Slashdot Mirror

← Back to Stories (view on slashdot.org)

Pwn2Own Competitors Crack Tesla, Firefox, Safari, Microsoft Edge, and Windows 10 (zdnet.com)

Posted by EditorDavid on from the war-of-the-white-hats dept.

A research duo who hacked a Tesla were the big winners at the annual Pwn2Own white hat security contest, reports ZDNet. "The duo earned $375,000 in prize money, of the total of $545,000 awarded during the whole three-day competition... They also get to keep the car." Team Fluoroacetate -- made up of Amat Cama and Richard Zhu -- hacked the Tesla car via its browser. They used a JIT bug in the browser renderer process to execute code on the car's firmware and show a message on its entertainment system... Besides keeping the car, they also received a $35,000 reward. "In the coming days we will release a software update that addresses this research," a Tesla spokesperson told ZDNet today in regards to the Pwn2Own vulnerability.

Not coincidentally, Team Fluoroacetate also won the three-day contest after earning 36 "Master of Pwn" points for successful exploits in Apple Safari, Firefox, Microsoft Edge, VMware Workstation, and Windows 10... [R]esearchers also exploited vulnerabilities in Apple Safari, Microsoft Edge, VMware Workstation, Oracle Virtualbox, and Windows 10.

41 comments

  1. The other prizes... by Anonymous Coward · · Score: 5, Funny

    Besides keeping the car, they also received a $35,000 reward.

    That's nothing... the ones who cracked Firefox got a free copy of Firefox. But the worst deal of all were the ones who cracked Win10, for they were obligated to accept a copy of Win10. Perhaps they'll read the terms and conditions more carefully next time. Live and learn.

    1. Re: The other prizes... by Anonymous Coward · · Score: 0

        -------- the joke ----->

          o <--- you.
        - |-
          / \

    2. Re: The other prizes... by Anonymous Coward · · Score: 0

      The joke is on your festival of crackhead stupidity

    3. Re: The other prizes... by Anonymous Coward · · Score: 0

      Can't win if you don't play

    4. Re: The other prizes... by Anonymous Coward · · Score: 0

      Depends. Is it a multiple round contest? Think before you answer

    5. Re: The other prizes... by Anonymous Coward · · Score: 0

      Nah. In the future all you old guys will be dead. Just have to hang on until you nutjobs get the ole death punt.

    6. Re: The other prizes... by Anonymous Coward · · Score: 0

      The only way to win is not to play!

  2. Telegram, guys? by hcs_$reboot · · Score: 1

    $300,000 for Cracking Telegram Encryption. How about that challenge?

    --
    Slashdot, fix the reply notifications... You won't get away with it...
    1. Re:Telegram, guys? by Anonymous Coward · · Score: 0

      It pays better to keep the crack private and sell info to the agencies, sorry.

    2. Re: Telegram, guys? by Anonymous Coward · · Score: 0

      Ah well then the agencies are literally shit out of luck. One must keep a record available to the manufacturer unless one is a dipshit then one must cry in a corner

    3. Re:Telegram, guys? by gravewax · · Score: 2

      exactly, cracks for that sort of stuff are unlikely to pop up in a pwn2own competition, they are too valuable to give away so cheaply.

    4. Re: Telegram, guys? by Anonymous Coward · · Score: 0

      Why not sell to both?

    5. Re:Telegram, guys? by hcs_$reboot · · Score: 1

      cracks for that sort of stuff are unlikely to pop up in a pwn2own competition, they are too valuable to give away so cheaply.

      That was the point. Unlike pwn2own, the Telegram prize is much more valuable, 300k ; and hackers would better try to crack this one.

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    6. Re:Telegram, guys? by Anonymous Coward · · Score: 0

      300k is chicken feed compared to what it would be worth to a government agency.

    7. Re:Telegram, guys? by Anonymous Coward · · Score: 0

      300k really isn't a significant amount, agencies are spending a 100 times that looking for vulnerabilities in these sort of apps and I bet would pay a pretty penny for an unknown vulnerability that gave them access, certainly many times more than 300k.

