Slashdot Mirror
First Pwn2Own 2009 Contest Winners Emerge
mellowdonkey writes "Last year's CanSecWest hacking contest winner, Charlie Miller, does it again this year in the 2009 Pwn2Own contest. Charlie was the first to compromise Safari this year to win a brand spankin new Macbook. Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well. Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program."
Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well.
Wow.
Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well.
Wow.
Wow.
But Safari was created by the Gods at Apple....
Or both.
Nonsense, all exploits used at these have already been know to at least the competitor. Afterwords they are submitted to the developers. This competition is used to give recognition to security researchers and improve browsers not to prove anything about a certain program.
I think that something is very wrong with the security features of these apps or the OS on which they were run.
I'd like to see a browser stabilized so that more work can be done on the security. I always wonder, how can they may a secure browser if they are constantly adding features to it?
What else do we need for a browser to do?
I'm serious, what else do we really need a browser to do? Can we stop for awhile and work on making one more secure?
it's seems to me to be an indication that we are pushing new functionality before the basis upon which it functions is mature enough to be safely reviewed. the complexity of a given computing environment is increasing at an approximately exponential rate, so there is more and more that need be tested and vetted everyday.
there are just some things that we need to accept aren't safe yet. As much as I like active web pages like this one, the problems with CGI and javascript persist even today, despite a decade+ of review and testing. I find online banking and drivers license registeration very convient, but at the same time, I firmly believe that there is no way to be safe when performing fiscal transactions online. don't get me wrong, I use these services, but I wish the chaotic computing environment would slow down a bit so we can catch up with the securiy problems of last year, before facing next years.
Once or twice meant something, but now it's an institution.
Meaning that somebody is going to try to make a career of breaking the easiest part of the system at this contest.
Meaning that these guys are going to sit on their exploits.
Meaning that this contest, running at a set time once a year, is now meaningless.
Except for advertising potential. You know, keeping your product name in the headlines.
The respective companies should offer a running bounty on exploits on their browsers. Yeah, that would spoil all the pageantry of Pwn20wn, but do we really need another pageant?
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Browsers
Chrome: 0
IE8: 1
Firefox: 1(1)*
Safari: 2(1)*
Mobile Browsers
Blackberry: 0
Android: 0
iPhone: 0
Nokia/Symbian: 0
Windows Mobile: 0
*Numbers in parenthesis indicate Successful exploits that fell outside the contest criteria and therefore could not be rewarded.
In Soviet Russia, Trojan exploits YOU!
Firefox Three for the Elven-kings under the sky,
IE Seven for the Dwarf-lords in their halls of stone,
Netscape Nine for Mortal Men doomed to die,
One Safari for the Dark Lord on his dark throne
In the Land of Apple where the Shadows lie.
One Browser to rule them all, One Browser to find them,
One Browser to bring them all and in the darkness bind them
In the Land of Apple where the Shadows lie.
>"we had the user click a link and all hell broke loose"
That is exactly what happened with Safari on MacOS, in seconds. I guess the others fell just as easily, but with a bit more crude exploits.
We don't get to know the details because vendors get to fix the hole before anything is published, which is long after all of us have forgotten about the contest.
What really is misleading is that Windows 7 and MacOS are implied pwned when it appears that only the browsers were taken.
With IE8 purportedly running in a "sandbox", breaking out of that was interesting by itself and hopefully a bit more difficult than just escalating privileges in MacOS.
I miss Linux too. A hole in firefox means being just one local exploit away from pwning your box.
10 little-endian boys went out to dine, a big-endian carp ate one, and then there were -246.
thats why its time for andriod style security on the desktop , firefox should ONLY be able to write to a downloads folder & its profile, OO should ONLY be able to read/write to disk, NO network access,.
IranAir Flight 655 never forget!
firefox is firefox, it runs on linux, it can be exploited on linux. NOSCRIPT FTW
IranAir Flight 655 never forget!
Is it just me, or does it look like they censored Nils' zipper when he was showing off his winnings?
I have no idea - but why were you were looking down there in the first place?
#DeleteChrome
Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program.
I see no details here.
No, it was via Safari's very outdated internal copy (probably even a fork, from what I recall) of the pcre regex library. I think the equivalent bug had been fixed in the upstream library ages before.