some things that we need to accept aren't safe yet. As much as I like active web pages like this one, the problems with CGI and javascript persist even today, despite a decade+ of review and testing. I find online banking and drivers license registeration very convient, but at the same time, I firmly believe that there is no way to be safe when performing fiscal transactions online. don't get me wrong, I use these services, but I wish the chaotic computing environment would slow down a bit so we can catch up with the securiy problems of last year, before facing next years.
Or, ... (Score:4, Insightful)
Once or twice meant something, but now it's an institution.
Meaning that somebody is going to try to make a career of breaking the easiest part of the system at this contest.
Meaning that these guys are going to sit on their exploits.
Meaning that this contest, running at a set time once a year, is now meaningless.
Except for advertising potential. You know, keeping your product name in the headlines.
The respective companies should offer a running bounty on exploits on their browsers. Yeah, that would spoil all the pageantry of Pwn20wn, but do we really need another pageant?
Re:Or, ... (Score:4, Insightful)
They change the rules and targets each year. Nobody will sit on an exploit all year because there's no way to know what to hang on to, or whether the hole will still be there in a month, let alone a year. It's used to promote the Zero Day Initiative [zerodayinitiative.com] which pays you directly for exploits, no fancy contest needed. The contest serves its purpose perfectly. It's never been a meaningful way to stop exploits anyway, just a promotional vehicle for the conference and the respective companies. Nobody's going to make a career out of this competition. If they were good enough to do that, they could make a comfortable living from the ZDI.
Re:Or, ... (Score:4, Insightful)
Nobody will sit on an exploit all year because there's no way to know what to hang on to, or whether the hole will still be there in a month, let alone a year.
That's exactly what happened [zdnet.com] this year:
I actually found this bug before last year's Pwn2Own but, at the time, it was harder to exploit. I came to CanSecWest last year with two bugs but only one exploit. Last year, you could only win once so I saved the second bug. Turns out, it was still there this year so I wrote another exploit and used it this year.
Re:Or, ... (Score:5, Insightful)
That's exactly what happened [zdnet.com] this year:
I actually found this bug before last year's Pwn2Own but, at the time, it was harder to exploit. I came to CanSecWest last year with two bugs but only one exploit. Last year, you could only win once so I saved the second bug. Turns out, it was still there this year so I wrote another exploit and used it this year.
So in a way what this event did is help keep a known vulnerability open for a year more than it should have been. Which means that there is a fair chance that in the mean time some body else might have found and used it in the wild.
Brilliant.
Re: (Score:2, Informative)
That's exactly what happened [zdnet.com] this year:
I actually found this bug before last year's Pwn2Own but, at the time, it was harder to exploit. I came to CanSecWest last year with two bugs but only one exploit. Last year, you could only win once so I saved the second bug. Turns out, it was still there this year so I wrote another exploit and used it this year.
So in a way what this event did is help keep a known vulnerability open for a year more than it should have been. Which means that there is a fair chance that in the mean time some body else might have found and used it in the wild.
Brilliant.
Wrong. Read the rest of the link:
He wouldn't have given up the bug if not for the contest. He'd have sat on it anyway until he found someone else to pa
Re: (Score:1)
Re:Or, ... (Score:4, Informative)
> The respective companies should offer a running bounty on exploits on their browsers.
You mean like http://www.mozilla.org/security/bug-bounty.html [mozilla.org] ?
The problem is that browser exploits sell for about $10,000 at the moment (that's how much various "security" companies will pay for them). The bug bounty above is $500...
Re: (Score:2)
Alas, the bad guys will always want to pay more for the exploit as its more valuable to them. Get this: $10,000 is nothing, they can make millions in profit!
Re: (Score:2)
Well, yeah, but I'm not sure I'd call it profit.
Ill-gotten gains have the baggage of having been gotten by ill means. When you start taking from other people, you start forgetting how to make your own.
I know the economy is bad. It's always bad. That's part of the puzzle we are trying to solve, how to provide for ourselves and our own in an adversarial economy. When we solve that puzzle well, we add value to the economy and to our own state of being. When we steal, we take away from both.
Of course, the bad g
I have your answer. (Score:2)
Straight from the horse's mouth:
"Why Safari? Why didnâ(TM)t you go after IE or Safari?
Itâ(TM)s really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs donâ(TM)t do. Hacking into Macs is so much easier. You donâ(TM)t have to jump through hoops and deal with all the anti-exploit mitigations youâ(TM)d find in Windows.
Itâ(TM)s more about the operating system than the (target) program. Firefox on Mac is p
Re: (Score:2, Informative)
Straight from the horse's mouth:
"Why Safari? Why didn't you go after IE or Safari?
It's really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don't do. Hacking into Macs is so much easier. You don't have to jump through hoops and deal with all the anti-exploit mitigations you'd find in Windows.
It's more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesnâ(TM)t have anti-exploit stuff built into it."
That's right - Windows is harder to exploit because it's so damned convoluted. Macs are easy prey because they don't have that convolution built-in as a security measure.
Wrong. He gives more details than you quoted:
He's saying that Windows uses recognized security techniques like DEP [wikipedia.org] and ASLR [wikipedia.org], and Mac doesn't. (Linux does u
Re: (Score:2)
ASLR is simply making sure core files aren't always loaded into the same address space - making it more convoluted. There are more twists, more hoops, more folds to go through, before you can get to what you want.
Convoluted - adj: Complex, intricate or complicated; Having numerous overlapping coils or folds
Re: (Score:1)
ASLR is simply making sure core files aren't always loaded into the same address space - making it more convoluted. There are more twists, more hoops, more folds to go through, before you can get to what you want.
