Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security Chrome Firefox Internet Explorer Safari

Pwn2Own 2012 Set To Reveal More Browser Vulnerabilities Than In the Past 57

Posted by Soulskill from the quality-over-quantity-but-quantity-is-good-too dept.
darthcamaro writes "In any given year, Slashdot always has stories about how a researcher hacked a browser in only a few minutes at the Pwn2own hacking challenge. This year the rules are a bit different, and instead of hackers winning for just one vulnerability, the rules allow for multiple vulnerabilities to be presented. The winner isn't the first one to hack a browser, but is the one that can hack the browser the most. 'In the past, due to the way the competition was architected, we had lots of sensationalist headlines, things like "Mac hacked in three seconds,"' said Aaron Portnoy, Manager of the Security Research Team at HP TippingPoint. 'We don't think that type of sensationalism was representative of all the research that was going on.'"
This discussion has been archived. No new comments can be posted.

Pwn2Own 2012 Set To Reveal More Browser Vulnerabilities Than In the Past More

Pwn2Own 2012 Set To Reveal More Browser Vulnerabilities Than In the Past

Comments Filter:

  • Actually an extremely good point (Score:5, Insightful)

    by Riceballsan ( 816702 ) on Tuesday January 24, 2012 @03:30AM (#38802169)
    The time is pretty irelevant. I mean it isn't like the hackers hadn't seen the OS's or browsers before they set foot on the floor and were going blind. That is like giving someone a sudoku puzzle a month in advance, having him do it from memory and claiming that this guy is so smart he can solve the sudoku puzzle in 30 seconds.

    • Re: (Score:3, Insightful)

      by mikael_j ( 106439 )

      It gets even more ridiculous when the Apple or Microsoft brand sudoku puzzle is the first one scheduled to be solved and everyone screams about how this is proof that those puzzles are easier to solve than the Mozilla or Google brand puzzles.

      And yeah, this has happened in previous years, Safari scheduled to be attacked first so the media and anti-Apple people online scream about how Safari is the least secure browser because it was broken "first" (even though if you look at the event schedule this obviously

      • Re:Actually an extremely good point (Score:4, Interesting)

        by mjwx ( 966435 ) on Tuesday January 24, 2012 @04:36AM (#38802465)

        And yeah, this has happened in previous years, Safari scheduled to be attacked first so the media and anti-Apple people online scream about how Safari is the least secure browser because it was broken "first"

        I dont suppose that you've considered that Safari gets broken first and fastest because there are a lot of undiscovered exploits, due largely to the fact that no-one targets safari as a browser due to low usage. Pwn2Own requires an entirely new exploit (otherwise I'm sure IE would be down in a number of nanoseconds)

        BTW, Safari was not simply broken first, it was broken fastest, this is important as you pointed out the demonstrations took place at different times.

        IE, Chrome and Firefox all have larger user bases, it stands to reason that they will have fewer undiscovered exploits then Safari because they are targeted more often.

        • Re:Actually an extremely good point (Score:4, Insightful)

          by drsmithy ( 35869 ) <drsmithy&gmail,com> on Tuesday January 24, 2012 @08:42AM (#38803597)

          Shush, this is Slashdot. Marketshare and userbase are never factors.

        • Re: (Score:1)

          by Dinghy ( 2233934 )

          Pwn2Own requires an entirely new exploit (otherwise I'm sure IE would be down in a number of nanoseconds)

          Actually that's one of the changes, they no longer require a zero day:

          In a new twist, Pwn2Own 2012 will also be taking aim at known vulnerabilities. These are browser issues that were disclosed at some point in the past year, but do not yet have a public exploit. The researchers will need to actually exploit the given vulnerability in order to score additional points.

          So if an vulnerability exists but has not been shown to be exploitable, if you can show that it is, you get points.

        • Re: (Score:2)

          by guruevi ( 827432 )

          Safari is still based on WebKit which also runs Chrome, Konqueror, Android and a host of other commercial and open source browsers.

        • Re:Actually an extremely good point (Score:4, Interesting)

          by tlhIngan ( 30335 ) <slashdot.worf@net> on Tuesday January 24, 2012 @12:45PM (#38806777)

          I dont suppose that you've considered that Safari gets broken first and fastest because there are a lot of undiscovered exploits, due largely to the fact that no-one targets safari as a browser due to low usage. Pwn2Own requires an entirely new exploit (otherwise I'm sure IE would be down in a number of nanoseconds)
           

          Possible, but given it's Pwn2Own, the machine you "pwned" is the machine you win.

          And given in the past you had a choice of Macbook Pro (OS X), a Sony Vaio (Windows) and sometihng else (for Linux), and had the ability to choose what computer you wanted, what would you go for?

          Most would go for the Macbook purely because it's a nice decent machine that happens to look and function great (and runs Windows and Linux). If I had a series of exploits that worked on all three platforms, I'd go after the Mac first just to win that over a Sony. Then I'd go for the Sony next (if it wasn't for the crapware, at least they're nice looking machines).

          Once that was won, people concentrated on the next machine that was second on their list, etc. Smart contestants go after the computer no one is breaking in as they have a greater chance of winning a free computer.

