Pwn2Own Competitors Crack Tesla, Firefox, Safari, Microsoft Edge, and Windows 10 (zdnet.com) 41
A research duo who hacked a Tesla were the big winners at the annual Pwn2Own white hat security contest, reports ZDNet. "The duo earned $375,000 in prize money, of the total of $545,000 awarded during the whole three-day competition... They also get to keep the car."
Team Fluoroacetate -- made up of Amat Cama and Richard Zhu -- hacked the Tesla car via its browser. They used a JIT bug in the browser renderer process to execute code on the car's firmware and show a message on its entertainment system... Besides keeping the car, they also received a $35,000 reward. "In the coming days we will release a software update that addresses this research," a Tesla spokesperson told ZDNet today in regards to the Pwn2Own vulnerability.
Not coincidentally, Team Fluoroacetate also won the three-day contest after earning 36 "Master of Pwn" points for successful exploits in Apple Safari, Firefox, Microsoft Edge, VMware Workstation, and Windows 10... [R]esearchers also exploited vulnerabilities in Apple Safari, Microsoft Edge, VMware Workstation, Oracle Virtualbox, and Windows 10.
Not coincidentally, Team Fluoroacetate also won the three-day contest after earning 36 "Master of Pwn" points for successful exploits in Apple Safari, Firefox, Microsoft Edge, VMware Workstation, and Windows 10... [R]esearchers also exploited vulnerabilities in Apple Safari, Microsoft Edge, VMware Workstation, Oracle Virtualbox, and Windows 10.
The other prizes... (Score:5, Funny)
Besides keeping the car, they also received a $35,000 reward.
That's nothing... the ones who cracked Firefox got a free copy of Firefox. But the worst deal of all were the ones who cracked Win10, for they were obligated to accept a copy of Win10. Perhaps they'll read the terms and conditions more carefully next time. Live and learn.
Telegram, guys? (Score:2)
Re: (Score:3)
Re: (Score:2)
cracks for that sort of stuff are unlikely to pop up in a pwn2own competition, they are too valuable to give away so cheaply.
That was the point. Unlike pwn2own, the Telegram prize is much more valuable, 300k ; and hackers would better try to crack this one.
Re: (Score:3)
Interesting that Chrome isn't one of the ones on the list though. Too valuable or too secure?
Re: Telegram, guys? (Score:1)
It's more about how the criteria are written. $80k for a breakout which allows full system control. Something that severe would probably qualify for the top end of Google's bounty, which would be close to $200k.
Why? (Score:2)
The code used the software is created in?
The skill sets needed to make a browser?
More testing needed?
Better testing?
Would something like Ada ensure better software?
Re: (Score:2)
Re: (Score:1)
You get what you pay for. I write secure code. Unit tested & input fuzzed. I use a different more secure paradigm than typical C / C++ function call stacks (which put parameters & code pointers on the stack), None of my heap stores pointers to functions or v-tables. I employ hardware memory RW controls to ensure there are is no return oriented programming, stack smashing or heap exploits (my custom memory allocator keeps all record keeping data in read only memory unless a thread is in the alloc
Re: (Score:1)
Re: (Score:2)
Easy (Score:2)
What does Tesla's web browser run on nowadays? (Score:3)
The last time they had a browser hack the hackers could control breaks, do they have a decent hardware firewall in place now or is it still a shitshow?