Pwn2Own 2017 Offers Big Bounties For Linux, Browser, and Apache Exploits (eweek.com)

← Back to Stories (view on slashdot.org)

Pwn2Own 2017 Offers Big Bounties For Linux, Browser, and Apache Exploits (eweek.com)

Posted by EditorDavid on Saturday January 21, 2017 @07:34AM from the big-bug-bounties dept.

Now that TrendMicro owns TippingPoint, there'll be "more targets and more prize money" according to eWeek, and something special for Pwn2Own's 10th anniversary in March. Slashdot reader darthcamaro writes: For the first time in its ten-year history, the annual Pwn2Own hacking competition is taking direct aim at Linux. Pwn2Own in the past has typically focused mostly on web browsers, running on Windows and macOS. There is a $15,000 reward for security researchers that are able to get a local user kernel exploit on Ubuntu 16.10. The bigger prize though is a massive $200,000 award for exploiting Apache Web Server running on Ubuntu.
"We are nine weeks away," TrendMicro posted Wednesday, pointing out that they're giving out over $1 million in bounties, including the following:

$100,000 for escaping a virtualization hypervisor
$80,000 for a Microsoft Edge or Google Chrome exploit
$50,000 for an exploit of Adobe Reader, Microsoft Word, Excel or PowerPoint
$50,000 for an Apple Safari exploit
$30,000 for a Firefox exploit
$30,000, $20,000 and $15,000 for privilege-escalating kernel vulnerabilities on Windows, macOS and Linux (respectively)
$200,000 for an Apache Web Server exploit

56 comments

Min score:

Reason:

Sort:

thought by buddyglass · 2017-01-21 07:40 · Score: 4, Interesting

Microsoft, Adobe, Google, Apple, and maybe some of the larger linux contributors/users (IBM, Oracle, Amazon) should form a sort of "consortium" and chip in $1M/year each to fund a much more lucrative version of pwn2own. That's chump change to them. With ~$8M in prizes yearly, I dare say we'd eliminate a lot of security flaws.
1. Re:thought by Anonymous Coward · 2017-01-21 10:50 · Score: 0
  
  People aren't going to magically discover security flaws just because you offer to pay a reward. You can't demand insight on a schedule. And because the result is unpredictable, the consortium won't want to gamble and lose. Quarterly thinkers want return on investment and not nebulous money sinks.
2. Re:thought by Anonymous Coward · 2017-01-21 11:14 · Score: 0
  
  Um yeah they will. Money encourages people to look...which is how bugs are found.
3. Re:thought by Anonymous Coward · 2017-01-21 12:21 · Score: 0
  
  It's also better just to pay these people outright and getting the problems fixed vs having them doing the same thing for shits and giggles with the vulnerable software not being fixed. I see this as a win-win for everybody.
4. Re: thought by dougdonovan · 2017-01-21 12:22 · Score: 0
  
  microsoft did this 10 years ago ...good luck to pwn ...u r not microsoft...check your ipo & good luck w/ linus.
5. Re:thought by buddyglass · 2017-01-21 14:16 · Score: 2
  
  If you offer the money and nobody claims it then you haven't lost. If nothing else, you can use it as P.R.
  
  Now that I've had some time to think about it more, what would worry me is that if the prize were lucrative enough, people might delay reporting flaws they've found in order to claim the yearly prize. So it would really need to be an "all the time" thing and not necessarily a yearly thing.
6. Re:thought by Gumbercules!! · 2017-01-22 02:16 · Score: 2
  
  They're not hoping people will magically discover flaws because of the reward, rather that they will turn in known vulnerabilities or not hand them over to the black market, for money.
no thanks by Anonymous Coward · 2017-01-21 07:47 · Score: 0

id rather be poor and look be able to spy on you all ....hhehehehehe
and i have several exploits that work on everything listed enjoy , if the nsa wants to spy so do i...
Apache is trivial to exploit by Anonymous Coward · 2017-01-21 07:50 · Score: 1

When paired with mod_php it is child's play.
How about targeting nginx, a superior web server?
1. Re:Apache is trivial to exploit by Anonymous Coward · 2017-01-21 08:08 · Score: 0
  
  Put up or shut up.
  I'm very glad to see pwn2own targeting linux-- as a linux user, the more good guys finding bugs the better...
2. Re:Apache is trivial to exploit by ledow · 2017-01-21 09:05 · Score: 2
  
  Go claim your $200,000 then.
3. Re:Apache is trivial to exploit by 93+Escort+Wagon · 2017-01-21 09:31 · Score: 3, Funny
  
  Go claim your $200,000 then.
  One problem - his mom won't let him travel alone...
  