Convoluted - adj: Complex, intricate or complicated; Having numerous overlapping coils or folds
So are you saying ASLR is a bad thing? If so, why? If not, why did you use the clearly derogatory terminology "so damned convoluted"?
Anyway, a non-executable stack has nothing to do with being convoluted, and that's also an obstacle that he mentioned.
Re: (Score:2)
Windows is so damned convoluted, that is what I said. ASLR is a good thing. I find it funny that the one thing that people tend to complain about - all the twists and turns in Windows and how sloppy and make-shift it is, ends up making it somewhat more secure in one form.
Re: (Score:3, Informative)
they are getting better with this, but they still have a long way to go.
Re: (Score:2)
Don't you read slashdot? [slashdot.org] There's a known hack to take control of the CPU and circumvent the entire OS.
Your computer is only yours by the whims of others.
Re: (Score:2)
That only works in ring 0, that is, if you are already root. Thus, it can only make a bad exploit even worse, it won't help you get out of a sandbox.
ScoreAfter Day 1 (for the TL;DR crowd) (Score:5, Informative)
Browsers
Chrome: 0
IE8: 1
Firefox: 1(1)*
Safari: 2(1)*
Mobile Browsers
Blackberry: 0
Android: 0
iPhone: 0
Nokia/Symbian: 0
Windows Mobile: 0
*Numbers in parenthesis indicate Successful exploits that fell outside the contest criteria and therefore could not be rewarded.
Re: (Score:3, Interesting)
Re: (Score:1)
Firefox on Mac was done but how about Firefox on Windows? (Nils did it on the Mac)
Re: (Score:3, Insightful)
firefox is firefox, it runs on linux, it can be exploited on linux. NOSCRIPT FTW
Re: (Score:2, Insightful)
If all OSes would implement all of OpenBSD security features, even if not perfectly, the amount of exploitable bugs would decrease considerably. The bug is still there, but the black hat is met with a harsh environment totally unlike the green garden that are major OSes.
Re: (Score:1)
No details? (Score:3, Insightful)
I checked the article and there don't appear to be any details. A few of these hacking contests have been a bit overblown so I'd like to know what manner of exploit they used.
If it's another "well you need physical access to the machine and know the admin username and password" then it's no big deal. If it's "we had the user click a link and all hell broke loose" that would be much more interesting.
Re:No details? (Score:5, Interesting)
That is exactly what happened with Safari on MacOS, in seconds. I guess the others fell just as easily, but with a bit more crude exploits.
We don't get to know the details because vendors get to fix the hole before anything is published, which is long after all of us have forgotten about the contest.
What really is misleading is that Windows 7 and MacOS are implied pwned when it appears that only the browsers were taken.
With IE8 purportedly running in a "sandbox", breaking out of that was interesting by itself and hopefully a bit more difficult than just escalating privileges in MacOS.
I miss Linux too. A hole in firefox means being just one local exploit away from pwning your box.
Not clear if sandbox was breached (Score:1)
Per the contest rules it wasn't necessary to break out of the sandbox, so at this point it is not clear that that happened. Simply executing code in context of the application (browser) would be enough. You can still do a lot of damage inside the browser, i.e. install password/certificate snooping, monitor and inject traffic etc. But it all ends with the browser session. You cannot read/write users' files much less compromise the machine.
Unlike Firefox, Opera and Safari, Chrome and IE actually has such a
Re: (Score:2)
But it all ends with the browser session. You cannot read/write users' files much less compromise the machine.
If you can execute in the applications context, I think you can write to the preferences files - even if the app is in a sandbox. At that point you might be able to save your hack and have it reloaded at start up. You might save your hack as file: //homepage.html and load that.
Re: (Score:2)
If you can execute in the applications context, I think you can write to the preferences files - even if the app is in a sandbox.
No, not in a sandbox. That\s the difference between something like SELinux and a real sandbox. With SELinux you will be allowed to do what you legitimately need to be able to do. In a sandbox you will have to ask the broker process to perform the privileged operations. Neither Chrome nor IE let the rendering process access the local file system. Instead they supply a broker/helper process. Typically this process will interact with the user, i.e. if downloading a file it will display a dialog or visual eleme
Sensored? (Score:1, Funny)
Is it just me, or does it look like they censored Nils' zipper when he was showing off his winnings?
Re:Sensored? (Score:5, Funny)
Is it just me, or does it look like they censored Nils' zipper when he was showing off his winnings?
I have no idea - but why were you were looking down there in the first place?
Re: (Score:2)
Didn't write the exploits in seconds did they?! (Score:3, Interesting)
The speed factor seems pointless in this exercise - if they didn't write the exploits there and then at the conference, it effectively boils down to who can stick his thumbdrive in the slot and double-click the fastest!
Why did it take longer to kill IE8/Firefox if the exploits were already written and just needed to be run by clicking a URL?
Make the fsckers write their own exploits, and make them do it at the show. THAT would be worth 10k.
What details...? (Score:4, Interesting)
Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program.
I see no details here.
Like they don't care? (Score:3, Interesting)
Who the hell cares about Windows, Macs, Linux?
Put these folks on voting machines - it's way more important to protect the sanctity of democracy than to point out exploitable browsers.
I get the economics of it, but this is what insurance is for. Software companies care about security, but at some point this becomes more about mental masturbation - cracking will always occur. Why not create some incentive to put the desire to crack on important systems rather than worry about jo-shmoes machine getting compromised.