Chrome, Firefox, IE 10, Java, Win 8 All Hacked At Pwn2Own

← Back to Stories (view on slashdot.org)

Chrome, Firefox, IE 10, Java, Win 8 All Hacked At Pwn2Own

Posted by timothy on Thursday March 7, 2013 @02:28AM from the soooory-eh dept.

mask.of.sanity writes "Annual Canadian hack fest Pwn2Own is famous for leaving a trail of bloodied software bits and today it did not disappoint. Security researchers tore holes through all major web browsers, breaking Windows 8 and Java, too (though the latter feat is not remarkable). Thankfully for the rest of us, the cashed-up winners will disclose the holes quietly to Microsoft, Mozilla, Google and Oracle, and the proof of concept attack code will remain in the hands of organisers only."

183 comments

Min score:

Reason:

Sort:

Windows 8 by Anonymous Coward · 2013-03-07 02:31 · Score: 4, Funny

Installing Windows 8 doesn't count as hacking it...
1. Re:Windows 8 by Anonymous Coward · 2013-03-07 10:32 · Score: 0
  
  It's a Microsoft product.
  If you install it, you're pwned.
2. Re:Windows 8 by Anonymous Coward · 2013-03-08 06:33 · Score: 0
  
  Mac sucks, basically why waste your time with the little kids? The big boys are linux, and linux and linux
  '
3. Re:Windows 8 by Anonymous Coward · 2013-03-08 06:37 · Score: 0
  
  Oh shit, wrong thing :( embarrassing
What? Not Mac? It must be impervious to hacks by Anonymous Coward · 2013-03-07 02:34 · Score: 1, Funny

Right?
Fundamentally Flawed by Anonymous Coward · 2013-03-07 02:35 · Score: 1

So, at what point do we wake up and realize that current models of hardware and software development are fundamentally flawed in terms of having products which by their very nature introduce unacceptable security risks to store any data or information? (I was going to write data or information which can cause monetary loss or expense, but really...)
Or, rather, at what point does someone wake up and develop a system that can be trusted out of the box to be secure? And consumer buys into the nature that while shopping / releasing credit card data / etc. is fun and may be necessary, but it is in the best interest to pay a little more for a (less advanced) system that does not and can not be exploited?
1. Re:Fundamentally Flawed by Shados · 2013-03-07 02:40 · Score: 5, Interesting
  
  Humans have been building infrastructure, houses, buildings, for thousands of years, and they still make mistakes (honest or out of greed by cutting corners) and these life critical infrastructure still fail left and right.
  Software is often more complex, require more people to build, and often have stricter constraints for people who don't understand it, even though we haven't been writing software all that long.
  In a few thousand years, if software doesn't have the same failure rate as building bridges does today, wake me up.
2. Re:Fundamentally Flawed by alen · 2013-03-07 02:46 · Score: 1, Insightful
  
  apple did something like this with the latest version of OS X and the ability to block the install of any software outside of their app store
  but the slashtarts were up in arms about this and how it violates their rights and whatever
3. Re:Fundamentally Flawed by robmv · 2013-03-07 02:47 · Score: 5, Informative
  
  ChromeOS was designed to be tamper resistant, so it can detect changes on the installed code. but the UI is a freaking browser and because of that any vulnerability on the browser that doesn't need changes on the installed code is possible, like reading your stored passwords, accessing your web sites sessions, etc.
4. Re:Fundamentally Flawed by bdcrazy · 2013-03-07 02:49 · Score: 3, Interesting
  
  People will not pay extraordinary amounts for slightly better hardware and software. (no apple doesn't count, they are good value for money, though you can't get good enough for low money from them.) Take for instance houses. People still make wood stick frame houses, even though they are quite lousy for insulation and longevity. A much better masonry or adobe house costs roughly 5-10% more, but they are very few and far between. Now take what most people are willing to pay for hardware ($0, free with subscription!) and software ($0). Now how does that figure into building them?
  
  --
  Tonights forecast: Dark. Continued dark throughout most of the evening, with some widely-scattered light towards morning
5. Re:Fundamentally Flawed by rtfa-troll · 2013-03-07 02:52 · Score: 3, Interesting
  
  So, at what point do we wake up and realize that current models of hardware and software development are fundamentally flawed in terms of having products which by their very nature introduce unacceptable security risks to store any data or information? (I was going to write data or information which can cause monetary loss or expense, but really...)
  This insight is as old as the hills. Or at least the '80s. It is the fundamental driver behind the "full disclosure" movement which has, in a sense, been and gone.
  
  Or, rather, at what point does someone wake up and develop a system that can be trusted out of the box to be secure? And consumer buys into the nature that while shopping / releasing credit card data / etc. is fun and may be necessary, but it is in the best interest to pay a little more for a (less advanced) system that does not and can not be exploited?
  Start by defining "trusted". Should my local system block me from putting my Visa card number into a web site because the web site isn't safe?
  If you mean "locally trusted"; top level, secure operating systems running on very secure hardware have been build. Even in military applications they have become a commercial failure because it takes too long to build a feature on such a system so they mostly don't do the things that people need of them.
  So; in the end; the answer to this is that things will only get better when people are willing to sacrifice some feature development for more secure development. Ask yourself; how many of us today are posting from OpenBSD? How many of us are posting from inside an SELinux sandbox? Both of those already have all of the features needed to do so. If you aren't willing to make the small sacrifices needed to run OpenBSD or web browse from inside a proper sandbox, how can you complain about the fact that the rest of the world which is even less interested in technology won't do anything about it?
  Just start giving companies selling (N.B. not programmers writing; it has to be commercial system distributors) computer systems some liability for security failures (e.g. up to a max. of 10 times the price of the product they sold) and this will become much much better. As long as nobody's willing to do that nothing will happen.
  
  --
  =~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
6. Re:Fundamentally Flawed by fredprado · 2013-03-07 02:58 · Score: 1
  
  Or, rather, at what point does someone wake up and develop a system that can be trusted out of the box to be secure
  Sorry, but that is simply impossible. Nothing is perfectly secure and nothing will ever be.
7. Re:Fundamentally Flawed by fredprado · 2013-03-07 03:00 · Score: 1
  
  Even if they do pay a lot for it, they will still end with a system that can and will be eventually exploited. The amount of effort it will take will be greater, most likely, but it does not grow as fast as the money you have to pour into the system.
8. Re:Fundamentally Flawed by ledow · 2013-03-07 03:04 · Score: 5, Interesting
  
  When pigs fly.
  Seriously, this is like saying "why doesn't someone just make a car that can't crash, or a plane that will never stop flying?".
  We can make computers that you can bet your life on. They still fail, but the failure rate is so low that we can bet people's lives on them every day (I'm not talking traffic lights - whose total failure isn't really that big of a deal in the long run, but things like life-support machines, nuclear reactors, etc.). It's EXTRAORDINARILY expensive, and relies on there being an absolute minimum of human input at runtime.
  Even spacecraft and aircraft send two or three of the same computers up so they can just swap them out or take the majority vote. You can design systems all you like to be infallible, the fact is that they aren't - even in terms of hardware, and certainly not in terms of software. And the more you want to do with them, the more the work needed to eliminate problems increases - usually exponentially.
  Have you seen how much it costs to formally prove code? Hell, just putting the requirements to begin the process can be something more expensive than an entire development cycle of conventional programming, and still contain human errors that the computer will happily prove to be correct (because they are) even if that's not what the humans involved intended (and thus you have a classic software bug again).
  By comparison, your web browser is more complex, has more to do, updates more often (new specs and features, etc.) and is business-class programming, not critical. It would take decades or even centuries of man-hours to formally prove even a tiny section of it and every time it changes you need to do it again.
  You can't design a secure language to express these things in. You can't design a machine that will cope with anything. You can't design a process involving humans that will be infallible.
  Hell, we can't even design a piece of software that will find these bugs by itself (or else we wouldn't need bug-testing) - and yet MILLIONS is spent every year on products that help do just that (static code analysers, fuzz-testers, standard-compliance suites, etc.).
  You will never have a "secure" computer, as long as its users and designers are human. When machines start to replicate themselves and write their own operating systems, then maybe it's possible (but how to get there without relying on the output of a human to do that job in the first place?).
  Until then, honestly, what do you suggest? A "secure" programming language? There's been hundreds of attempts and ironically Java was one of them (it's all contained within a virtual machine, don't you know?, and thus can't damage the computer it's installed on.... least that's how it was sold for over TWO DECADES).
  Summary: It ain't gonna happen in your lifetime. You can deal with it, or prove everyone in CS wrong.
9. Re:Fundamentally Flawed by fredprado · 2013-03-07 03:06 · Score: 0, Troll
  
  And Safari is still exploitable as is OS X and iOS. You basically forfeited your control over your system and gave a third party the power to choose for you for an illusion of safety. Congratulations.
10. Re:Fundamentally Flawed by msauve · 2013-03-07 03:08 · Score: 1
  
  "at what point does someone wake up and develop a system that can be trusted out of the box to be secure?"
  
  Today. Just don't connect to a network or use writable, removable media.
  
  It's all a matter of trust vs. risk. How much do you trust that some software officially signed through Microsoft is really OK? Or that SSL keys signed by a CA provide any security?
  
  It's easy to complain - you're saying it's "fundamentally flawed," but not offering any examples of what isn't. People have broken into bank vaults, too.
  