          And despite the /. crowd chanting "FUNCTION FIRST, not form", most people seem to consistently go for the Macs.

          Given the machines are all around the same value, perhaps a fairer comparison would be if everyone of them was a Macbook Pro or so, running the OS of choice (after all, Windows and Linux run great on a Macbook Pro - I know Ubuntu has a EFI installer that boots natively).

      • Re:Actually an extremely good point (Score:5, Interesting)

        by Anonymous Coward on Tuesday January 24, 2012 @05:02AM (#38802549)

        Safari scheduled to be attacked first so the media and anti-Apple people online scream about how Safari is the least secure browser because it was broken "first"

        The schedule is not relevant, the Mac was hacked in the shortest amount of time which is why we say it was hacked "first".

        And what pissed all you fanboys off wasn't how fast it got hacked, but the statement by the hacker that he chose the Mac because "it was the easiest to compromise quickly".

        If Apple would stop its misleading marketing campaign, and if Apple's users would stop with the constant "Derp derp my Mac is 100% immune to any and all malicious activity of any kind" then we wouldn't laugh at your ass all the time.

        • And what pissed all you fanboys off wasn't how fast it got hacked, but the statement by the hacker that he chose the Mac because "it was the easiest to compromise quickly".

          Skip the ad hominems, will you?

          And most complaints were about the media blowing this out of proportion while leaving details out (I've seen lots of pwn2own reports in the media where it was basically stated "the first browser to get hacked was Apple's Safari raising concerns that blablabla..." with no mention of the fact that this was not a "everyone goes in blind and attacks the browser of their choice for the first time simultaneously" situation) and the anti-fanboys hollering about how this proved that e

        • Re: (Score:1)

          by Anonymous Coward

          Just looking at the stories from last year, it does seem like the order played into it. One story about IE8's exploit last year says:

          The only other browser to fall Wednesday was Apple's Safari 5, which dropped to a team from French security company Vupen minutes before Fewer took his shot at IE8.

          And really, the "Apple Hacked First" headlines will always get more attention than "IE Hacked First", so it does make business sense to have that one scheduled first to ensure the most clickable story gets out.

    • Comment removed based on user account deletion

    • Well, not just that, but, past entries have done what, written a file to disk and executed something like the calculator?

      Big hairy deal. I'm not concerned until we see a mac drive by that also escalates to root.

      • Re: (Score:3)

        by drsmithy ( 35869 )

        Big hairy deal. I'm not concerned until we see a mac drive by that also escalates to root.

        Nothing on my computer I care about, needs root privileges to access.

      • That's still a pretty big deal. If you can get that far you can probably compromise an individual user's data. Even if not you could probably at least start a browser pointed to some shock site. That could be a pretty big deal on a workplace or school computer.

  • Also helps with vulnerability hoarding (Score:5, Informative)

    by slimjim8094 ( 941042 ) on Tuesday January 24, 2012 @03:36AM (#38802201)

    I heard that it's been the case before that discovered vulnerabilities would be kept secret so that they could be used across multiple years. This changes the incentive to reward whoever's found the most, which is what the point was all along - exposing as many vulnerabilities as possible.

    • Re:Also helps with vulnerability hoarding (Score:4, Interesting)

      by robbak ( 775424 ) on Tuesday January 24, 2012 @04:11AM (#38802353) Homepage

      As well, all contestants should reveal all techniques they intend to use a part of their application. All these reports would be provided to the vendors after the competition.

      • Re: (Score:2)

        by Krneki ( 1192201 )

        As well, all contestants should reveal all techniques they intend to use a part of their application. All these reports would be provided to the vendors after the competition.

        No-go, this exploits are worth a shit load of money on the black market. Unless you are willing to pay for the discovery all you will achieve is to push this people back in the underground and while you don't know how they work, at least you know they are out there.

  • My plan (Score:2, Funny)

    by Anonymous Coward

    1. Hack the browser once using a single vulnerability.
    2. Install lots of new vulnerabilities on the compromised machine.
    3. Win the contest by exploiting each of those vulnerabilities.
    4. PROFIT!!!

  • Since they no longer do it with Linux, who cares. Could it be that 2008 Firefox on Ubuntu was un-hacked? It's not good advertisement if a open source system can't be hacked, while the two commercial systems are hacked in seconds?

    • Re: (Score:3)

      by Krneki ( 1192201 )

      Since they no longer do it with Linux, who cares. Could it be that 2008 Firefox on Ubuntu was un-hacked? It's not good advertisement if a open source system can't be hacked, while the two commercial systems are hacked in seconds?

      Last year neither firefox nor Chrome on Windows OS were hacked.

    • Re: (Score:2)

      by ledow ( 319597 )

      Mmm, that's odd, I have to agree.

      Especially given that both HP and Google are funding it, one of which probably has an interest in a non-open OS being trounced by an open one, and the other of which supports both types of OS on its hardware (and isn't really "competing" or "allied" with Apple in those terms either).

      Weird.

Slashdot Top Deals

Two can Live as Cheaply as One for Half as Long. -- Howard Kandel

Close