  --
  #DeleteChrome
4. Re:Apache is trivial to exploit by Anonymous Coward · 2017-01-21 10:05 · Score: 0
  
  There are about a dozen new apache exploits every week. Are you that stupid?
  There are about 100 new php exploits every day. Fuckstain.
  I suspect that the number of exploitable Apache bugs is quite small. You are particularly stupid, and supremely entitled to the epithet you have bandied about.
5. Re:Apache is trivial to exploit by gravewax · 2017-01-21 19:01 · Score: 1
  
  I would expect the Apache prize to be claimed pretty quickly, They seem to have gotten worse in recent years rather than improving.
6. Re:Apache is trivial to exploit by Anonymous Coward · 2017-01-22 02:20 · Score: 0
  
  Reference? Apache core vulns are fairly rare. Third party modules are usually the problem.
  For example, was httpoxy Apache's fault, or Perl/Python/PHP's fault? I'd argue it was a problem in the 3 Ps, but that it was appropriate for Apache to build a protection against it.
Submitter missed one of the bounties by 93+Escort+Wagon · 2017-01-21 09:29 · Score: 4, Funny

$1.99 for a working IIS exploit.

--
#DeleteChrome
1. Re: Submitter missed one of the bounties by pellik · 2017-01-21 09:59 · Score: 2
  
  That would blow the budget.
2. Re: Submitter missed one of the bounties by Anonymous Coward · 2017-01-21 10:02 · Score: 0
  
  I was pretty much under the impression that IIS properly configured wasn't really that bad anymore. If it were, wouldn't more people be attacking web servers hosting multiple sites?
  Is there a good site with known to work exploits for IIS? I'm not interested in hacking but more interested in identifying methods of securing my sites.
  If I am correct, IIS web sites are executed with a user privilege not admin. If anything, I'd imagine it would require a windows exploit as opposed to an IIS exploit to attack it.
3. Re:Submitter missed one of the bounties by Anonymous Coward · 2017-01-21 16:39 · Score: 0
  
  IIS for the last 5 or 6 years at least has been far more secure than apache.
4. Re: Submitter missed one of the bounties by Anonymous Coward · 2017-01-21 16:42 · Score: 0
  
  yep, IIS being the laughing stock of security is really ancient history. If anything it tends to do better on security now than Apache.
5. Re: Submitter missed one of the bounties by Anonymous Coward · 2017-01-21 22:10 · Score: 0
  
  You are correct IIS exploits for iis7+ are rare.
  It's something MS actually got right when they rewrote everything around the svr2008\r2 time frame and since.
6. Re:Submitter missed one of the bounties by wvmarle · 2017-01-22 02:27 · Score: 1
  
  Joking aside, if prize money is related to the difficulty of an exploit, then why is a Linux kernel exploit half the price of a Windows kernel exploit?
7. Re: Submitter missed one of the bounties by Anonymous Coward · 2017-01-23 09:35 · Score: 0
  
  IIS usage is pretty rare.
8. Re:Submitter missed one of the bounties by Anonymous Coward · 2017-01-23 11:04 · Score: 0
  
  It is not. Apache exploits are common.
  MS donated more money for Windows exploits, derp
Big Money Prizes by PopeRatzo · 2017-01-21 10:09 · Score: 1

As you all know, first prize is a Cadillac El Dorado. Anybody want to see second prize? Second prize is a set of steak knives. Third prize is you're in prison.
And by the way, all of you now work for the government, comrades.

--
You are welcome on my lawn.
It's about time! by Gravis+Zero · 2017-01-21 11:27 · Score: 2

Having a competition to attack Windows and OSX is fine and all but it's not helpful to anyone trying to run a secure system. I'm looking forward to any number of Linux kernel exploits because it's running on most servers... and my desktop. :)

--
Anons need not reply. Questions end with a question mark.
Loons like you are why I wrote this by Anonymous Coward · 2017-01-21 12:02 · Score: 0

APK Hosts File Engine 9.0++ SR-5 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/
Ads & malware rob speed, security & privacy
Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity
APK
P.S. - Safe https://www.virustotal.com/en/file/e01211ca36aa02e923f20adee0a3c4f5d5187dc65bdf1c997b3da3c2b0745425/analysis/1433430542/
Re:Loons like you are why I wrote this by Anonymous Coward · 2017-01-21 14:11 · Score: 0

Could you stop sperging your bullshit?
Host files is such a manual and clumsy way to block things. It was cutting edge in 1993!
Can kind of see security by price... by cant_get_a_good_nick · 2017-01-21 15:27 · Score: 1

