Slashdot Mirror
First Pwn2Own 2009 Contest Winners Emerge
mellowdonkey writes "Last year's CanSecWest hacking contest winner, Charlie Miller, does it again this year in the 2009 Pwn2Own contest. Charlie was the first to compromise Safari this year to win a brand spankin new Macbook. Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well. Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program."
But Safari was created by the Gods at Apple....
Actually, if I'm remembering correctly, Charlie Miller DID say that he knew of more ways to crack into a mac. He also said that Mac was just as insecure as Windows and that Windows gets attacked mainly because of the number of people using it.
Browsers
Chrome: 0
IE8: 1
Firefox: 1(1)*
Safari: 2(1)*
Mobile Browsers
Blackberry: 0
Android: 0
iPhone: 0
Nokia/Symbian: 0
Windows Mobile: 0
*Numbers in parenthesis indicate Successful exploits that fell outside the contest criteria and therefore could not be rewarded.
In Soviet Russia, Trojan exploits YOU!
Nevermind,
Mac easiest to hack, says $10,000 winner
Firefox Three for the Elven-kings under the sky,
IE Seven for the Dwarf-lords in their halls of stone,
Netscape Nine for Mortal Men doomed to die,
One Safari for the Dark Lord on his dark throne
In the Land of Apple where the Shadows lie.
One Browser to rule them all, One Browser to find them,
One Browser to bring them all and in the darkness bind them
In the Land of Apple where the Shadows lie.
Since no one has placed what 'owned' means, here's the rules from the canwest site:
2009-03-18-01:00:00 PWN2OWN Final Rules
Well after much discussion and deliberation here is the final cut at scenarios for the PWN2OWN competitions.
Browsers and Associated Test PAltform
Vaio - Windows 7
* IE8
* Firefox
* Chrome
Macintosh
* Safari
* Firefox
Day 1: Default install no additional plugins. User goes to link. .net, quicktime. User goes to link. ... User goes to link
Day 2: flash, java,
Day 3: popular apps such as acrobat reader
What is owned? - code execution within context of application
=====
I'm presuming that code execution is the first step towards owning the whole box, which may or may not be trivial once you got code execution happening within the app.
Actually, if I'm remembering correctly, Charlie Miller DID say that he knew of more ways to crack into a mac. He also said that Mac was just as insecure as Windows and that Windows gets attacked mainly because of the number of people using it.
BURN HIM ! BURN THE HERETIC !
>"we had the user click a link and all hell broke loose"
That is exactly what happened with Safari on MacOS, in seconds. I guess the others fell just as easily, but with a bit more crude exploits.
We don't get to know the details because vendors get to fix the hole before anything is published, which is long after all of us have forgotten about the contest.
What really is misleading is that Windows 7 and MacOS are implied pwned when it appears that only the browsers were taken.
With IE8 purportedly running in a "sandbox", breaking out of that was interesting by itself and hopefully a bit more difficult than just escalating privileges in MacOS.
I miss Linux too. A hole in firefox means being just one local exploit away from pwning your box.
10 little-endian boys went out to dine, a big-endian carp ate one, and then there were -246.
Is it just me, or does it look like they censored Nils' zipper when he was showing off his winnings?
I have no idea - but why were you were looking down there in the first place?
#DeleteChrome
That's exactly what happened this year:
I actually found this bug before last year's Pwn2Own but, at the time, it was harder to exploit. I came to CanSecWest last year with two bugs but only one exploit. Last year, you could only win once so I saved the second bug. Turns out, it was still there this year so I wrote another exploit and used it this year.
So in a way what this event did is help keep a known vulnerability open for a year more than it should have been. Which means that there is a fair chance that in the mean time some body else might have found and used it in the wild.
Brilliant.
May contain traces of nut.
Made from the freshest electrons.