  --
  "National Security is the chief cause of national insecurity." - Celine's First Law
11. Re:Fundamentally Flawed by roman_mir · 2013-03-07 03:13 · Score: 0
  
  So, at what point do we wake up and realize that current models of hardware and software development are fundamentally flawed in terms of having products which by their very nature introduce unacceptable security risks to store any data or information?
  - at no point, because it's not true.
  There is nothing flawed about our hardware and software models, nothing more flawed than for example our own replication machinery built into each one of us, and it is complex and it sometimes produces unfortunate results.
  It is all a cost benefit analysis and basically if we were to scrap our current models and to throw away the hardware and the software and to start from scratch (or whatever you are talking about), the results would be similar to us giving up all of our technology and going back to the caveman ages because we don't have the perfect technology and perfect outcomes and perfect solutions.
  Cost benefit tells us that we put as much energy as we can to build up these systems and we are getting a very good use of them and that if we tried to spend every waking moment of every day just trying to build the most perfect solutions, the benefit would be very marginal and not actually worth the effot (not that we would succeed, by the way, that's not a guarantee at all).
  
  --
  You can't handle the truth.
12. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 03:17 · Score: 0
  
  Nobody forfeited anything. You can still easily install unsigned apps. It's just another safety precaution and it's perfectly reasonable.
13. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 03:17 · Score: 0
  
  Nothing is perfectly secure and nothing will ever be.
  Earth's core... the Sun... the surface of Jupiter... the massive black hole at the center of the galaxy... I'd like to see any scenario where these are hacked.
14. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 03:18 · Score: 0
  
  NASA is the most serious organization out there about that sort of thing and even they have bugs. You are asking for a unicorn. Theoretically, we could probably bio-engineer a unicorn, and the expense and inventions necessary for that would be less than for making all software bug-free. So actually, you are asking for something that is harder to get than a unicorn is. Could happen sometime, not soon, probably nuclear fusion will be a viable way of making power well before we have bug-free software.
15. Re:Fundamentally Flawed by fuzzyfuzzyfungus · 2013-03-07 03:19 · Score: 1
  
  Local attackers might be fundamentally unsolvable, I'll leave that one to the physicists; but attackers who don't get to modify the hardware face the limits of the fact that software is ultimately math, and math about which certain things can be proven.
  It is true that it is arduous and/or impossible to prove many of the properties we are interested in in software complex enough to actually have any customers; but it isn't impossible in the general sense.
16. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 03:21 · Score: 0
  
  I guess people could take issue with placing that authority in some ELSE's hands....in this case Apple.
17. Re:Fundamentally Flawed by PerfectionLost · 2013-03-07 03:24 · Score: 1
  
  When software stops being made for end users.
18. Re:Fundamentally Flawed by smash · 2013-03-07 03:29 · Score: 2, Insightful
  
  ChromeOS was designed to make google money out of the box. Secure out of the box is/was primary marketing slogan.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
19. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 03:29 · Score: 2, Informative
  
  Fool, the setting is customizable.
  Allow Applications downloaded from:
  â Mac App Store
  â Mac App Store and Identified Developers
  â Anywhere
  Choose either of these 3 options for your preferred level of control vs. safety. Change the setting any time you like.
  Yes, the power is is in the hands of the administrator.
  Now, don't you feel stupid?
20. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 03:42 · Score: 0
  
  but attackers who don't get to modify the hardware face the limits of the fact that software is ultimately math, and math about which certain things can be proven.
  Yes, like Gödel's incompleteness theorems, for instance, which pretty much state that any software can get hacked.
  There's a reason that Intel bought McAfee, because changing the problem domain from pure software to software+hardware sidesteps the conclusions of the incompleteness theorems.
21. Re:Fundamentally Flawed by Zyrill · 2013-03-07 03:59 · Score: 2
  
  You mean it is still customizable. It's not like you can install any software you want legally on your iOS appliance. But that is besides the point: even using Safari browsers, one is still susceptible to MITM, fishing, scamming ... attacks. So it isn't really a question of which browser/OS etc. you use. It is a question of infrastructure and the weakest link will always be the target.
22. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 03:59 · Score: 0
  
  Yeah. I mean, who can hack God! Let's just use God OS and be done with it. /sigh
23. Re:Fundamentally Flawed by hobarrera · 2013-03-07 04:25 · Score: 1
  
  I'm not sure how well your analogy was chosen.
  Latin american countries, for example, tend to use cement and bricks for house-building, not wood. I've never seem a wooden-framed (like the ones built in the US). I don't think those would cost less in most of the world either, since wood tends to be more expensive.
24. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 04:32 · Score: 0
  
  Agreed but the trend in software is shifting away from robustness. We build infrastructure once, get the bugs out, then use it for decades while carrying periodic maintenance only. Software and computer hardware used to be like that, but the rate of innovation accelerated and it's come to the point where companies like to add new features every month, and stop supporting older versions after a handful of years. This just doesn't allow time to get all the bugs out and every new feature introduces more bugs.
25. Re:Fundamentally Flawed by TheLink · 2013-03-07 04:33 · Score: 2
  
  I just use different browsers that are run using different restricted users. That way if my Slashdot browser gets pwned it doesn't affect my banking browsers. Nor does it affect my main user account.
  Yes these pwn2own guys probably have zero day privilege escalation exploits, but as the joke goes, I don't have to outrun the bear, I just have to outrun Joe Average. And Joe Average will never do something like this. Especially since the browser won't have enough privileges to update itself normally - I have to use another account for updating the browser. It's not that inconvenient or difficult for me. Just launch the update browser and do the updating. But you can't expect Joe Average to do that regularly (probably have to automate it for them).
  If a skilled hacker specifically target me I'd be pwned but why would they bother?
  --
  
  Too many replies beneath your current threshold
26. Re:Fundamentally Flawed by krakelohm · 2013-03-07 04:45 · Score: 1
  
  Legally you can jailbreak your iOS appliance and install anything you want.
  
  --
  You are all a bunch of idots.
27. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 04:55 · Score: 0
  
  Ask yourself; how many of us today are posting from OpenBSD? How many of us are posting from inside an SELinux sandbox?
  
  After dealing with SELinux, I have decided to take my chances with the boogieman of the wild Internet. Seriously, SELinux sucks so bad that nobody I know uses it. Not in production at work. Not even for playing around.
28. Re:Fundamentally Flawed by Zyrill · 2013-03-07 04:56 · Score: 1
  
  IMHO, that depends very much where you live. The US just banned even SIM-unlocking phones. And since jailbreaking iOS may be considered a circumvention of DRM, you also would be in violation of the DMCA and quite possibly similar laws in other countries. Or am I missing something?
29. Re:Fundamentally Flawed by cbhacking · 2013-03-07 04:58 · Score: 2
  
  OS X was listed in TFA, but not in the headline of it. That headline was pretty directly re-used for Slashdot.
  What, bias in the tech community?? No way...
  
  --
  There's no place I could be, since I've found Serenity...
30. Re:Fundamentally Flawed by fredprado · 2013-03-07 05:00 · Score: 1
  
  Legally you can jailbreak iPhones (at least for now) as it was made an exception for it, but there is no exception for iPads, for example, and jailbreaking it is and always illegal, because of DCMA.
31. Re:Fundamentally Flawed by fredprado · 2013-03-07 05:03 · Score: 1, Insightful
  
  For OS X it still is customizable. It won't be for long, though. For iOS it is not and never was.
  
  How it feels to be stupid, sheeple?
32. Re:Fundamentally Flawed by smash · 2013-03-07 05:03 · Score: 1
  
  MENTIONED in TFA. Not confirmed as hacked. It didn't fall (yet).
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
33. Re:Fundamentally Flawed by fredprado · 2013-03-07 05:04 · Score: 2
  
  Slashdot and all other tech sites are full of Safari exploit cases, my friend, including those that are used to jailbreak iOS devices.
34. Re:Fundamentally Flawed by Bob+the+Super+Hamste · 2013-03-07 06:09 · Score: 1
  
  Then why am I investigating how to secure various systems using either SELinux or AppArmor for work?
  
  --
  Time to offend someone
35. Re:Fundamentally Flawed by butalearner · 2013-03-07 06:16 · Score: 2
  
  If a skilled hacker specifically target me I'd be pwned but why would they bother?
  This is the important bit. At this point, the only people this type of thing matters to is government and corporate users that handle sensitive information. And even then, social engineering is far easier and more effective.
36. Re:Fundamentally Flawed by firewrought · 2013-03-07 06:41 · Score: 1
  
  at what point does someone wake up and develop a system that can be trusted out of the box to be secure
  Never. Security is subtle, complex, and in contention with most other design goals. Oh... you see attempts to build sandboxed hardware, OS'es, runtimes, and languages from the ground up, and these are worthwhile efforts, but as long as people are doing new stuff with computers, other people will finds ways to exploit it.
  
