Slashdot Mirror
All Five Smartphones Survive Pwn2Own Contest
CWmike writes "Although three of the four browsers that were targets in the PWN2OWN hacking contest quickly fell to a pair of researchers, none of the smartphones were successfully exploited. TippingPoint had offered $10,000 for each exploit on any of the phones, which included the iPhone and the BlackBerry, as well as phones running the Windows Mobile, Symbian and Android operating systems. 'With the mobile devices so limited on memory and processing power, a lot of [researchers'] main exploit techniques are not able to work,' said TippingPoint's Terri Forslof. 'Take, for example, [Charlie] Miller's Safari exploit,' referring to Miller's 10-second hack of a MacBook via an unpatched Safari vulnerability that he'd known about for more than a year. 'People wondered why wouldn't it work on the iPhone, why didn't he go for the $10,000?' she said. 'The vulnerability is absolutely there, but it's a lot tougher to exploit on the iPhone.'"
Chrome was the only browser at the contest that was not successfully exploited. We previously discussed day one of the contest, and a summary of day two is available as well.
They name the iPhone and Blackberry and 3 OS's. Poorly worded much?
"should work on the iPhone but the bug couldn't (be) used twice in the competition."
So the iPhone should be quite vulnerable, but wasn't compromised because it wouldn't have been eligible for the award since it was the same exploit used against OS X in the first day.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
I saw one of them Symbian's on the internet once. But I didn't know it could have a browser. I thought it was used more for content production.
Chrome was the only browser in the contest that was not successfully exploited... why didn't they include Opera, or any of the non-webkit open source browsers other than Firefox? (Ok, they may be fairly obscure, but surely Opera is well known enough, right?)
[citation needed]
æeee!
Miller's 10-second hack of a MacBook via an unpatched Safari vulnerability that he'd known about for more than a year.
Definitely a black hat then, as I'm assuming if he'd reported the vulnerability when he'd found it even Apple would have patched it by now.
"none....was..." puhleeze!
AT&ROFLMAO
A quick Google Pulled up the Phones as:
Phones (and associated test platform)
* Blackberry(TBA)
* Android(Dev G1)
* iPhone(locked 2.0)
* Nokia/Symbian(N95-1)
* Windows Mobile (HTC Touch)
Browsers
Chrome: 0***
IE8: 1**
Firefox: 1(1)*
Safari: 2(1)*
Mobile Browsers
Android: 0
iPhone: 0
Nokia/Symbian: 0
Windows Mobile: 0
Blackberry: 0****
*Numbers in parenthesis indicate Successful exploits that fell outside the contest criteria and therefore could not be rewarded.
**Exploit Confirmed by MS
***Chrome was impacted by one of the flaws, although exploit was not possible using any current known techniques.
****The Blackberry was attempted and resulted in "Something Interesting", but not an exploit.
In Soviet Russia, Trojan exploits YOU!
DIE HACKER DIE
Your German is unintelligible to me.
The static point is that if you find an exploit, you are under no obligation to inform the vendor. You are not evil if you do not inform the vendor.
I couldn't disagree more. If I walk by a house and see that the door is standing wide open, and then I see the owner on the street a couple minutes later, the ethics are clear. I should tell the guy he left his door open. I'm under no legal obligation but I should because it is the right thing to do. If he gets robbed later I should feel bad because I could have helped prevent it.
Well maybe you say, no, they're a business. Doesn't matter. If I'm in a jewelry store and see that a clerk forgot to put away a diamond ring, which is the more ethical choice of action: ignore it and walk away, or remind the clerk to put it away?
It is NOT ethical to go through life just ignoring what you perceive. Copping out is a choice too. Didn't you see Spiderman??
It's particularly bad if you go around LOOKING for open doors or unlocked jewelry cabinets. You want to try to convince me that it's ok to spend a lot of time and effort looking for flaws, then just walk away when one is found? That seems like a ridiculous argument to me. Who goes through a bunch of effort and trouble to find a weakness, and then just blithely does nothing?
Sorry, but I think you are a scumbag if you find an exploit in a popular OS or piece of software and do not report it to the vendor. Because if you found it, someone else will too and eventually it will get exploited. That will have a real impact on real people and you could have prevented it.
If that doesn't seem fair, here's the way out--don't go looking for exploits unless you're contracted to do it. It's a very fair bargain--you don't waste your time and society doesn't hold you responsible for that choice. But please don't ask me to believe that it's ok to go hunting for exploits, but then it's somehow someone else's fault you don't get paid for the ones you find. That is what consulting contracts are for.
Build a man a fire, he's warm for one night. Set him on fire, and he's warm for the rest of his life.