Pwn2own 2014 Set To Hunt Unicorns 66
darthcamaro writes "The annual Pwn2own hacking competition has always made short work of all browser vendors' security, shredding perception of safety by hacking IE, Firefox, Safari and Chrome in minutes. This year the competition is adding a twist — for IE on Windows 8.1, hackers will also have to bypass Microsoft EMET, which is a seemingly bulletproof type of sandbox. The competition is calling this the 'Unicorn Exploit' and the first researcher to successful exploit it will pocket $150,000."
Theme handles (Score:2)
More than meets the eye (Score:2)
Re: (Score:2)
"In minutes" (Score:5, Insightful)
Sure, they hack browsers "in minutes" after months of studying and audits.
Re:"In minutes" (Score:5, Funny)
But don't they just type the hack really fast at a moments notice just like in the movies? Hollywood you lied to me!
In other shocking news... (Score:1)
...housewives don't generally pay for plumbing or electrical work in sexual favors, either...
Re: (Score:2)
...housewives don't generally pay for plumbing or electrical work in sexual favors, either...
So I'm wasting my time with my cable repairman correspondence course?
Re: (Score:2)
He fixes the cable?
Re: (Score:2)
Probably because I've never met a plumber who looked anything like a porn star...
Re: (Score:2)
No they just insert a floppy disk and the computer autoruns their exploit for them.
Re: (Score:2)
But don't they just type the hack really fast at a moments notice just like in the movies?
This requires two people typing really fast on the same keyboard simultanously
Re:"In minutes" (Score:5, Insightful)
Exactly. What all of these headlines neglect to mention is that these folks have created automated suites that oftentimes make use of zero-day or recent exploits. It's not as if they sit down and start putting something together once they get there. Rather, they carefully crated these tools in advance in order to allow them to make the headlines by hacking things in mere minutes or even seconds.
Re: (Score:2)
Does anyone seriously expect someone to just walk up to a machine, and search for a new vulnerability and hack it in 30 minutes?
Re: (Score:2)
Have you talked to any of the types of folks that are regular watchers of CSI and its ilk? For most of them, computers are still magic boxes. A mother I was talking with yesterday was asking me if they still made computers with floppy drives, since she still uses them on a regular basis, and she was shocked to learn that not only have all of the major manufacturers stopped putting them in, but that the industry is even starting to move away from CD/DVD drives at this point towards download-only distribution
Re: (Score:2)
A mother I was talking with yesterday . . .
I know; mothers are the worst. Completely technologically illiterate. Did you know that the average mother still uses her uterus to produce a child?
Re: (Score:2)
To be clear, I wasn't generalizing about mothers. I was generalizing about the sort of folks who watch shows like that. The two sets may intersect for a large portion of their members, but they are by no means identical. I'm friends with a mother who has a doctorate, has flown in space four times, is one of the leading experts on certain types of robotics, does occasional stints as a university professor, and could run circles around me when it comes to anything technological. On the other end of the spectr
Re: (Score:1)
Re: (Score:2)
I actually enjoyed CSI for the first few seasons as well, but I think we all have a mental picture of the sorts of people I'm talking about when I make a comment along those lines. That is, people who think that technology is much more capable than it actually is, that scientists and the like catch all of the finest details every single time, and that even the slightest thing out of place is sufficient for dismissing the entire idea. I've heard that prosecutors have been having a really hard time since CSI
Re: (Score:1)
Enhanced Mitigation Experience Toolkit (Score:1)
Re: (Score:1)
It's a little more challenging to get into the NSA's holes than your mom's.
Re: (Score:2)
Not to mention your mom will not be monitoring for break-ins on quite the same level of the NSA.
Snowden already did (Score:3, Interesting)
Re: (Score:3, Funny)
Re: (Score:2)
Any data classified as Secret or higher is stored on computers that are physically separate from the public internet. So before anyone could hack into the NSA or a similar agency, they would have to bypass physical security involving many men with guns.
