Slashdot Mirror
Pwn2own 2014 Set To Hunt Unicorns
darthcamaro writes "The annual Pwn2own hacking competition has always made short work of all browser vendors' security, shredding perception of safety by hacking IE, Firefox, Safari and Chrome in minutes. This year the competition is adding a twist — for IE on Windows 8.1, hackers will also have to bypass Microsoft EMET, which is a seemingly bulletproof type of sandbox. The competition is calling this the 'Unicorn Exploit' and the first researcher to successful exploit it will pocket $150,000."
I hope whoever wins this one has a handle that's a character name from Legend...
Do not look into laser with remaining eye.
Sure, they hack browsers "in minutes" after months of studying and audits.
The hackers will certainly hit the EMET bullseye, the rest of the dominoes should fall like a house of cards. Checkmate. Somebody's getting $150,000.00
From GHacks.net "It is by no means a catch-all security application, but it mitigates many common attack types and forms on the system. " The review on their website had led me to believe that the best of hackers could still get through EMET security. It will still be exciting to see how quickly the victor can make it into the heavily defended IE.
...housewives don't generally pay for plumbing or electrical work in sexual favors, either...
There have to be holes to get into their networks, no?
Wouldn't the opposite of a Unicorn be a Priums?
Since unicorns can only be catched by virgins, I am very confident that someone in the hacker's community will meet the necessary requirements.
*scnr*
I thought Ed Snowden already got into the NSA through the most effective method: social engineering. Heck, his name rearranges to Ends Owned.
This year the competition is adding a twist — for IE on Windows 8.1, hackers will also have to bypass Microsoft EMET, which is a seemingly bulletproof type of sandbox
Why would hackers care about Windows 8.1? What is the market share now? Half a percent better than Vista? Haven't the shills been screaming for years that Linux is only secure because it's not a 'big target' like Windows? By that definition Windows 8.1 must now be the most secure OS the world has ever known.
Nothing is ever bulletproof.
Breaking a "bulletproof type of sandbox" gets you ... $150k? That's all it's worth?
I was curious about this "seemingly bulletproof" sandbox as described in the summary. But the opening paragraph on Microsoft's website explains:
These security mitigation technologies do not guarantee that vulnerabilities cannot be exploited
So much for the hyped-up summary...
At the risk of introducing information into the discussion ... some of the other respondents have taken oblique cue shots off this info, but to get it out on the table ... EMET is a software package that enforces otherwise existing security protections on programs that may not have them in place. For example, DEP, ASLR, SEHOP (very Windows-specific mitigation), heapspray prevention, and in 4.1 they added certificate pinning, to detect mitm attacks. (looking up acronyms left as an exercise for the reader)
... I think the only protection that wouldn't already be compiled in is the certificate pinning, but maybe that alone is enough - or it makes it doubly difficult to break out of IE11 if you have the compiled in e.g. ASLR as well as the imposed-sandbox ASLR ... not sure.
... it's NOT comparable to mandatory access control - it's more mitigation-specific than that. And also, by way of information, the open source operating systems often enforce the same kinds of mitigations on the apps that they support from their repositories (e.g., the Canonical Ubuntu team compiles every app in their repo with all possible mitigations -- see the Ubuntu security features page for more info). That's one of the big advantages of open source - you don't have to try to impose really-meant-to-be-compiled-in security features from outside.
The good news - these mitigations can be applied from outside the apps involved (as of 4.1, no more app recompiling or special-versions needed). The somewhat bad news - there are compatibility issues, and many apps are not compatible with the whole list of protections (see the MS KB article for more info). I also wonder if there are performance impacts from doing so, as opposed to compiling in the mitigations that can be compiled in - but don't quote me on that, I'm not sure
More bad news - it won't work with certain app features, e.g. any code that accesses certain system services at too low a level, so for example DRM-using apps (so many videogames are off the table); and it only intended for desktop apps (so they "do not advise" you use it with system services or server apps).
We tested the 3.0 version, focusing solely on the mitigations that could be imposed from outside the code even in that version - and found that many apps had issues with most, and some with all, of the mitigations (and, a killer for us, it wouldn't work with virtualized apps). Maybe that's improved, not claiming to know.
All in all - it has value if you're deploying legacy apps over which you have no control to a broad array of desktops, and it doesn't break your apps. Frankly, I don't know why the emphasis on IE11
To be clear
"Ahh! I see you're in that indeterminate Schrodinger state where - oh, uh
Damn, I was hoping this finally spelled the end for Princess Twilicorn.
You usually have to submit exceptions to EMET for everything to keep working after turning it all on.
I'd target the most common exceptions.
typically attracts people that already have a stable full of unicorns, especially if you're foolish enough to put a big bounty on it. Announcing you have "perfect security" just brings the embarrassment to your door that much faster.
And try as you might, even actual "perfect security" on your part will usually fail miserably at someone else's hands. Look at Safai, and how often flash or java (or the user themselves) is used to compromise it. (approaching 100%?)
I work for the Department of Redundancy Department.
215 of The Patriot Act, The NSA, The CIA, The FBI, DHS and the following individuals who shall remain nameless. Without whose contributions, there would be no "ethical" paid hacking as a career, endless amounts of American civil liberties, no war on ter-r. Think any agencies will be doing some recruiting there?
it's clear that the amount offered is very little compared to what you could get by selling the info. if you can get a browser hack that can highjack the OS then it's worth a shitload more than the pennies they are offering. they need to start offering real cash for these deep level hacks.
Anons need not reply. Questions end with a question mark.
Here I thought this would be about talking to single ladies at couples clubs.
God invented whiskey so the Irish would not rule the world.
After all, they have to hack into a "World Wide Web" browser.
... When you can just order it online?
"Be grateful for what you have. You may never know when you may lose it."
Marigold will be quite upset to hear they're offering bounties on unicorns. She might take it as a personal affront.