Slashdot Mirror
First Pwn2Own 2009 Contest Winners Emerge
mellowdonkey writes "Last year's CanSecWest hacking contest winner, Charlie Miller, does it again this year in the 2009 Pwn2Own contest. Charlie was the first to compromise Safari this year to win a brand spankin new Macbook. Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well. Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program."
Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well.
Wow.
Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well.
Wow.
Wow.
'Security' through obscurity
Well, I'm not surprised it didn't take but a few moments for the contest to be won.
Man can make it, man can break it. That's it.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Either these guys are very good.
or something is very wrong with the security features of these Apps
If browsers would be truely sandboxed, no big worries. Sandbox could be even recreated at every start from safe binary cache on harddisk so compromise would only affect the current session inside sandbox. Sandbox could be even completely separate slimmed down virtual session.
It is not impossibe to teach people to restart it after surfing porn. It is impossible to prevent them visiting malicious sites.
Once or twice meant something, but now it's an institution.
Meaning that somebody is going to try to make a career of breaking the easiest part of the system at this contest.
Meaning that these guys are going to sit on their exploits.
Meaning that this contest, running at a set time once a year, is now meaningless.
Except for advertising potential. You know, keeping your product name in the headlines.
The respective companies should offer a running bounty on exploits on their browsers. Yeah, that would spoil all the pageantry of Pwn20wn, but do we really need another pageant?
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Browsers
Chrome: 0
IE8: 1
Firefox: 1(1)*
Safari: 2(1)*
Mobile Browsers
Blackberry: 0
Android: 0
iPhone: 0
Nokia/Symbian: 0
Windows Mobile: 0
*Numbers in parenthesis indicate Successful exploits that fell outside the contest criteria and therefore could not be rewarded.
In Soviet Russia, Trojan exploits YOU!
Not clear in the article, but the exploits were only under windows and osx?
I checked the article and there don't appear to be any details. A few of these hacking contests have been a bit overblown so I'd like to know what manner of exploit they used.
If it's another "well you need physical access to the machine and know the admin username and password" then it's no big deal. If it's "we had the user click a link and all hell broke loose" that would be much more interesting.
Is it just me, or does it look like they censored Nils' zipper when he was showing off his winnings?
Straight from the horse's mouth:
"Why Safari? Why didnâ(TM)t you go after IE or Safari?
Itâ(TM)s really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs donâ(TM)t do. Hacking into Macs is so much easier. You donâ(TM)t have to jump through hoops and deal with all the anti-exploit mitigations youâ(TM)d find in Windows.
Itâ(TM)s more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesnâ(TM)t have anti-exploit stuff built into it."
That's right - Windows is harder to exploit because it's so damned convoluted. Macs are easy prey because they don't have that convolution built-in as a security measure.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Per the contest rules it wasn't necessary to break out of the sandbox, so at this point it is not clear that that happened. Simply executing code in context of the application (browser) would be enough. You can still do a lot of damage inside the browser, i.e. install password/certificate snooping, monitor and inject traffic etc. But it all ends with the browser session. You cannot read/write users' files much less compromise the machine.
Unlike Firefox, Opera and Safari, Chrome and IE actually has such a sandbox. Chrome actually has a 2-level sandbox and a process-per-tab while IE only has a single sandboxed process common to all tabs.
In addition to that IE has a really big supply of extra defenses such as heap encryption, various stack overflow protections, mechanisms designed to foil exception handler exploitation etc. At least some of these must have been broken in the attack against IE8. Recently a couple of security researchers demonstrated how most (if not all) of these mitigation mechanisms (except for sandbox) could be broken by leveraging perfectly valid code to reduce entropy (most of these mitigation mechanisms work by introducing entropy or encryption thus lowering the chance of a successful attack)
Firefox, Opera and Safari has no sandbox and practically no extra mitigation mechanisms to speak of, except for those offered by the operating system. Again, OSX is a the bottom of the heap here, with practically NO extra mitigation techniques. Vista offers the most, especially on 64bit.
For the last couple of years, Firefox (not IE) has been the browser with the most vulns. Combine that with the fact that it has no sandbox, no extra mitigation techniques and that it relies heavily on extensions and plugins the quality of which cannot be controlled by Mozilla. That's a recipe for a security disaster. On Windows and on any other OS.
You can argue that SELinux may be able to achieve something akin to a sandbox. While it can certainly lock down an app pretty tight, it does have 2 issues: 1) It's highly impractical. Mainstream users will not be able to set up a profile and no mainstream distro has been able to supply a built-in profile which suit the needs of the general user. 2) While a profile may prohibit/allow certain calls, it cannot do so based on what the user wants to do. If FF needs to read or write from/to a directory, it will be allowed to do so always. The IE/Chrome sandbox design always denies local file system access. To be able to upload/download files the browser process must interact with a higher privileged process to do the actual marshalling of files. Obviously such a design is inherently stronger.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
The speed factor seems pointless in this exercise - if they didn't write the exploits there and then at the conference, it effectively boils down to who can stick his thumbdrive in the slot and double-click the fastest!
Why did it take longer to kill IE8/Firefox if the exploits were already written and just needed to be run by clicking a URL?
Make the fsckers write their own exploits, and make them do it at the show. THAT would be worth 10k.
#include <sig.h>
Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program.
I see no details here.
Who the hell cares about Windows, Macs, Linux?
Put these folks on voting machines - it's way more important to protect the sanctity of democracy than to point out exploitable browsers.
I get the economics of it, but this is what insurance is for. Software companies care about security, but at some point this becomes more about mental masturbation - cracking will always occur. Why not create some incentive to put the desire to crack on important systems rather than worry about jo-shmoes machine getting compromised.
"Old man yells at systemd"