Pwn2Own 2017 Offers Big Bounties For Linux, Browser, and Apache Exploits (eweek.com)

Now that TrendMicro owns TippingPoint, there'll be "more targets and more prize money" according to eWeek, and something special for Pwn2Own's 10th anniversary in March. Slashdot reader darthcamaro writes: For the first time in its ten-year history, the annual Pwn2Own hacking competition is taking direct aim at Linux. Pwn2Own in the past has typically focused mostly on web browsers, running on Windows and macOS. There is a $15,000 reward for security researchers that are able to get a local user kernel exploit on Ubuntu 16.10. The bigger prize though is a massive $200,000 award for exploiting Apache Web Server running on Ubuntu.
"We are nine weeks away," TrendMicro posted Wednesday, pointing out that they're giving out over $1 million in bounties, including the following:

• $100,000 for escaping a virtualization hypervisor
• $80,000 for a Microsoft Edge or Google Chrome exploit
• $50,000 for an exploit of Adobe Reader, Microsoft Word, Excel or PowerPoint
• $50,000 for an Apple Safari exploit
• $30,000 for a Firefox exploit
• $30,000, $20,000 and $15,000 for privilege-escalating kernel vulnerabilities on Windows, macOS and Linux (respectively)
• $200,000 for an Apache Web Server exploit

Comments

thought

[buddyglass]

Microsoft, Adobe, Google, Apple, and maybe some of the larger linux contributors/users (IBM, Oracle, Amazon) should form a sort of "consortium" and chip in $1M/year each to fund a much more lucrative version of pwn2own. That's chump change to them. With ~$8M in prizes yearly, I dare say we'd eliminate a lot of security flaws.

Re:thought

[buddyglass]

If you offer the money and nobody claims it then you haven't lost. If nothing else, you can use it as P.R.

Now that I've had some time to think about it more, what would worry me is that if the prize were lucrative enough, people might delay reporting flaws they've found in order to claim the yearly prize. So it would really need to be an "all the time" thing and not necessarily a yearly thing.

Re:thought

[Gumbercules!!]

They're not hoping people will magically discover flaws because of the reward, rather that they will turn in known vulnerabilities or not hand them over to the black market, for money.

Apache is trivial to exploit

[Anonymous Coward]

When paired with mod_php it is child's play.

How about targeting nginx, a superior web server?

Re:Apache is trivial to exploit

[ledow]

Go claim your $200,000 then.

Re:Apache is trivial to exploit

[93 Escort Wagon]

Go claim your $200,000 then.

One problem - his mom won't let him travel alone...

Re:Apache is trivial to exploit

[gravewax]

I would expect the Apache prize to be claimed pretty quickly, They seem to have gotten worse in recent years rather than improving.

Submitter missed one of the bounties

[93 Escort Wagon]

$1.99 for a working IIS exploit.

Re: Submitter missed one of the bounties

[pellik]

That would blow the budget.

Re:Submitter missed one of the bounties

[wvmarle]

Joking aside, if prize money is related to the difficulty of an exploit, then why is a Linux kernel exploit half the price of a Windows kernel exploit?

Big Money Prizes

[PopeRatzo]

As you all know, first prize is a Cadillac El Dorado. Anybody want to see second prize? Second prize is a set of steak knives. Third prize is you're in prison.

And by the way, all of you now work for the government, comrades.

It's about time!

[Gravis Zero]

Having a competition to attack Windows and OSX is fine and all but it's not helpful to anyone trying to run a secure system. I'm looking forward to any number of Linux kernel exploits because it's running on most servers... and my desktop. :)

Can kind of see security by price...

[cant_get_a_good_nick]

Chrome and Edge the hardest, safari a bit less secure, Firefox at the bottom. at least they're in the competition - they used to be so insecure as to not worth being in the competition

Why these numbers?

[garote]

Why is the Safari bounty higher than the Firefox bounty, even though more people are on Firefox? More backing from Apple? More easily exploited target userbase?

Firefox is back! And windows exploit more $$$?

[tlhIngan]

Well, the good news is that Firefox is back! It was banned a few years because it was considered so insecure that there was no challenge in finding a new exploit.

Though, $30,000 for a Windows kernel elevation exploit? It seems like a lot of money, especially since macOS gets you $20,000 and Linux a measly $15,000.

Re:Firefox is back! And windows exploit more $$$?

[Gumbercules!!]

Windows kernel exploits are worth more because they're worth more on the open market (because that's where the corporate data is and corporations pay ransoms). pwn2own has to compete with the black market, after all. If you discover have a Windows exploit - you can sell it for a lot of money if you sell it exclusively. Not so much an OSX and even less a Linux desktop exploit. So market forces dictate that, if you want people to actually turn up to pwn2own and show you their exploits, you need to make it attractive, not just to pure whitehats but to greyhats, too. If they can get $50,000 or something from "some guy in Russia" you can't very well offer $5,000 and hope they tell you out of the goodness of their hearts.

Re:Firefox is back! And windows exploit more $$$?

[wvmarle]

That wouldn't explain why Edge has so high a price on its exploits, as it's one of the smaller browsers nowadays.

Re:Firefox is back! And windows exploit more $$$?

[Gumbercules!!]

Possibly - but there's likely a similar set of drivers. a) Microsoft is paying for the bounties. b) Again, criminals know if they can break Edge, they will get a sizeable number home users now and more in the future and c) (some) corporations are more likely to use Edge than Chrome, especially as more move to Windows 10.

Re:Firefox is back! And windows exploit more $$$?

[benjymouse]

Windows kernel exploits are worth more because they're worth more on the open market (because that's where the corporate data is and corporations pay ransoms). pwn2own has to compete with the black market, after all.

Wrong. All of these prizes are far below what a zero-day exploit is worth on the black market. This contest is not a way to overbid the black market; rather it is a way for white-hats to showcase their skills and bring attention to vulnerabilities.

The prizes a set to reflect the expected difficulty; the hardest target - the ones that involves the most work - pays most. Virtual machine escapes are considered really hard because of the very limited attack surface.

Windows 10 is considerably harder to crack than Linux and OS/X. The latter 2 still have *far* to many services running as root and still exposes a lot of SUID root executables. Windows 10 has also adopted many of the EMET anti-exploit techniques. You'd have to harden Linux with grsecurity to achieve the same level.