Chrome and Edge the hardest, safari a bit less secure, Firefox at the bottom. at least they're in the competition - they used to be so insecure as to not worth being in the competition
1. Re:Can kind of see security by price... by Anonymous Coward · 2017-01-22 04:04 · Score: 0
  
  It's more that Firefox isn't pre-bundled with any devices, and so isn't widely used. By contrast every Win10 machine had Edge, pretty much every Android has Chrome, and every OSX/iOS device has Safari. Of course they're going to be worth more to hack.
Re: Loons like you are why I wrote this by Anonymous Coward · 2017-01-21 17:40 · Score: 0

Do you have a better way to block sites? A browser add on is not better by the way.
I block sites on my router with unbound, if I wasn't using my homemade router then I'd just use the hosts file.
Please explain the better way you use.
Why these numbers? by garote · 2017-01-21 17:50 · Score: 1

Why is the Safari bounty higher than the Firefox bounty, even though more people are on Firefox? More backing from Apple? More easily exploited target userbase?
1. Re:Why these numbers? by Anonymous Coward · 2017-01-21 19:07 · Score: 0
  
  because firefox is a security mess so far less effort required to win the prize. I am surprised the bounty is as high as it is given how bad the security in it is.
2. Re:Why these numbers? by Anonymous Coward · 2017-01-22 15:23 · Score: 0
  
  Because why would it be worth more to find an exploit for Firefox, when it's not pre-bundled on any device (anymore, since nobody wanted FirefoxOS), while Safari comes forcibly bundled on all OSX and iOS iPhones (including third-party browsers, which have to use Safari's engine as their own)? The same thing applies for Edge and Chrome.
3. Re:Why these numbers? by Anonymous Coward · 2017-01-22 15:30 · Score: 0
  
  Well that sure explains why there are so many hacked Firefox installations out there, doesn't it? And of course, it doesn't matter how quickly and effectively they close holes, just that you feel they're theoretically more hackable despite nobody actually taking advantage of it, apparently.
4. Re:Why these numbers? by Anonymous Coward · 2017-01-23 08:50 · Score: 0
  
  WTF? have you been living in a hole, firefox exploits are rampant. It is one of the biggest things I am constantly cleaning up in my support role. The list of firefox exploits for 2016 was multiple pages long and many of them critical and requiring no more interaction than browsing a site.
No asshole - I won't... apk by Anonymous Coward · 2017-01-21 17:56 · Score: 0

See subject: MAKE ME (& I see I ran you DRY of your "downmodpoints" too - hence your unidentifiable ac post)
APK
P.S.=> You little pussy motherfucker... apk
1. Re:No asshole - I won't... apk by Anonymous Coward · 2017-01-21 20:12 · Score: 0
  
  You little pussy motherfucker
  Dude, sort out your tourette's.
2. Re:No asshole - I won't... apk by Anonymous Coward · 2017-01-23 09:28 · Score: 0
  
  Keep on sperging...
  You are stupid and pathetic.
Firefox is back! And windows exploit more $$$? by tlhIngan · 2017-01-21 20:17 · Score: 1

Well, the good news is that Firefox is back! It was banned a few years because it was considered so insecure that there was no challenge in finding a new exploit.
Though, $30,000 for a Windows kernel elevation exploit? It seems like a lot of money, especially since macOS gets you $20,000 and Linux a measly $15,000.
1. Re:Firefox is back! And windows exploit more $$$? by Gumbercules!! · 2017-01-22 02:22 · Score: 1
  
  Windows kernel exploits are worth more because they're worth more on the open market (because that's where the corporate data is and corporations pay ransoms). pwn2own has to compete with the black market, after all. If you discover have a Windows exploit - you can sell it for a lot of money if you sell it exclusively. Not so much an OSX and even less a Linux desktop exploit. So market forces dictate that, if you want people to actually turn up to pwn2own and show you their exploits, you need to make it attractive, not just to pure whitehats but to greyhats, too. If they can get $50,000 or something from "some guy in Russia" you can't very well offer $5,000 and hope they tell you out of the goodness of their hearts.
2. Re:Firefox is back! And windows exploit more $$$? by Anonymous Coward · 2017-01-22 02:26 · Score: 0
  
  Browser vulnerabilities are more vanuable because they protect more people. Generally speaking, gaining shell access on a server means game over already. The privilege escalation is just icing on the cake. So I actually agree that these escalations are reasonable bounties. Remember, those aren't just "any bug in Linux," they are specifically privilege-escalation bugs.
3. Re:Firefox is back! And windows exploit more $$$? by wvmarle · 2017-01-22 02:29 · Score: 1
  