  --
  -1, Too Many Layers Of Abstraction
37. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 06:55 · Score: 0
  
  Certainly not with that attitude.
38. Re:Fundamentally Flawed by BasilBrush · 2013-03-07 06:56 · Score: 2
  
  For OS X it still is customizable. It won't be for long, though.
  How many years have you been claiming that now? Longer than "The Year of Linux"?
39. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 07:10 · Score: 0
  
  Most of the civilized world builds their houses out of brick and mortar. I laugh my ass off every time it comes on the news here that another tornado levelled some shithole in the US where houses are made of popsicle sticks. There's no cure for stupid, and that's a good thing -- stupid is funny!
40. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 07:11 · Score: 0
  
  The system that comes closest... Actually it's RMS' wet dream come true and there is no more binary distribution of any software and "source code access" is a phrase from the past, because source is all there is. Producing binaries is just another installation/ usage step, done as often and only when needed. Accessing and using any software entitles you to also access and use it's code.
  25th century space faring humans will at one time unearth my epic comment and decide that the real revolution started around that. Also, the lottery numbers for tomorrow are 2, 43, 12, 46, 44, 1 plus 8. The winner of tomorrow's lottery jackpot is of course, as usual:
  Yours sincerely,
  Nostradamos
41. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 07:27 · Score: 0
  
  Because you're a sadist? I tried setting the clock in Fedora once. SEL wouldn't allow it until I had a rule in place. No "put in your password and I'll make a rule" option or anything like that. It just told me to go fuck myself.
42. Re:Fundamentally Flawed by Fastolfe · 2013-03-07 07:47 · Score: 1
  
  How does Google make "money out of the box" from ChromeOS?
43. Re:Fundamentally Flawed by sjames · 2013-03-07 07:49 · Score: 2
  
  It's more extreme than that. How many houses, bridges, etc are immune to deliberate attempts to make them fail? That is, how many bridges will just shrug off shaped charges attached to each and every support column by a determined attacker? How many bank vaults can be attacked night after night forever while never showing a single mark? How many are impervious to a clever mechanical dial turner guessing the combination?
44. Re:Fundamentally Flawed by Shados · 2013-03-07 07:54 · Score: 1
  
  I'm no specialist by any mean, but I always thought houses built in wood in the US were not because of the cost of the material, but because of the labor cost. You can build up a wood frame house very, very, VERY quickly. Cement/brick need time to set in. Labor cost being significantly higher is generally the problem.
  I'm in the market in Cambridge/Boston right now, and the difference in price between a place made out of wood and one that isn't in the same are with similar metrics/features is extreme (wood houses are free in comparison to those that aren't...)
45. Re:Fundamentally Flawed by sjames · 2013-03-07 08:01 · Score: 1
  
  Probably at the point that people are ready to pay for it.
  At what point will we build houses that cannot be burned, blown to bits, crushed by a tree, or broken in to? Unlike a web browser, human lives hang in the balance with the houses we build.
46. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 08:05 · Score: 0
  
  You might also be interested in Memory Safe Programming Languages as another approach to shore up security. They still pwn software by means of C and C++ artifacts like "use after free".
  There are many more memory safe languages than Java and C#. I invented one named Sappeur, which nicely integrates with existing C++ toolchains, debuggers and code.
  http://sourceforge.net/projects/sappeurcompiler/
47. Re:Fundamentally Flawed by rtfa-troll · 2013-03-07 08:15 · Score: 1
  
  After dealing with SELinux, I have decided to take my chances with the boogieman of the wild Internet. Seriously, SELinux sucks so bad that nobody I know uses it. Not in production at work. Not even for playing around.
  Which distribution? When? Generally SELinux on Debian based distros has always been a bit disasterous. From about Fedora 10 / RHEL 5 second update it's always been great. Also if there is a problem and you bug report it properly you can get a fix within a couple of days. I never turn of SELinux on those distros at all.
  Ubuntu never really supported SELinux so forget that. You have to use AppArmor to get similar (but weaker) protection.
  
  --
  =~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
48. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 08:24 · Score: 0
  
  Your post is highly disingenuous. NASA had a highly successful control software in the Space Shuttle with no fatal bugs ever. Airbus does something similar for more than 20 years now. Boeing does so for 15 years or so.
  Flawed software can always be traced to what we call "Schlamperei" in German. The more Schlamperei your leaders tolerate or even mandate, the more serious problems you will have. But it also works in the other direction: Diligent and sound software engineering practices (from proper, comprehensive specs to proper, comprehensive test cases) can actually deliver software that is more reliable than any mechanical system will ever be.
  You just need leaders who have more active brain cells than a mouse, who have a real education, who make serious time and funding available, who are not intimidated by the "business" whores.
49. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 08:41 · Score: 0
  
  http://personales.upv.es/juaruiga/teaching/TFC/Material/Trabajos/AIRBUS.PDF
  http://www.cs.st-andrews.ac.uk/~ifs/Resources/CaseStudies/Airbus/Airbus-fcs.pdf
50. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 08:56 · Score: 0
  
  So long as there is gain, people will find ways to exploit.. anything. It's all motivation.
51. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 09:07 · Score: 0
  
  The word you are looking for is "termites".
52. Re:Fundamentally Flawed by rtfa-troll · 2013-03-07 09:58 · Score: 1
  
  Earth's core... the Sun... the surface of Jupiter... the massive black hole at the center of the galaxy... I'd like to see any scenario where these are hacked.
  I think what you are looking for is this hacking article from Wired. Given sufficient resources and determination almost nothing short of a supermassive blackhole is likely to be impossible to disrupt. Even about that I wouldn't be sure.
  
  --
  =~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
53. Re:Fundamentally Flawed by fredprado · 2013-03-07 11:55 · Score: 1
  
  Nah. Maybe since iOS came in 2007, if you really want to stretch it, and since then Apple has been pushing slowly but steadily in this direction with OS X.
  
  And although Linux desktop is still not a worry for MS, Linux has reached the end user market very well through Android mobile devices, and dominated the server market.
54. Re:Fundamentally Flawed by smash · 2013-03-07 12:44 · Score: 1
  
  For previous versions, which isn't what they were testing here.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
55. Re:Fundamentally Flawed by jhol13 · 2013-03-07 13:00 · Score: 1
  
  From the other side: houses are still being build lousily because the builders don't give a damn. Sam applies for software. I have never seen a single piece of code that has been well written. Well, perhaps one or two exceptions in the millions of software packages there are.
  A decent architecture, whether SW or a building, can make a huge difference. Now code is written so that in practice every line in the whole browser or Java or any other runtime is potential security hole. It shouldn't be that way. There should be insulation+moisture barrier / firewall-kinda-IF to the Internet.
  There is something fundamentally flawed with Java - it has all the required systems in it to make it safe - but it apparently is completely opposite. I have no clue where they (designers and programmers of the crap) went wrong.
  Same with the Mozilla - it once claimed to be safer than IE because it uses C++ Strings. That was a revelation to me, I realised it isn't a bit safer - as can be seen right now.
56. Re:Fundamentally Flawed by Ol+Olsoc · 2013-03-07 13:04 · Score: 2
  
  Wait! Did someone get a box with Chrome?
  
  --
  The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
57. Re:Fundamentally Flawed by jhol13 · 2013-03-07 13:13 · Score: 1
  
  I disagree with you whemently.
  Two or three, or seven, computers do not help if there is a SW bug. And don't give me "separate teams making different SW" bullshit, it has been proven that they all make the same mistakes.
  Formal proving? It is neither necessary and the assumptions the proof takes are usually far too lenient.
  The web browser, while complex, should not be designed so that every line of code is potential security breach - so big a hole that just looking at a textual input will give attacker whole access to your computer. Are you really claiming that using proper runtimes (managed, "jail", unprivileged, ...), proper compartment (only minor amount of code can have security effect, ect.) a safe browser cannot be done relatively easily? It might require twice the effort to write, but then it would require half the effort to keep up.
  You will never secure a computer as long as you use C/C++ - that I agree.
  What they did wrong with Java, I don't know, have not been following. It must have been huge architectural and desing and programming culture flaw.
58. Re:Fundamentally Flawed by smash · 2013-03-07 13:43 · Score: 3, Informative
  
  You do understand Google's entire business model, yes? Essentially "you give us your data, we mine it and target ads at you".
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
59. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-07 13:53 · Score: 0
  
  There's a difference between houses and software though. Construction is physical labor. At least, some of it is. Software requires cognitive skills. When it's simple tasks or physical labor, throwing more money at the problem works. That doesn't work with anything that requires cognitive tasks. More money actually leads to worse performance.
  I would guess that open source software would be more well written than some piece of commercial code, because they're doing it for a greater purpose than just money. Although, even when you do give a damn, you can't make sure code is perfect and nothing will go wrong.
60. Re:Fundamentally Flawed by BasilBrush · 2013-03-07 14:32 · Score: 1
  
  and since then Apple has been pushing slowly but steadily in this direction with OS X.
  
  But they haven't
61. Re:Fundamentally Flawed by fredprado · 2013-03-07 14:39 · Score: 1
  
  Yet...
62. Re:Fundamentally Flawed by BasilBrush · 2013-03-07 14:44 · Score: 1
  
  No, I mean they haven't "been pushing slowly but steadily in this direction with OS X."
  Arbitrary third party software is just as installable on OSX as it always was.
  Your prediction is just as wrong as it's always been. It's just stupid.
63. Re:Fundamentally Flawed by fredprado · 2013-03-07 15:03 · Score: 1
  
  They have been pushing slowly in the same way they always do. First by giving you a choice of opting for their control, as it is now, then making it mandatory.
  
