First Pwn2Own 2009 Contest Winners Emerge

mellowdonkey writes "Last year's CanSecWest hacking contest winner, Charlie Miller, does it again this year in the 2009 Pwn2Own contest. Charlie was the first to compromise Safari this year to win a brand spankin new Macbook. Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well. Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program."

Comments

Let me be the first to say

[Jurily]

Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well.

Wow.

Re:Let me be the first to say

[von_rick]

I'm pretty sure he knows more methods to compromise the OS through these browsers. Most likly he'll use those methods at next years' pwn2own. Same could be said about Charlie Miller.

Re:Let me be the first to say

[Anonymous Coward]

No not burn, just leave him and all the other to their windoze spyware nightmare :)

Hmmm....

[Khyber]

Well, I'm not surprised it didn't take but a few moments for the contest to be won.

Man can make it, man can break it. That's it.

Re:Hmmm....

[rts008]

Does that mean these exploits are actually usable to do something malicious,...

Yes.

The code executed by the contestant may not be malicious, it is only meant to showcase the exploit being used. If I were a contestant, I would not run malicious code on the laptop I was hoping to take home with me! Maybe download a Kubuntu .iso and Wubi.exe, and execute Wubi.....

Used in the wild, the exploit would almost certainly be used to execute malicious code, I'd think.

Re:Hmmm....

[MadnessASAP]

It's also very unclear what constitutes "pwned". Even reading the rules, "code execution in the context of the application" or something... Does that mean these exploits are actually usable to do something malicious, or do they just, say, crash the browser?

Seems pretty cut and dry to me, it means they were able to inject their own code into the processes memory and get it too execute. So no privilege escalation but you can now do whatever said application would theoretically been able to do.

Re:Hmmm....

[RiotingPacifist]

thats why its time for andriod style security on the desktop , firefox should ONLY be able to write to a downloads folder & its profile, OO should ONLY be able to read/write to disk, NO network access,.

Re:WTF ?

[CannonballHead]

Or both.

Re:WTF ?

[JumpDrive]

I think that something is very wrong with the security features of these apps or the OS on which they were run.
I'd like to see a browser stabilized so that more work can be done on the security. I always wonder, how can they may a secure browser if they are constantly adding features to it?
What else do we need for a browser to do?
I'm serious, what else do we really need a browser to do? Can we stop for awhile and work on making one more secure?

Re:WTF ?

[doas777]

it's seems to me to be an indication that we are pushing new functionality before the basis upon which it functions is mature enough to be safely reviewed. the complexity of a given computing environment is increasing at an approximately exponential rate, so there is more and more that need be tested and vetted everyday.
there are just some things that we need to accept aren't safe yet. As much as I like active web pages like this one, the problems with CGI and javascript persist even today, despite a decade+ of review and testing. I find online banking and drivers license registeration very convient, but at the same time, I firmly believe that there is no way to be safe when performing fiscal transactions online. don't get me wrong, I use these services, but I wish the chaotic computing environment would slow down a bit so we can catch up with the securiy problems of last year, before facing next years.

Or, ...

[reiisi]

Once or twice meant something, but now it's an institution.

Meaning that somebody is going to try to make a career of breaking the easiest part of the system at this contest.

Meaning that these guys are going to sit on their exploits.

Meaning that this contest, running at a set time once a year, is now meaningless.

Except for advertising potential. You know, keeping your product name in the headlines.

The respective companies should offer a running bounty on exploits on their browsers. Yeah, that would spoil all the pageantry of Pwn20wn, but do we really need another pageant?

Re:Or, ...

[Nazlfrag]

They change the rules and targets each year. Nobody will sit on an exploit all year because there's no way to know what to hang on to, or whether the hole will still be there in a month, let alone a year. It's used to promote the Zero Day Initiative which pays you directly for exploits, no fancy contest needed. The contest serves its purpose perfectly. It's never been a meaningful way to stop exploits anyway, just a promotional vehicle for the conference and the respective companies. Nobody's going to make a career out of this competition. If they were good enough to do that, they could make a comfortable living from the ZDI.

Re:Or, ...

[pyrrhonist]

Nobody will sit on an exploit all year because there's no way to know what to hang on to, or whether the hole will still be there in a month, let alone a year.

That's exactly what happened this year:

I actually found this bug before last year's Pwn2Own but, at the time, it was harder to exploit. I came to CanSecWest last year with two bugs but only one exploit. Last year, you could only win once so I saved the second bug. Turns out, it was still there this year so I wrote another exploit and used it this year.

Re:Or, ...

[Fred_A]

That's exactly what happened this year:

I actually found this bug before last year's Pwn2Own but, at the time, it was harder to exploit. I came to CanSecWest last year with two bugs but only one exploit. Last year, you could only win once so I saved the second bug. Turns out, it was still there this year so I wrote another exploit and used it this year.

So in a way what this event did is help keep a known vulnerability open for a year more than it should have been. Which means that there is a fair chance that in the mean time some body else might have found and used it in the wild.

Brilliant.

No details?

[rbanzai]

I checked the article and there don't appear to be any details. A few of these hacking contests have been a bit overblown so I'd like to know what manner of exploit they used.

If it's another "well you need physical access to the machine and know the admin username and password" then it's no big deal. If it's "we had the user click a link and all hell broke loose" that would be much more interesting.

Re:No linux?

[RiotingPacifist]

firefox is firefox, it runs on linux, it can be exploited on linux. NOSCRIPT FTW

Re:No linux?

[ld a,b]

The same hole can have different levels of exploitability in different OSes. FF for Windows cannot take advantage of ASLR because Windows XP didn't support it. In Linux it should be enabled by default by now. MacOS X has nothing at all yet.

If all OSes would implement all of OpenBSD security features, even if not perfectly, the amount of exploitable bugs would decrease considerably. The bug is still there, but the black hat is met with a harsh environment totally unlike the green garden that are major OSes.