Slashdot Mirror
All Five Smartphones Survive Pwn2Own Contest
CWmike writes "Although three of the four browsers that were targets in the PWN2OWN hacking contest quickly fell to a pair of researchers, none of the smartphones were successfully exploited. TippingPoint had offered $10,000 for each exploit on any of the phones, which included the iPhone and the BlackBerry, as well as phones running the Windows Mobile, Symbian and Android operating systems. 'With the mobile devices so limited on memory and processing power, a lot of [researchers'] main exploit techniques are not able to work,' said TippingPoint's Terri Forslof. 'Take, for example, [Charlie] Miller's Safari exploit,' referring to Miller's 10-second hack of a MacBook via an unpatched Safari vulnerability that he'd known about for more than a year. 'People wondered why wouldn't it work on the iPhone, why didn't he go for the $10,000?' she said. 'The vulnerability is absolutely there, but it's a lot tougher to exploit on the iPhone.'"
Chrome was the only browser at the contest that was not successfully exploited. We previously discussed day one of the contest, and a summary of day two is available as well.
They name the iPhone and Blackberry and 3 OS's. Poorly worded much?
"should work on the iPhone but the bug couldn't (be) used twice in the competition."
So the iPhone should be quite vulnerable, but wasn't compromised because it wouldn't have been eligible for the award since it was the same exploit used against OS X in the first day.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
I saw one of them Symbian's on the internet once. But I didn't know it could have a browser. I thought it was used more for content production.
Chrome was the only browser in the contest that was not successfully exploited... why didn't they include Opera, or any of the non-webkit open source browsers other than Firefox? (Ok, they may be fairly obscure, but surely Opera is well known enough, right?)
[citation needed]
æeee!
Steve Jobs' attitude is focused on usability and looks, not security. Apple has more than one employee, and I also bet there's more than one person assigned to software security.
Maybe there's just too much money to be had selling phone hacks. Miller has already said that $10,000 was well below the market value of some of the exploits used in the contest.
Call me crazy but I still wouldn't call it a true "hack" when it requires someone to click on a link. No browser can protect against human gullibility.
I look at it as the difference between pushing past an old lady and robbing her after you told her you were from the electric company as opposed to a cat burglar "tip toe in and tip toe out and they don't realize they were robbed until you're long gone".
Both are bad, mind you, but only one of them actually requires skill.
http://discussions.apple.com/thread.jspa?messageID=9193300&tstart=0 I'm suprised this bug hasn't be used as a "toe hold" for an exploit.
Miller's 10-second hack of a MacBook via an unpatched Safari vulnerability that he'd known about for more than a year.
Definitely a black hat then, as I'm assuming if he'd reported the vulnerability when he'd found it even Apple would have patched it by now.
"none....was..." puhleeze!
AT&ROFLMAO
A quick Google Pulled up the Phones as:
Phones (and associated test platform)
* Blackberry(TBA)
* Android(Dev G1)
* iPhone(locked 2.0)
* Nokia/Symbian(N95-1)
* Windows Mobile (HTC Touch)
I missed the joke. Can someone tell me?
Oh, I keep mixing up the Symbian and the Sybian.
Browsers
Chrome: 0***
IE8: 1**
Firefox: 1(1)*
Safari: 2(1)*
Mobile Browsers
Android: 0
iPhone: 0
Nokia/Symbian: 0
Windows Mobile: 0
Blackberry: 0****
*Numbers in parenthesis indicate Successful exploits that fell outside the contest criteria and therefore could not be rewarded.
**Exploit Confirmed by MS
***Chrome was impacted by one of the flaws, although exploit was not possible using any current known techniques.
****The Blackberry was attempted and resulted in "Something Interesting", but not an exploit.
In Soviet Russia, Trojan exploits YOU!
no.
According to these guys, opera mini is the second most used mobile browser No idea if these are accurate stats, just what I found with a quick search.
After all... As TSA states - there is a world market for maybe five smartphones.
Mit der Dummheit kämpfen Götter selbst vergebens
DIE HACKER DIE
Your German is unintelligible to me.
He says, to a message board of hackers, owned and operated by hackers...
Be seeing you. :)
I don't think anyone claimed that OS X was or would be going forward perfect. That doesn't mean that it is not well ahead of Windows in terms of a secure design.
Except for ending slavery, the Nazis, communism, & securing American independence, war has never solved anything.
DIE HACKER DIE
Your German is unintelligible to me.
I'll translate that to English for you:
The Hacker The
Your German is unintelligible to me.
I think he's talking about a female hacker... we all know there are no girls on the internet, so he truly makes no sense.
The guys are holding out for "maximum market value" for their talent.
"Vulnerabilities have a market value so it makes no sense to work hard to find a bug, write an exploit and then give it away." - Charlie Miller
What?
The static point is that if you find an exploit, you are under no obligation to inform the vendor. You are not evil if you do not inform the vendor.
I couldn't disagree more. If I walk by a house and see that the door is standing wide open, and then I see the owner on the street a couple minutes later, the ethics are clear. I should tell the guy he left his door open. I'm under no legal obligation but I should because it is the right thing to do. If he gets robbed later I should feel bad because I could have helped prevent it.
Well maybe you say, no, they're a business. Doesn't matter. If I'm in a jewelry store and see that a clerk forgot to put away a diamond ring, which is the more ethical choice of action: ignore it and walk away, or remind the clerk to put it away?
It is NOT ethical to go through life just ignoring what you perceive. Copping out is a choice too. Didn't you see Spiderman??
It's particularly bad if you go around LOOKING for open doors or unlocked jewelry cabinets. You want to try to convince me that it's ok to spend a lot of time and effort looking for flaws, then just walk away when one is found? That seems like a ridiculous argument to me. Who goes through a bunch of effort and trouble to find a weakness, and then just blithely does nothing?
Sorry, but I think you are a scumbag if you find an exploit in a popular OS or piece of software and do not report it to the vendor. Because if you found it, someone else will too and eventually it will get exploited. That will have a real impact on real people and you could have prevented it.
If that doesn't seem fair, here's the way out--don't go looking for exploits unless you're contracted to do it. It's a very fair bargain--you don't waste your time and society doesn't hold you responsible for that choice. But please don't ask me to believe that it's ok to go hunting for exploits, but then it's somehow someone else's fault you don't get paid for the ones you find. That is what consulting contracts are for.
Build a man a fire, he's warm for one night. Set him on fire, and he's warm for the rest of his life.
He said he's not going to go through the trouble of finding and bugs and writing an exploit and then giving it away to Apple for free when they pay others money to do the exact same thing.
I guess I missed the part where someone put a gun to his head and forced him to go through all that trouble. He's right that some people do get paid to find bugs--and if he wants to get paid, he should get one of those jobs. Otherwise, yes, he's a black hat. Dark grey, minimum. It's not like this is the only thing a programmer can choose to do with their skills and time.
Build a man a fire, he's warm for one night. Set him on fire, and he's warm for the rest of his life.
$50000 to $2000000 is more like it (probably $250000)
To spell it out:
50 thousand to 2 million, probably a quarter million
That's 5x to 200x the $10000 that was paid. (probably 25x)
DAS HÄCKER DER
better?
It appears that the IPhone was pwned but the hacker didn't think $10,000 was enough money to give up the exploit.
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=Mobile+and+Wireless&articleId=9130346&taxonomyId=15&pageNumber=2
The Computer World article by Gregg Keizer regarding this has been updated. The vulnerability from pwn2own which additionally impacts the iphone was the one discovered by German researcher "Nils" and not the one demonstrated by Charlie Miller.