  OS X isn't just like iOS yet for a single motive: Apple does not have a strong hold over the desktop market. If this happens we will see the same policies they have applied to iOS applied to OS X, that if they don't decide to merge both platforms.
64. Re:Fundamentally Flawed by fredprado · 2013-03-07 15:10 · Score: 1
  
  Just for your education. This is the last Safari release known vulnerabilities list:
  
  http://www.cvedetails.com/version/130707/Apple-Safari-5.1.7.html
65. Re:Fundamentally Flawed by BasilBrush · 2013-03-07 15:17 · Score: 1
  
  OS X isn't just like iOS yet for a single motive: Apple does not have a strong hold over the desktop market.
  Right. So you think OSX is going to get a strong hold over the desktop market (what? 80%). And that's when your long standing and long failing prediction of lock-down will happen.
  
  that if they don't decide to merge both platforms.
  Yeah right. After all Microsoft has been so successful with trying to unify the UIs on it's mobiles and desktops. (Metro) How could Apple possibly resist making such a fuck up.
  What;s happening her is you don't like Apple so you predict they will do stupid things, that will bring about their demise. Your problem is that Apple's smarter than you are.
66. Re:Fundamentally Flawed by fredprado · 2013-03-07 15:45 · Score: 1
  
  Oh and if you refer to the OS X only Safari 6 that had a prize in this event, nobody even tried to hack it in this convention...
  
  http://nakedsecurity.sophos.com/2013/03/07/pwn2own-results-java-chrome-ie-10-and-firefox-owned-on-day-one/
67. Re:Fundamentally Flawed by tibman · 2013-03-07 16:42 · Score: 1
  
  I don't think a team would show up to crack OS X if they couldn't already do it at home. But a confirmation would be good!
  
  --
  http://soylentnews.org/~tibman
68. Re:Fundamentally Flawed by fredprado · 2013-03-07 18:22 · Score: 1
  
  They are already locking their platforms, as I explained. The fact that you choose to refuse to see it it is your problem, not mine. Ignorance is an opt in, my friend. Suit yourself.
69. Re:Fundamentally Flawed by BasilBrush · 2013-03-08 01:47 · Score: 1
  
  Given that I am the one that knows OSX from daily usage, and you don't, the ignorance is all yours.
  You seem to think there's some restriction on OSX, that is not there.
70. Re:Fundamentally Flawed by fredprado · 2013-03-08 02:17 · Score: 1
  
  Sure there is you just need to enable it. Which is only an option. For now...
71. Re:Fundamentally Flawed by helix2301 · 2013-03-08 07:08 · Score: 1
  
  ChromeOS and Chrome browser both been hit really hard this year.
  
  --
  http://www.thetechnologygeek.org
72. Re:Fundamentally Flawed by Anonymous Coward · 2013-03-09 03:54 · Score: 0
  
  It isn't that hard to separate code from data, and make code immutable. They shouldn't even be on the same disk partition.
No love for Safari? by Sponge+Bath · 2013-03-07 02:35 · Score: 4, Insightful

$100,000 for popping Chrome on Windows 7; the same for hacking Internet Explorer 10 on Win 8; $75,000 for ripping up IE9 on Win 7; $60,000 for owning Firefox on Win 7; and $65,000 for exploiting Apple Safari on OS X Mountain Lion.
$65K was not enough to bang up Safari?
1. Re:No love for Safari? by MatrixCubed · 2013-03-07 03:04 · Score: 1
  
  Safari who?
2. Re:No love for Safari? by Anonymous Coward · 2013-03-07 03:19 · Score: 0, Informative
  
  Safari who?
  
  The browser that is largely responsible for WebKit being the most popular rendering engine, and whose mobile version is #1.
3. Re:No love for Safari? by smash · 2013-03-07 03:19 · Score: 2, Informative
  
  You know. The browser that probably accounts for more traffic than the built in android browser. That has previously been hacked pretty much first thing every year so far.
  Gatekeeper, sandboxing the web worker process and ARC in the development kit maybe paying off.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
4. Re:No love for Safari? by Shados · 2013-03-07 03:48 · Score: 3, Insightful
  
  The browser that probably accounts for more traffic than the built in android browser
  Built in android browser? Let see... ::pulls out his nexus phone...::
  You mean Chrome?
  Oh wait, you mean the OLD android browser, from the version of android that barely worked on the internet at all, even though it still has more marketshare.
  Yeah, no surprise that that shitty browser isn't on the radar either.
5. Re:No love for Safari? by Anonymous Coward · 2013-03-07 04:01 · Score: 0
  
  I'm not trying to continue a flame war here, but since ios accounts for more than 50% of mobile browsing the statement is accurate.
6. Re:No love for Safari? by Anonymous Coward · 2013-03-07 04:29 · Score: 0
  
  Safari who?
  
  Safari the browser they offered $65,000 to hack, that's who.
7. Re:No love for Safari? by LordLimecat · 2013-03-07 04:59 · Score: 1
  
  Theyll get there tomorrow-- they havent failed to breach OSX yet. The shocker this year is that OSX / Safari didnt fall on day one-- the question is whether thats due to actual security, perceived difficulty, or lower prize money.
8. Re:No love for Safari? by Anonymous Coward · 2013-03-07 05:04 · Score: 2, Informative
  
  Safari for Windows was abandoned (no version 6) and this year Pwn2own is targeting Windows browsers only.
9. Re:No love for Safari? by tlhIngan · 2013-03-07 05:25 · Score: 2
  
  Theyll get there tomorrow-- they havent failed to breach OSX yet. The shocker this year is that OSX / Safari didnt fall on day one-- the question is whether thats due to actual security, perceived difficulty, or lower prize money.
  That is an interesting shocker. Because usually pwn2own, the Mac goes first (because beating it got you a nice MacBook Pro), followed by Windows (normally some nice Sony laptop), and then Linux (some generic Dell). The lower prize money typically reflects that - everyone normally attacks OS X first, while the Windows and Linux ones typically are less attacked. One strategy has alwys been to go after Windows and Linux becaues everyone else is concentrating on OS X.
  And normally, OS X is not only cracked on day 1, but cracked first, followed by Windows and then Linux (usually because of the desirability of the hardware).
  Lowered prize money is a possibility, but you'd think given the range was anywhere from $110K for Windows 8 to $65K for OS X (and the range in-between - I think the next one was $75K) that it wouldn't be a huge difference. I don't think increased security is the reason as Mountain Lion has more security, but it's just like Windows 7/8 - the browser is sandboxed (just like IE and Chrome - they all run LUA). Gatekeeper is easily defeated (it only applies to files that are tagged as coming from the Internet - as an extended filesystem attribute that you can use standard tools to set and clear as long as you have permission to edit the file - and yes, those tools ship in the default config) - files originating from local media or elsewhere do not trigger it (e.g., compiler).
10. Re:No love for Safari? by JonJ · 2013-03-07 06:15 · Score: 2
  
  That is an interesting shocker. Because usually pwn2own, the Mac goes first (because beating it got you a nice MacBook Pro), followed by Windows (normally some nice Sony laptop), and then Linux (some generic Dell).
  Linux has never been hacked in pwn2own.
  
  --
  -- Linux user #369862
11. Re:No love for Safari? by Aizenmyou · 2013-03-07 06:58 · Score: 1
  
  That is an interesting shocker. Because usually pwn2own, the Mac goes first (because beating it got you a nice MacBook Pro), followed by Windows (normally some nice Sony laptop), and then Linux (some generic Dell).
  Linux has never been hacked in pwn2own.
  I don't think Linux is one of the hacking categories at Pwn2Own. http://dvlabs.tippingpoint.com/Pwn2OwnContestRules.html
12. Re:No love for Safari? by Anonymous Coward · 2013-03-08 17:14 · Score: 0
  
  Wrong. The Android browser (not Chrome mobile) is #1 for mobile.
  Also WebKit was stolen from KHTML.
Candian by Anonymous Coward · 2013-03-07 02:35 · Score: 0

Where is this country? I can't find it on a map. Mind you, as an American, I can't even find Kansas on a map. Go figure.
1. Re:Candian by MatrixCubed · 2013-03-07 02:50 · Score: 1
  
  Try looking for Kansias.
2. Re:Candian by Anonymous Coward · 2013-03-07 03:07 · Score: 0
  
  Mmmm, Candy Land. Maybe next year they can have it in the pizza province instead.
Candian? by Anonymous Coward · 2013-03-07 02:37 · Score: 0, Redundant

Candian?
Re:What? Not Mac? It must be impervious to hacks by Anonymous Coward · 2013-03-07 02:38 · Score: 3, Funny

They weren't hacking toys.
Where's Candia? by Anonymous Coward · 2013-03-07 02:46 · Score: 0

Does that knowledge also remain in the hands of organisers only?
Researchers tore holes through browsers on Windows by dgharmon · 2013-03-07 02:47 · Score: 3, Interesting

Do any of these exploits work on Linux?

--
AccountKiller
Interesting /. bias by roman_mir · 2013-03-07 02:50 · Score: 1, Interesting

Security researchers tore holes through all major web browsers, breaking Windows 8 and Java, too (though the latter feat is not remarkable).
- at this point I have to wonder what are the underlying reasons for the obvious bias present on /. against Java, because clearly there is something at work here, so where does the money trail lead? Is Dice holding a short position against Oracle or something? Is there something else going on? Is it a pro-Apple product and anti-Android stand?
Personally I dislike Oracle as a company because of their insidious penetration of all facets of medium to large businesses (everything must be Oracle), but not Java as a language or as a VM. Obviously the sandboxed JVM browser plugin has various issues, but the slander against the entire Java platform is getting repetitive.
While a Java browser plugin may have security problems, I fail to see how this relates to server side Java usage (as an example).
OTOH even /. comments are so confused, mixing terms, mixing notions such as Java and Javascript and browser plugin, etc., permanently labelling JVM (or Java, I don't know which anymore) as a 'slow language' or 'slow platform' (again, there are too many of these too keep track) and whenever somebody says something to this effect without upfront stating exactly what they are talking about, it leads to page long threads that can't even agree on teh terms they are using.
This is destructive, not constructive.

