Slashdot Mirror

← Back to Stories (view on slashdot.org)

First Pwn2Own 2009 Contest Winners Emerge

Posted by timothy on from the good-work-if-you-can-get-it dept.

mellowdonkey writes "Last year's CanSecWest hacking contest winner, Charlie Miller, does it again this year in the 2009 Pwn2Own contest. Charlie was the first to compromise Safari this year to win a brand spankin new Macbook. Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well. Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program."

1 of 98 comments (clear)

  1. Re:Let me be the first to say by tonywong · · Score: 5, Informative

    Since no one has placed what 'owned' means, here's the rules from the canwest site:

    2009-03-18-01:00:00 PWN2OWN Final Rules

    Well after much discussion and deliberation here is the final cut at scenarios for the PWN2OWN competitions.

    Browsers and Associated Test PAltform

    Vaio - Windows 7

            * IE8
            * Firefox
            * Chrome

    Macintosh

            * Safari
            * Firefox

    Day 1: Default install no additional plugins. User goes to link.
    Day 2: flash, java, .net, quicktime. User goes to link.
    Day 3: popular apps such as acrobat reader ... User goes to link

    What is owned? - code execution within context of application

    =====

    I'm presuming that code execution is the first step towards owning the whole box, which may or may not be trivial once you got code execution happening within the app.