  That wouldn't explain why Edge has so high a price on its exploits, as it's one of the smaller browsers nowadays.
4. Re:Firefox is back! And windows exploit more $$$? by Gumbercules!! · 2017-01-22 02:32 · Score: 1
  
  Possibly - but there's likely a similar set of drivers. a) Microsoft is paying for the bounties. b) Again, criminals know if they can break Edge, they will get a sizeable number home users now and more in the future and c) (some) corporations are more likely to use Edge than Chrome, especially as more move to Windows 10.
5. Re:Firefox is back! And windows exploit more $$$? by Anonymous Coward · 2017-01-22 04:08 · Score: 0
  
  Edge is also pre-bundled on every Windows 10 system; Firefox isn't. Edge is also rather pushy by comparison, using ads built into Win10 to pressure people into using it, and being necessary to use some things like Cortana. As Win10 usage grows, so will Edge's use (and thus hacks are far more valuable). Why would a Firefox exploit be worth as much in the face of that?
6. Re:Firefox is back! And windows exploit more $$$? by Anonymous Coward · 2017-01-22 04:21 · Score: 0
  
  It was only "banned" from last year's event, if by "banned" they didn't pay for exploits. I'm not sure why you chose that word, to be honest.
7. Re:Firefox is back! And windows exploit more $$$? by benjymouse · 2017-01-22 07:30 · Score: 1
  
  Windows kernel exploits are worth more because they're worth more on the open market (because that's where the corporate data is and corporations pay ransoms). pwn2own has to compete with the black market, after all.
  Wrong. All of these prizes are far below what a zero-day exploit is worth on the black market. This contest is not a way to overbid the black market; rather it is a way for white-hats to showcase their skills and bring attention to vulnerabilities.
  The prizes a set to reflect the expected difficulty; the hardest target - the ones that involves the most work - pays most. Virtual machine escapes are considered really hard because of the very limited attack surface.
  Windows 10 is considerably harder to crack than Linux and OS/X. The latter 2 still have *far* to many services running as root and still exposes a lot of SUID root executables. Windows 10 has also adopted many of the EMET anti-exploit techniques. You'd have to harden Linux with grsecurity to achieve the same level.
  
  --
  Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Why don't you prove this wrong instead? by Anonymous Coward · 2017-01-22 05:47 · Score: 0

What hosts do addons can't (or as well):
PROTECT vs.:
1.) bad sites (past ads)
2.) fastflux C&C
3.) dynDNS C&C
4.) DGA C&C
5.) DNS down
6.) poisoned dns
7.) trackers (dnsrequestlogs/ads/transparent ISP proxy)
8.) spam/phish payload
9.) dns blocks
10.) slowdown 2 ways: adblocks & hardcodes
11.) Multiplatform
12.) Ez data edit
13.) Efficiency (cpu/ram/I-O)
14.) UBlock no DNS bennys = poor imitation = "sincerest form of flattery"
15.) NoScript tag parses. Hosts block adservers before it cheaper
APK
P.S.=> AB+ 151mb http://cdn.ghacks.net/wp-content/uploads/2014/06/adblocker-memory-consumption.jpg/
UBlock 64MB http://cdn.ghacks.net/wp-content/uploads/2014/06/adblocker-memory-consumption.jpg/
(hosts ~6mb)
ClarityRay defeatable
Don't work http://www.businessinsider.com/google-microsoft-amazon-taboola-pay-adblock-plus-to-stop-blocking-their-ads-2015-2/
SLOWER: http://superuser.com/questions/686041/which-leads-to-faster-browsing-an-ad-blocker-or-an-edited-hosts-file/
1. Re:Why don't you prove this wrong instead? by Anonymous Coward · 2017-01-22 10:17 · Score: 0
  
  See a therapist. You have serious mental illness.
2. Re:Why don't you prove this wrong instead? by Anonymous Coward · 2017-01-26 22:02 · Score: 0
  
  hosts files can't dynamically block sites numbnuts.
  Turn down your assburgers
3. Re:Why don't you prove this wrong instead? by Anonymous Coward · 2017-01-31 12:37 · Score: 0
  
  He doesn't even have ass burgers since it was always a bullshit condition that has been removed.
  He is simply fucktarded
Stuff your advice up your ass "Forrest" by Anonymous Coward · 2017-01-22 10:22 · Score: 0

See my subject: As you "Run, Forrest: RUN!!!" from a fair challenge I put to trolls like you https://it.slashdot.org/comments.pl?sid=10146371&cid=53715879/ & "your kind" RUNS, every single time, lol...
APK
P.S.=> If all you can do is harass others online? Take your own poor advice, freak... apk