Re: (Score:2)
Why would hackers care about Windows 8.1? What is the market share now?
I'd guess well over 90% of newly manufactured desktop and laptop PCs not made by Apple and sold to homes and small-business users in the first world.
Re: (Score:1)
If true, that's the percentage of a vanishingly small sector of the total internet connected devices. You've basically said "well over 90% of 0.7% of the market" which proves the OP's point entirely.
Re: (Score:2)
Re: (Score:3)
well, the 150 000 is to make them care.
Re: (Score:2)
For now maybe.
For now Windows 8.1 is such a small part of the installed base that the botnet controllers are probably unwilling to pay much more than that for exploits to make it more accessible. Eventually that will change and the value may become much higher, but if you're an amoral hacker trying to wait until then to cash in you run the risk that some other hacker will discover the exploit and cash in with Microsoft, which renders your work valueless.
But come on, how many man-hours do you suppose are go
Re: (Score:2)
Presumably only one person wins. If it's a task that the average security researcher could accomplish ($150k is not a very high wage). Then you have to estimate how many *other* people will enter. You also have to estimate that all 'average' security researchers will be equally successful.
That means you spend $150k and you are 1 of let's say 1,000 entrants and your average payout is $150 for a year's work. About 2 hours of your hourly rate. Even if you were only one of 100 contestants then your pa
Re: (Score:2)
Yes, but do you suppose an "average security researcher" would bother to enter one of these things unless just for the sport of it? I suspect these competitions appeal more to the fringe types who aren't content to work as a cog within the machine - refusing to be a well-oiled cog does tend to take its toll on earning potential.
"seemingly bulletproof" ? (Score:2)
I was curious about this "seemingly bulletproof" sandbox as described in the summary. But the opening paragraph on Microsoft's website [microsoft.com] explains:
These security mitigation technologies do not guarantee that vulnerabilities cannot be exploited
So much for the hyped-up summary...
Re: (Score:2)
Of course they dont guarantee, as that would be an issue if it were exploited.
What EMET is - and isn't (Score:5, Informative)
The good news - these mitigations can be applied from outside the apps involved (as of 4.1, no more app recompiling or special-versions needed). The somewhat bad news - there are compatibility issues, and many apps are not compatible with the whole list of protections (see the MS KB article [microsoft.com] for more info). I also wonder if there are performance impacts from doing so, as opposed to compiling in the mitigations that can be compiled in - but don't quote me on that, I'm not sure
More bad news - it won't work with certain app features, e.g. any code that accesses certain system services at too low a level, so for example DRM-using apps (so many videogames are off the table); and it only intended for desktop apps (so they "do not advise" you use it with system services or server apps).
We tested the 3.0 version, focusing solely on the mitigations that could be imposed from outside the code even in that version - and found that many apps had issues with most, and some with all, of the mitigations (and, a killer for us, it wouldn't work with virtualized apps). Maybe that's improved, not claiming to know.
All in all - it has value if you're deploying legacy apps over which you have no control to a broad array of desktops, and it doesn't break your apps. Frankly, I don't know why the emphasis on IE11
To be clear
"perfect security" (Score:2)
typically attracts people that already have a stable full of unicorns, especially if you're foolish enough to put a big bounty on it. Announcing you have "perfect security" just brings the embarrassment to your door that much faster.
And try as you might, even actual "perfect security" on your part will usually fail miserably at someone else's hands. Look at Safai, and how often flash or java (or the user themselves) is used to compromise it. (approaching 100%?)
We'd Like to Thank! Our Pwn2own Platinum Sponsors (Score:1)
not worth it (Score:2)
it's clear that the amount offered is very little compared to what you could get by selling the info. if you can get a browser hack that can highjack the OS then it's worth a shitload more than the pennies they are offering. they need to start offering real cash for these deep level hacks.
unicorn hunting? (Score:2)
Here I thought this would be about talking to single ladies at couples clubs.
Why Hunt Unicorns? (Score:2)