Slashdot Mirror
2008 Pwnie Award Nominees Announced
ruphus13 writes "The Pwnie Awards, an 'annual awards ceremony celebrating and making fun of the achievements and failures of security researchers and the wider security community' announced their 2008 nominees. From their site, 'The final list of nominees for the nine Pwnie Award categories is finally published. We've received some really good submissions and it was not an easy task to narrow them down to five nominees per category, but we hope that we've done a good job. The next step for the Pwnie Awards judges will gather in an undisclosed location prior to the award ceremony and vote on the winners.'"
OMG PWNIESS!!!
picpix image polls. create - share - vote. fun!
Their web server has been pwned.
Did we just set some sort of record?
Anybody want my mod points?
Microsoft sure pwned the ISO when they got OOXML 'accepted' as a 'standard.'
Can we nominate you for a Pwnie Award for hosting a server on a DSL line?
Anybody want my mod points?
Posting anonymously for obvious reasons...
My employer recently released a new "security measure" where our software phones home during installation (and ONLY during installation) to ensure the license key is valid (it has to be pre-generated on the server, avoiding the possibility for key generators). .NET assembly (not even obfuscated, and with REALLY obvious method and property names) - it took me literally about 15 minutes to make a new version of the DLL that doesn't phone home, and just returns true under all conditions. (I make no claim to any skill for doing this - what I do make a claim to is that it's ridiculously simple for pretty much anyone to do)
However, the code to do so is a very easy to "decompile"
I hereby nominate my employer for implementing the most insecure security method EVER.
Note #1: We used to have NO security, and the security was added later to try and stop "evil pirates". I dislike adding this security to our products, but it just seems a little pointless to go through the expense and hassle if it's so easily circumvented!
Note #2: I'll be making a full report of this to the appropriate people, including the obvious measures on how to mitigate the problem, so future versions won't be so bad.
Note #3: We're a large company, so have multiple development teams for different things - this FUBAR was NOT related to my team!
Can we nominate you for a Pwnie Award for hosting a server on a DSL line?
Sure, but I doubt you'll be able to get to the site to submit the nomination :-)
I didn't expect to get Slashdotted. Last year I submitted a link to the awards and it didn't even make it to the front page, so I figured that nobody outside of the security industry cared.
Alexander Sotirov
Pwnie Awards
Concern? Their collapsed server is now more secure than it has ever been!
Do I win?
Very poorly implemented. The majority of people who use computers are completely computer illiterate. Most times I'm suprised they can figure out how to do something as technical as breathing. Anyway, what I'm getting at is they wouldn't know WTF "privileged" means in computer terms, even after consulting a dictionary.
The dialog should just say, "You are about to give a program permission to do whatever the fuck it wants to your computer, including INFECT IT WITH A VIRUS if it so chooses!!!! Unless you know 100% that the program is safe to run, or at least know how to fix ANY problem if it occurs, I strongly suggest you PROMPTLY CLICK NO!!!!". If they click the yes button they should be prompted for their windows product key, twice.
This might discourage people from clicking yes to everything. It may also discourage software companies from writing software that requires admin access. Better yet, it may encourage people who don't know how to use a computer to not use one. Then they can go back to using crayons, paper, envelopes and stamps to send an email.