--
You can't handle the truth.
1. Re:Interesting /. bias by smash · 2013-03-07 05:07 · Score: 1
  
  The bias is against java at the moment largely because it is owned by Oracle who is evil, but also because lately, its security record has just shown it to be complete and utter CRAP.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
2. Re:Interesting /. bias by amicusNYCL · 2013-03-07 07:29 · Score: 1
  
  Obviously the sandboxed JVM browser plugin has various issues, but the slander against the entire Java platform is getting repetitive.
  As far as I see it, there are 2 major problems. One is that the name "Java" refers to too many things. Vulnerabilities get found in the Java browser plugins, and get reported as "Java vulnerabilities". Even my boss (who is no longer a programmer, and has no experience with Java, even though he runs a tech company) heard about Twitter, Facebook, Apple, et. al. getting attacked because of "Java" (specifically, the browser plugin components), and that caused him to recommend to one of our customers that they have their vendor rewrite their (server-side) Java software in another language, and saying that he didn't want to install Tomcat because of security issues. It's simple confusion among the vast majority of the public, who don't know what Java is. If they called the browser plugins something other than whatever they call them now, with a unique name, then media may correctly report that the problems are in the browser plugins and not simply problems with "Java".
  That's one reason. Like I said, I think there are 2 major reasons. The other reason is this. Like it or not, the Java browser plugins are crap and get exploited way too often for people not to notice. Their naming scheme gives all of Java a bad rap, but the browser plugins actually do deserve the shit reputation that they have. They have earned it.
  
  --
  "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
3. Re:Interesting /. bias by Anonymous Coward · 2013-03-07 09:23 · Score: 0
  I'm posting anonymously because I've already moderated in this discussion, but here goes.
  I hate Java because it sucks for my purposes:
  
  Obviously, the plugin is a security nightmare.
  The Java programming language is a Bondage and Discipline language that doesn't follow the Don't Repeat Yourself principle.
  The JVM takes forever to launch, making it a poor choice for small programs. Also, it's a write-compile-run type of language, so it can't fill the role of a REPL type of language.
  The culture that Sun built around it is terrible. Lots of people have commented on how Enterprise Java code is filled with abstract factories with uninformative function names, making it difficult to figure out exactly what the program is supposed to do. Also, the state of Java UI is horrible.
  Java is appropriate for other purposes. Just not mine.
FRONT PAGE NEWS!!! by iSterculius · 2013-03-07 02:56 · Score: 1

Wow, you mean really large complex systems can be hacked by smart people with a lot of time and sophisticated tools? Knock me over with a feather.
Re:Researchers tore holes through browsers on Wind by dacaldar · 2013-03-07 03:02 · Score: 1

You care if you own a smartphone. The new BB10 browser from BlackBerry outperforms desktop browsers in HTML5, and runs on top of QNX, which is like a more stable, secure version of Linux. I'd like to see someone try to hack that, especially in comparison to Android and iPhone.
Re:Researchers tore holes through browsers on Wind by Anonymous Coward · 2013-03-07 03:02 · Score: 0

But...but.. this is going to be the year of the linux desktop, isn't it? Yet?
Re:Researchers tore holes through browsers on Wind by Anonymous Coward · 2013-03-07 03:02 · Score: 1

Not the IE ones :) maybe the Java one
Probably the Firefox one
The chrome one partially, they used a kernel exploit to break out of the chrome sandbox
Re:Researchers tore holes through browsers on Wind by Anonymous Coward · 2013-03-07 03:06 · Score: 0

It's not like you're going to type most of your Internet passwords and your credit card details in a web browser, right?
Re:Researchers tore holes through browsers on Wind by Anonymous Coward · 2013-03-07 03:07 · Score: 0

Those of us that don't run a server.
Re:Researchers tore holes through browsers on Wind by Anonymous Coward · 2013-03-07 03:09 · Score: 0

From what I read, all the affected systems were Windows based.
Re:Researchers tore holes through browsers on Wind by Anonymous Coward · 2013-03-07 03:11 · Score: 0

QNX is a NetBSD
Safari by smash · 2013-03-07 03:12 · Score: 1

Not hacked? First time ever! :D

--
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Re:Researchers tore holes through browsers on Wind by Anonymous Coward · 2013-03-07 03:14 · Score: 5, Informative

http://www.internetnews.com/skerner/2011/03/why-pwn2own-doesnt-target-linu.html
Pwn2Own will target IE, Firefox, Safari and Chrome all running on Windows 7. Windows XP isn't on the target list and neither is Linux, for different reasons.
I spoke with Aaron Portnoy, Manager of the Security Research Team at HP TippingPoint the other day and asked him why Linux wasn't being included. Apparently the question is among the most common questions he is ever asked about Pwn2Own.
"Linux is not an operating system that has widespread use with any one particular distribution, flavor or configuration," Portnoy said. "In general Linux is still a server-based operating system, people do use it on the desktop, but you can't go to BestBuy and buy Linux with a specific distro on it that everyone uses that has widespread market share. If we were to include Linux, we'd have even more controversy and we just don't want to deal it."
Once again, no Opera by TheKeyboardSlayer · 2013-03-07 03:16 · Score: 5, Interesting

Once again, pwn2own ignores the Opera web browser. This makes me sad...I recently switched exclusively to Opera after toying around with it for almost 10 years now. I've been completely happy since. I will say this, Opera takes security more seriously than any other browser out there...just an example is when the Certificate Authority hack came into play in 2011...All other browsers were twisting their knickers but Opera just yawned and said:

Browsers that do not have protection against blocked revocation lists will need to rapidly issue an update to fix any new certificate abuse. In Opera, users are protected automatically when the certificate is revoked. If the CA has a general problem, or a CA is no longer being used, we can remove it from our list of trusted CAs behind the scenes, and the user will also be secure, without needing to change anything in her browser.
This was the default setting in opera.
In my opinion, Opera has my interests at the forefront when it comes to security. Whether or not that would translate to being more resistant to hacking attempts at pwn2own, I have no idea...but I really wish they'd give it a go one of these years just to see.

--
Insert_Ending_Here
1. Re:Once again, no Opera by Anonymous Coward · 2013-03-07 03:23 · Score: 0
  
  Opera just announced that they were basically abandoning their engine in less than a year. At that point, only Chromium will matter anyway, so while I would have agreed with you in past P2O events, this time I couldn't care less.
2. Re:Once again, no Opera by TheKeyboardSlayer · 2013-03-07 03:31 · Score: 1
  
  They're switching to a modified version of webkit for rendering and using the V8 javascript engine. A browser is much more than just a tool for rendering and a javascript engine and this is the only thing they're sucking in from Chrome.
  Just the same, the current version uses Presto...and that's the one that pwn2own could check out right now...and they haven't every tried Opera in the history of pwn2own. It'd be great if they gave it a parting shot.
  
  --
  Insert_Ending_Here
3. Re:Once again, no Opera by Anonymous Coward · 2013-03-07 05:07 · Score: 0
  
  Chrome has a silent autoupdate function. Revoking certificates is no big deal for Chrome.
  (Being the default setting, it is also the way the browser functions for over 99% of the users who haven't specifically disabled the setting. It is dishonest to claim that Opera is any more automatic in this regard than Chrome.)
4. Re:Once again, no Opera by x_t0ken_407 · 2013-03-07 05:27 · Score: 1
  
  Agreed. Sadly, we Opera users will [seemingly] ALWAYS be in the minority. Shame, really. It's really a phenomenal browser. If we could somehow get signing/encryption included for the email client, it would be fully golden, IMHO.
5. Re:Once again, no Opera by Anonymous Coward · 2013-03-07 05:35 · Score: 0
  
  "Once again, pwn2own ignores the Opera web browser."
  Just like everyone else.
6. Re:Once again, no Opera by amicusNYCL · 2013-03-07 07:49 · Score: 1
  
  While I would like to see Opera get the recognition it deserves as a good browser, I'm actually OK with it being "obscure". To me that means virtually no chance that there will be attacks targeted at the browser itself. I have plugins on click-to-play, don't have Java plugins or Acrobat even installed, and I feel just fine using Opera on any site.
  
  --
  "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
What about Opera? by Anonymous Coward · 2013-03-07 03:16 · Score: 1, Interesting

Invulnerable or did nobody try?
1. Re:What about Opera? by TheKeyboardSlayer · 2013-03-07 03:37 · Score: 2
  
  They don't try because they say the userbase is too small. But it just hit 300million users. It's also one of the most popular mobile browsers out there...it was tops in May of 2011 iirc.
  Sidenote: The organizer of pwn2own, Aaron Portnoy, supposedly uses the Opera Browser. Go figure.
  
  --
  Insert_Ending_Here
2. Re:What about Opera? by smash · 2013-03-07 05:09 · Score: 1
  
  Mobile opera, at least on iOS is just a wrapper around the iOS webkit library. All the heavy lifting is done by webkit, so as far as iOS opera goes, any vulnerability that affects Safari probably affects Opera on iOS too. And vice versa.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
3. Re:What about Opera? by amicusNYCL · 2013-03-07 07:51 · Score: 1
  
  Opera Mini is a wrapper. Opera Mobile is a full-fledged browser, I even have it send a desktop user agent string and it will render pages meant for a desktop just fine, with the speed that Opera users come to expect.
  
  --
  "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Re:Researchers tore holes through browsers on Wind by Anonymous Coward · 2013-03-07 03:16 · Score: 0

I guess not. I just installed lynx on my server to prove you wrong, but it looks like the reply button on slashdot uses javascript. I could compile links2 with javascript enabled, but I have work to do.
In the real world... by Parker+Lewis · 2013-03-07 03:21 · Score: 1

Browser, like anything in our life, cannot be 100% safe. You don't have any security system (at houses, banks, computers) 100% failsafe. Best you can do is make the "thief" life a little bit harder.
Re:Researchers tore holes through browsers on Wind by Anonymous Coward · 2013-03-07 03:23 · Score: 1

-1, ignorant and factually incorrect. It uses the NetBSD TCP/IP stack, but that doesn't make it a NetBSD. Period.
captcha: amateurs. Indeed.
Re:Researchers tore holes through browsers on Wind by smash · 2013-03-07 03:23 · Score: 1

runs on top of QNX, which is like a more stable, secure version of Linux.
The sky is blue and therefore I like rollercoasters.
Just..... no. It's like saying VMS is a more stable secure version of Windows, the two platforms have about as much in common. Probably more, given they're both the children of Dave Cutler.

--
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Why the bashing of Java? by devent · 2013-03-07 03:26 · Score: 0

I don't understand why the bashing of Java?
First, the vulnerabilities of Java are only for the Java Applets. And seconds, Java it not really a system critical component. Is more like Flash or Silverlight, or .Net. All of them have way more vulnerabilities then Java but you don't see them to be bashed all the time.
So, sure you should call out vulnerabilities so the company is going to fix them as soon as possible, but it's not that critical anyway. It's not like you just connect to the Internet and get a virus without to open any browsers first (Windows XP without SP). Any software have vulnerabilities but Java Applets are not so bad like Flash for example.

--
http://www.mueller-public.de - My site http://www.anr-institute.com/ - Advanced Natural Research Institute
1. Re:Why the bashing of Java? by smash · 2013-03-07 03:37 · Score: 1
  
  For the people who need Java, it often IS a mission critical component (and yes, often for applets). And it is a FUCKING JOKE lately. AGAIN this morning another update.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
2. Re:Why the bashing of Java? by devent · 2013-03-07 04:33 · Score: 1
  
  Did you get a virus or trojan because of a Java Applet?
  It is so bothersome to update Java? Normally it's just a popup in Windows where you can click and update.
  Your browser have probably way more security holes and I'm not see people scream "fucking joke" if they need to update Firefox again. (On my Fedora Linux I need to update Firefox every week, you don't see me scream "fucking joke").
  
  --
  http://www.mueller-public.de - My site http://www.anr-institute.com/ - Advanced Natural Research Institute
3. Re:Why the bashing of Java? by smash · 2013-03-07 04:35 · Score: 2
  
  The whole point of java was to run cross platform code in a secure manner. The fact that it is the most insecure software on a typical machine these days is the joke. And no, my browser, and yours is not less secure than Java, which has had way more than 65 vulnerabilities patched in the last month alone.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
4. Re:Why the bashing of Java? by Anonymous Coward · 2013-03-07 08:11 · Score: 0
  
  Is Java really mission critical for your random browsing? Or is it for specific sites, most likely on the intranet? Just run a separate instance of your browser with Java enabled for those specific sites, and turn it off everywhere else. And if you're bothered by the constant updates just turn auto-update off too and do it manually at your own pace.
5. Re:Why the bashing of Java? by Anonymous Coward · 2013-03-07 09:04 · Score: 0
  
  Is this so ? I have been reading lots of stories how the array bounds checking did not work correctly under all circumstances. And that means you can pwn a Java server remotely.
6. Re:Why the bashing of Java? by devent · 2013-03-07 11:33 · Score: 1
  
  You are going to based your "security meter" on how many vulnerabilities were _patched_?
  All it means is that 65 vulnerabilities were patched, nothing more.
  It's like Microsoft that try to convince people that their IIS server is more secure, because Apache had more vulnerabilities patched than IIS.
  In the Pwn2Own contest IE, Safari and Firefox were always busted, based on some sort of 0-day vulnerability. Just look at the past Pwn2Own contests. You really don't need Java at all to bust the web browsers.
  Just look at the current Pwn2Onw:
  0Day (32 Points each)
  * Google Chrome: Full sandbox escape and code execution
  * Microsoft Internet Explorer: Protective Mode Bypass and code execution
  And you think Java is the most insecure on your system? I beg to differ.
  All the news are just bashing Java for no reason. Java is not more or less secure then Firefox or IE.
  The only mistake was from was Oracle to wait so long to fix the issues. You can blame Oracle for that, but stop with the stupid Java bashing.
  
  --
  http://www.mueller-public.de - My site http://www.anr-institute.com/ - Advanced Natural Research Institute
7. Re:Why the bashing of Java? by smash · 2013-03-07 13:39 · Score: 1
  
  Sure, it's the metric by which Windows is judged when people point out how insecure it is.
  But... OK lets go by how many zero days were exploited in the wild in the last 30 days.
  It's still more than IE, Safari, Chrome and Firefox in the same time frame.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Safari wins! by goombah99 · 2013-03-07 03:28 · Score: 2, Interesting

"Safari on Mac OS X Lion was the only browser left standing at the conclusion of the zero day portion of pwn2own. "
Perhaps it's also telling that the prizes for winning are Mac Laptops.

--
Some drink at the fountain of knowledge. Others just gargle.
1. Re:Safari wins! by smash · 2013-03-07 03:35 · Score: 1
  
  It's been hacked every year previously, mostly by the same guy. I suspect that the sandboxing of the web process in the current version, gatekeeper in Mountain Lion, and ARC support in the current development tools (to make memory management easier and less prone to error) is paying off.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
2. Re:Safari wins! by Anonymous Coward · 2013-03-07 04:01 · Score: 0
  
  For what it's worth, almost every competitor was already using a Mac laptop and OS X.
3. Re:Safari wins! by Anonymous Coward · 2013-03-07 14:53 · Score: 0
  
  Perhaps it's also telling that the prizes for winning are Mac Laptops.
  It's more telling that the hacking Safari was only worth $65,000 vs. $20,000 for java that was violated more than a prostitute.
Not fundamentally, but economically? by Anonymous+Brave+Guy · 2013-03-07 03:31 · Score: 4, Informative

So, at what point do we wake up and realize that current models of hardware and software development are fundamentally flawed in terms of having products which by their very nature introduce unacceptable security risks to store any data or information?
That's hardly a secret. It's a cost/benefit question, and there is enough benefit around right now that most people are willing to pay the cost/accept a modest risk rather than going without.

Or, rather, at what point does someone wake up and develop a system that can be trusted out of the box to be secure?
You'll never have perfect security, because many useful things are inherently insecure on some level. But yes, we could certainly do a lot better than we do right now.
I personally suspect that any qualitative shift in the industry first needs the development of an industrial-scale application programming language (and a comprehensive supporting ecosystem in terms of tools and libraries) that manages to combine reasonably high performance and flexible low-level access with much stronger architectural support features than any mainstream language offers today.
We know a lot about how to build such a programming language already, and many useful techniques are already tried and tested in more academic/obscure/innovative languages. Unfortunately, this is a chicken and egg kind of problem: you need to get enough developers using your language that the ecosystem develops enough for mainstream industrial use, but attracting the non-enthusiast developers needs some sort of ecosystem to be there already. And as long as most customers are willing to pay significant money for software that doesn't have lots of bugs/vulnerabilities, accepting these things are somehow inevitable in the way that most non-geeks today probably do, there isn't sufficient commercial incentive for the few organisations that could actually do it to throw megabucks into developing the language and a bootstrappable ecosystem from scratch right now.

--
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Attack code ownership by craigminah · 2013-03-07 03:32 · Score: 3, Funny

TFA says, "Thankfully for the rest of us, the cashed-up winners will disclose the holes quietly to Microsoft, Mozilla, Google and Oracle, and the proof of concept attack code will remain in the hands of organisers only." Who wants to bet the organisers are China?
1. Re:Attack code ownership by MobyDisk · 2013-03-07 06:16 · Score: 2
  
  the proof of concept attack code will remain in the hands of organisers only
  I find it ironic that after telling us that nearly every major operating system was hacked, they conclude by assuring us that the exploit code is kept secure.
2. Re:Attack code ownership by Anonymous Coward · 2013-03-07 12:15 · Score: 0
  
  Google, I believe?
  http://en.wikipedia.org/wiki/Pwn2Own#Contest_2013
I assume that the Firefox bug is in JS? by John+Hasler · 2013-03-07 03:42 · Score: 1

n/t

--
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
1. Re:I assume that the Firefox bug is in JS? by Anonymous Coward · 2013-03-07 03:52 · Score: 0
  
  Actually, no. Though I guess you'll have to wait for the 19.0.2 release later today for proof of that (unless you're smart enough to figure out which public repo to look at to see the fix that was already checked in).
Linux by Lord+Lode · 2013-03-07 03:53 · Score: 1

For operating system, why do they only try Windows there? I, for one, would love them to try Linux as well, to help find exploits, which I'm pretty sure they'd find just as well.
Of course they were hacked, duh?! by Anonymous Coward · 2013-03-07 04:00 · Score: 0

"Listen, we got a higher purpose here, alright? A wake up call for the Nintendo Generation. We demand free access to data, well, it comes with some responsibility." - Cereal Killer, Hackers. Like it or not security in either the software or the physical world comes with some freedom violations. You cannot have your cake and eat it too. You either want the developers to tie you down and spoon feed you only what they will allow or you want to operate the system the way you want. They are mutually exclusive until we invent Skynet. Needs of the user are a constantly moving target. Anytime we lock down something for security reasons a new paradigm comes along and causes us to have to violate our own security measures. On top of all that, the hacker world does not sit still and stop trying to exploit vulnerabilities. If you want to be safe you can't go running around the internet willy-nilly doing whatever the hell you want without proper security safeguards. If you're going to go to Pirate Bay and download some torrent or other, then you better damn well have kick ass security tools to verify that all you got was the illegal movie and not some virus or other. Risky behavior is RISKY, stupid. Stop complaining about it to me and get proactive. Your security and safety is YOUR responsibility.
No, their phone and Facebook don't count. by Impy+the+Impiuos+Imp · 2013-03-07 04:01 · Score: 1

"Security researchers tore holes through all major web browsers, breaking Windows 8 and Java, too"
Hey! How goes the effort to gain access to Jennifer's pants? Debbie's? Becky's?
"I stand on the shoreline, having hacked a few shells, while the great undiscovered ocean of life remains before me."

--
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
I think you "hit the nail on the head" by Anonymous Coward · 2013-03-07 04:45 · Score: 0

Apparently it is. Any other 'excuse' is merely a "cop out", nothing more, nothing less.
* :)
(That's what it tells ME @ least... opinions may vary!).
So, does Opera possibly have "holes" in it too? Possibly. Only thing is, I'm not being shown CONCRETE SOLID UNDENIABLE & VERIFIABLE evidence thereof is all, so I have to assume what you have is all.
Like MOST /.'ers? I am a "show me" person... & I'm NOT being shown any differently, thus, I am free to make statements like yours also!
(These contests, much like I feel hacker/cracker types do (the ONLY "good" thing they do), expose weakness, & in a better manner than outright online criminals do, in that they DETAIL how it was done... when you know that, you can DO something about it!).
APK
P.S.=> So, sure/yes - Exclusing Opera also makes me wonder as well on WHY it's excluded from these tests, other than the fact they make it rather OBVIOUS there are no "holes" in it by such omissions, unfairly, imo @ least...
... apk
"Windows All Hacked At Pwn2Own"? by hobarrera · 2013-03-07 04:47 · Score: 1

There's no mention of any vulnerabilities on any other OS. Does this mean they're only windows-specific issues?
110% agreement w/ you & others... apk by Anonymous Coward · 2013-03-07 04:53 · Score: 0

http://developers.slashdot.org/comments.pl?sid=3525253&cid=43105565
* :)
APK
P.S.=>

"Opera takes security more seriously than any other browser out there...just an example is when the Certificate Authority hack came into play in 2011...All other browsers were twisting their knickers but Opera just yawned and said:
Browsers that do not have protection against blocked revocation lists will need to rapidly issue an update to fix any new certificate abuse. In Opera, users are protected automatically when the certificate is revoked. If the CA has a general problem, or a CA is no longer being used, we can remove it from our list of trusted CAs behind the scenes, and the user will also be secure, without needing to change anything in her browser.
This was the default setting in opera.
In my opinion, Opera has my interests at the forefront when it comes to security. Whether or not that would translate to being more resistant to hacking attempts at pwn2own, I have no idea...but I really wish they'd give it a go one of these years just to see." - by TheKeyboardSlayer (729293) on Thursday March 07, @10:16AM (#43104503) Homepage
Well said, & with BACKING evidence to reinforce your statement too (doesn't GET any better, than that)... again, agreed, 110% per my subject-line above!
Their lead dev, afaik, Mr. Hakom Lie (sp?) is really, Really, REALLY "on top of his game" here & always is (he's on the standards for the web committee)... which also makes me wonder WHY he's willing to drop his engine (excellent in latest/greatest 12.14 builds, especially in 64-bit, which is what I use personally) for WebKit.
However - it also shows me he IS concerned with solidifying the web... even to the point of taking a "personal beating" & giving up HIS motor/engine, to make the web more "unified" via WebKit.
It's the "why" of WHY I use it (as well as years of dominating speed/performance online on ALL fronts, even javascript (which I feel needs some SERIOUS shoring up in its faulty exploitable DOM model) - speeding javascript up is like speeding up being tossed in front of a speeding car, as it stands currently))...
... apk
Must Say by Zamphatta · 2013-03-07 04:54 · Score: 2

The article points out that the hacks were done on Windows & Mac's. So simply saying "oh, these browsers are all flawed", is suggesting something that is either not true or something unknown. After all, it's entirely possible that the flaws do not exist in Linux or non-Mac-BSD versions of the browsers. I've seen articles go on like this before... about how all the browsers are hackable, but they only really know (or mean) that all the browsers are hackable on a certain platform. I'm tired of that FUD.
1. Re:Must Say by smash · 2013-03-07 05:16 · Score: 1
  
  The hacks work on the desktop platforms that matter if you're chasing maximum number of botnet hosts. Linux as far as desktop usage goes is barely a blip on the radar, and trying to target the myriad of different variants contained within that 1 percent of desktop users is just not worth the effort. You'd be spending say 10x the effort to hack the Windows and OS X to target the many different linux variants for a maybe 1% increase in terms of number of machines owned.
  And if they did test at pwn2own - which distro? Whatever they pick will be the wrong platform, and would unfairly tarnish the rep of the distro hacked vs the others who may or may not be vulnerable as well, but publicly get a pass because they weren't tested. It's just not worth it.
  However, if you think that say, Firefox is not hackable on Linux, I'd suggest you're being a little cavalier with that attitude. Most of the code is similar, barring widget toolkits and a bit of abstraction for the networking code.
  
  --
  I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
2. Re:Must Say by Anonymous Coward · 2013-03-07 20:30 · Score: 0
  
  So you are essentially confirming that pwn2own is a Redmond Propaganda Operation ?
  They currently have MacOS X in their crosshairs (as they had when they founded it) and Linux is not yet a "worthy" target because of marketshare ? Yeah, that makes sense.
Re:What? Not Mac? It must be impervious to hacks by marklark · 2013-03-07 05:00 · Score: 1

Yep, must be... ;^) So far, at least, since the article (but who (else) reads those?) makes no mention of it being compromised this time.
$65,000 if you can through, though.
Re:What? Not Mac? It must be impervious to hacks by Anonymous Coward · 2013-03-07 05:09 · Score: 0

Right?
Nobody is scheduled to attempt an attack against Safari this year. Contestants have to pre-register which platform they wish to attack, and have 30 minutes to demonstrate it. So usually the reason you see a platform ignored is because all the entrants already have plans for one of the other platforms and it's more about who can hack the other one faster and get the money.
Known Hacks? by Anonymous Coward · 2013-03-07 05:11 · Score: 0

So, I must wonder how many people who "win" these have known about problems, holding back disclosure to profit (either from selling the hack or winning the contest).
I'm not going to go so far as to say the cash incentive caused otherwise scrupulous people to not report the bugs (delay reporting, certainly), but it seems to have turned into it's own little economy, hasn't it?
All of the 'news' the last six months about Java insecurities . . . well is it news? Someone knew.
Re:What? Not Mac? It must be impervious to hacks by LynnwoodRooster · 2013-03-07 05:33 · Score: 2

Given that it was always the first platform hacked at these events, I guess the competitors decided to step up to a real challenge and move to other platforms...

--
Browsing at +1 - no ACs, I ignore their posts. So refreshing!
safest browser by Anonymous Coward · 2013-03-07 06:21 · Score: 0

Does that make elinks2 the safest browser out there?
There is silver lining here by MobyDisk · 2013-03-07 06:21 · Score: 5, Interesting

Despite the fact that zero-day vulnerabilities still exist, we should note that software has gotten harder to exploit over the years. For example:

Firefox was popped with a use-after-free vulnerability and a new technique that bypasses Address Space Layout Randomisation (ASLR) and Data Execution Prevention (DEP) in Windows, Vupen said...Windows 8 also fell to the security consultancy which cracked Microsoft's Surface Pro using two Internet Explorer zero day vulnerabilities and a sandbox bypass.

So in each case they had to chain 3 vulnerabilities together to make this work. That means that we are at least improving security, albeit not enough. Fixing any 1 of those vulnerabilities makes the exploit no longer work.
1. Re:There is silver lining here by gstrickler · 2013-03-07 15:28 · Score: 1
  
  ASLR is not a security feature, it's an obfuscation feature.
  
  --
  make imaginary.friends COUNT=100 VISIBLE=false
2. Re:There is silver lining here by Anonymous Coward · 2013-03-07 20:45 · Score: 0
  
  +1
  Here's a real security feature: Memory Safe Languages. MS research has been working on these for years, but like IBM, MS has grown into being incapable of using their own research results:
  http://research.microsoft.com/en-us/people/maf/
  http://research.microsoft.com/en-us/downloads/ee56884c-b946-4c35-b12d-d84bd4269235/
  {End Bracket}
  Singularity
  James Larus, Galen Hunt, and David Tarditi
  When the C and C++ programming languages were invented, computers were slow, memory was limited, and compilers were simple and memory challenged, so a practical language could be little more than a veneer for assembly language. Times change, though, and so do the limits on software development. Today, program performance is seldom limited by raw processor speed. Instead, latency—memory, disk, network, database—often determines performance. Moreover, software dependability—an amalgam of reliability, availability, safety, and security—has become a challenge that often dominates software development.
  Safe programming languages can increase dependability by preventing (or, at least detecting) many common programming errors. Safety has two parts: type and memory. Type safety means that a program can't treat an object of type A as if it was of an unrelated type (unchecked casts in C/C++ offer this "feature"). Memory safety means that a program can't reference beyond the bounds of an object or construct a pointer to an object, for example, by casting some random integer to a pointer.
  No doubt you are thinking: "yeah, yeah, I've heard all that before, but safe languages are too slow or hog too much memory for my application." In fact, your problem may have more to do with the implementation of your programming language or operating system than with language safety.
  To explore these issues, our team in Microsoft Research built a new system to study trade-offs in the pervasive use of safe languages and to demonstrate that they need not incur large performance penalties. Singularity is a new operating system, written almost entirely in C#, which executes only verifiably safe programs. Singularity's kernel and runtime libraries are the only parts of the system containing unsafe code and, even in those sections, most code is written in safe C#.
  Singularity achieves good performance by reinventing the environment in which code executes. In existing systems, safe code is an exotic newcomer who lives in a huge, luxurious home in an elegant, gated community with its own collection of services. Singularity, in contrast, has architected a single world in which everyone can be safe, with performance comparable to the unsafe world of existing systems.
  A key starting point is Singularity processes, which start empty and add features only as required. Modern language runtimes come with huge libraries and expressive, dynamic language features such as reflection. This richness comes at a price. Features such as code access security or reflection incur massive overhead, even when never used.
  A Singularity application specifies which libraries it needs, and the Bartok compiler brings together the code and eliminates unneeded functionality through a process called "tree shaking," which deletes unused classes, methods, and even fields. As a result, a simple C# "Hello World" process in Singularity requires less memory than the equivalent C/C++ program running on most UNIX or Windows® systems. Moreover, Bartok translates from Microsoft® intermediate language (MSIL) into highly optimized x86 code. It performs interprocedural optimization to eliminate redundant run-time safety tests, reducing the cost of language safety.
  Aggressive interprocedural optimization is possible because Singularity processes are closed—they do not permit code loading after the process starts executing. This is a dramatic change, since dynamic code loading is a popular, but problematic, mechanism for loading plug-ins. Giving plug-ins access to a program's internals presents serious security and re
Re:What? Not Mac? It must be impervious to hacks by Anonymous Coward · 2013-03-07 06:35 · Score: 0

Hehheh, good one...
NOT by Anonymous Coward · 2013-03-07 08:02 · Score: 1

AppArmor is actually quite intuitive and moderately complicated to work with. I once did an AppArmor profile for firefox in two days. I am not privy to the details of firefox, but I do develop in C++ on Windows and Linux and I know a little about the DLL loading process on Linux.
I also created a memory safe and efficient (unlike Java and C#) programming language, but the sad fact is that software developers are not exactly enlightened when it comes to ditching their deficient programming language in favor of something more secure.
Here it is: http://sourceforge.net/projects/sappeurcompiler/
As I wrote somewhere else:
"
Drumming For Sappeur
"Popular languages in this category don't exist"
That statement is true, but there "exist" languages which are both memory-safe and efficient. You can have most of the efficiency and realtime capabilities of C++ without all the nasty Java properties such as voracious memory consumption and GC freezes. You can have your little command line program start up in less than 10 milliseconds.
More than 50% of all serious exploits in the CVE database are artifacts of the C and C++ languages. Real-world C and C++ programs will have them, because programmers are not superhumans. They don't live in a world of infinite funding and infinite project deadlines. Quite the opposite.
I designed a language called Sappeur and wrote a compiler (or call it a translator if you wish), which assures memory safety. Sappeur is (essentially) a memory-safe subset of C++ and adds some novel support for memory-safe multithreading. The compiler will generate C++ code to be compiled into machine code by GCC or msvc (or potentially any other modern C++ compiler). That took me about 10000 lines of C++ code. I do think the right people could prove correctness of a 10k LOC project, given reasonable time and budget.
But certainly the current version of the compiler will contain bugs. Still, I do think it demonstrates what is possible. It is another line of defence and given that hardware designers are not infallible creatures, we should look for any opportunity to add useful layers into the defence-in-depth armour. Is your MMU proven correct ? If not, will your sandbox ever work as promised ?
Actually, Sappeur programs could *remove* the need for MMUs and consequentially save cost and electric power.
"
Nice Apologism by Anonymous Coward · 2013-03-07 08:16 · Score: 0

..having "use after free" errors in 2013. The truth is that most software developers and software development managers are plain idiots. For most of them, "delivering features" is the one and only objective. They are too lazy to even consider alternatives to their long-practised approach of using C and C++. They will find 1001 reasons why they should change Exactly Nothing.
They use the same line of argument as you do "we can never be 100% secure, so why should we improve anything at all ?".
The truth is that "use after free" "heap overflow", "DSLR outwitted" really does not need to occur in 2013. It occurs because most managers and developers are actually Programming Whores. They are in this purely for money and nothing else.
Here's a nickel boy. Download yourself a Memory Safe Programming Language:
http://sourceforge.net/projects/sappeurcompiler/
http://www.rust-lang.org/
http://dlang.org/memory-safe-d.html
RTF Post you're replying to? by Anonymous Coward · 2013-03-07 08:37 · Score: 0

Safari for Windows was abandoned (no version 6) and this year Pwn2own is targeting Windows browsers only.
From the post you're replying to, quoting TFA:

$100,000 for popping Chrome on Windows 7; the same for hacking Internet Explorer 10 on Win 8; $75,000 for ripping up IE9 on Win 7; $60,000 for owning Firefox on Win 7; and $65,000 for exploiting Apple Safari on OS X Mountain Lion.
$65K was on offer for a Safari/Mac crack.
1. Re:RTF Post you're replying to? by Anonymous Coward · 2013-03-07 10:58 · Score: 0
  
  You might be right.
  I was reading this and it mentions Windows only.
Re:You mean crack fest? by YurB · 2013-03-07 08:51 · Score: 2

I agree. By (consciously) using the word "hacking" instead of "cracking" when refering to activity related to circumventing computer security we show our disrespect of those who contributed to the development of computing as we know it and who once asked us to differentiate the costructive "hacking" from the destructive "cracking". This is an example of constructive "cracking" though which is a special case.
Re:Researchers tore holes through browsers on Wind by Anonymous Coward · 2013-03-07 08:52 · Score: 0

My bullshit detector just hit 10 out of a scale of 0 to 9. If I had a kernel-level zero day for the latest Ubuntu it would probably work on most other modern distros latest version, too. Because the kernel is the same.
The HP guy does not want to embarrass the PC division who are in bed with MS.
Re:Researchers tore holes through browsers on Wind by ais523 · 2013-03-07 11:23 · Score: 1

Most likely, I'd guess that some of them would be hitting cross-platform parts of the browser, and so the exploit would work in order to break out of the browser sandbox. Because Windows code doesn't run directly on Linux, the rest of the exploit would have to be changed to work correctly on Linux, but that would be a reasonably routine porting job.
If the exploit hits a platform-specific part of the browser, it wouldn't work on any other OS, because the part it was trying to attack wouldn't exist.

--
(1)DOCOMEFROM!2~.2'~#1WHILE:1<-"'?.1$.2'~'"':1/.1$.2'~#0"$#65535'"$"'"'&.1$.2'~'#0$#65535'"$#0'~#32767$#1"
Re:Researchers tore holes through browsers on Wind by devent · 2013-03-07 11:39 · Score: 1

Year right. That is why Linux is very much deployed on Desktop Computers. Like in Governments and in companies.
Here is a list: http://en.wikipedia.org/wiki/List_of_Linux_adopters
The only reason is that Linux was not busted in the last 5 (or something like that) pown2own contests. It looks really bad if your system (ehem Microsoft) is busted in 5 minutes and a Linux system like Ubuntu will not get busted at all.

--
http://www.mueller-public.de - My site http://www.anr-institute.com/ - Advanced Natural Research Institute
Re:What? Not Mac? It must be impervious to hacks by Anonymous Coward · 2013-03-07 14:24 · Score: 0

$65,000 if you can through, though.
$45,000 less than hacking Java so you can't claim that nobody hacked the mac because the reward was too low.
Re:What? Not Mac? It must be impervious to hacks by Anonymous Coward · 2013-03-07 14:41 · Score: 1

Given that it was always the first platform hacked at these events, I guess the competitors decided to step up to a real challenge and move to other platforms...
In previous events, the "first platform hacked was determined by the order of the events. So the "first to be hacked" was meaning less. Since then, they changed the rules so "first to be hacked" is meaning less. Now quickest to be hacked is meaning full. Mac OS Safari was not in that category.
Now the anti-apple fanboys will argue that the meager $65,000 was too little of an incentive to be hacked but Java only paid out $20,000. You cannot use the excuse that they paid too little to hack the mac.
Not desireability of the HW. by mjwx · 2013-03-07 15:52 · Score: 1

Erm, no.

The Pwn2Own contest offers cash prizes, they have done this since 2011. In fact they haven't given away a laptop since 2010. This year it's US$60,000 for first place, US$30,000 for second and US$15,000 for third. Laptop type has nothing to do with it, in fact they're targeting browsers exclusively which are running on a fully patched Win7 or latest OSX version. Points are awarded for each exploit, 0day's are worth the most, known exploits (2 have been left deliberately unpatched and will be announced) are worth fewer points. The winner is the team with the most number of points and must include at least one 0day.

Sorry, but the idea that OSX is targeted first because it's more desirable is a complete myth made up by sad fanboys. The entire Pwn2Own competition was created to demonstrate the insecurity of OS X. The first competition only included OS X (Windows and Linux were introduced in the second P2O).

--
Calling someone a "hater" only means you can not rationally rebut their argument.
Re:What? Not Mac? It must be impervious to hacks by Anonymous Coward · 2013-03-11 05:00 · Score: 0

Nice. That reminds me of something my first networking instructor (Novell, back in 1995) wrote on the white board when someone asked how well Apple computers worked on a network: "We don't do fruit."