    8. Re:Telegram, guys? by AmiMoJo · · Score: 2

      Interesting that Chrome isn't one of the ones on the list though. Too valuable or too secure?

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    9. Re: Telegram, guys? by Anonymous Coward · · Score: 1

      It's more about how the criteria are written. $80k for a breakout which allows full system control. Something that severe would probably qualify for the top end of Google's bounty, which would be close to $200k.

    10. Re:Telegram, guys? by Anonymous Coward · · Score: 0

      neither. Google offer higher bounties. by submitting it to the competition the participant would be giving up a lot of money. Really smart of google as it ensures less vulnerabilities are published outside of their control.

  3. Re: President Trump Owned The Libs by Anonymous Coward · · Score: 0

    You must have grown up in reform school

  4. Re: President Trump Owned The Libs by Anonymous Coward · · Score: 0

    #winning

  5. Re: President Trump Owned The Libs by Anonymous Coward · · Score: 0

    Are y'all tired of winning!? Me neither.

  6. WindBourne told us win10 was the most secure ever! by Anonymous Coward · · Score: 0

    But WindBourne foolishly told us that windows 10 is secure and only insider spies and Chinese outsourcing could penetrate it and steal your secrets.

  7. Why? by AHuxley · · Score: 2

    Is it the quality of the OS?
    The code used the software is created in?
    The skill sets needed to make a browser?
    More testing needed?
    Better testing?
    Would something like Ada ensure better software?

    --
    Domestic spying is now "Benign Information Gathering"
    1. Re:Why? by hcs_$reboot · · Score: 1

      The complexity hidden behind these apparently simple and easy to use programs.

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    2. Re:Why? by Anonymous Coward · · Score: 1

      You get what you pay for. I write secure code. Unit tested & input fuzzed. I use a different more secure paradigm than typical C / C++ function call stacks (which put parameters & code pointers on the stack), None of my heap stores pointers to functions or v-tables. I employ hardware memory RW controls to ensure there are is no return oriented programming, stack smashing or heap exploits (my custom memory allocator keeps all record keeping data in read only memory unless a thread is in the alloc / free function, and I check permission to call this function by examining EIP (instruction pointer) AFTER unlocking memory (otherwise one could jump to the record keeping unlock code that temporarily marks the code writable) -- the check afterwards relocks the RAM pages if permission is not approved.

      Hardware could speed up the mark & unmarking of certain pages while excuting code in a specific range (the memory allocator / etc "sensitive" user code), by providing an opcode and two registers to do so. However once software designers have a "turing complete" machine they pretend it is the holy grail and all things are possible thereby without sticking it to the hardware mfgs. On the old chipsets where there was no execution ring level permissions (such as MS-DOS & DR-DOS were made for) there was no way to prevent one process from writing over another's memory. Unless you run all your software in a VM you can not provide such protections on the old chipset. This demonstrates that some hardware capabilities are required for software security to exist within performance (speed) expectations. Now we have execution rings & memory virtualization. We can now isolate processes thanks to these hardware features. Now we also need to ensure that only certain functions (regions of code) can modify certain pages of process memory. We don't have that hardware capability and no popular OS provides it. I can emulate it via memory mapping and IPC and using a separate process to do all memory (de)allocation, but it is fucking slow as molasses...

      TL;DR: provably secure software exists. You won't pay for security. You don't get developers like me. We have no clout to push for the HW features needed for securing your platforms. Also, spies.

    3. Re:Why? by AHuxley · · Score: 1

      Every year the software people need to trust and use keeps on not been secure.

      --
      Domestic spying is now "Benign Information Gathering"
    4. Re:Why? by Anonymous Coward · · Score: 0

      Pix or it didn't happen.

    5. Re:Why? by RespekMyAthorati · · Score: 1

      English?

  8. Easy by wolfheart111 · · Score: 1

    Peasy...

    --
    [($)]
    1. Re:Easy by Anonymous Coward · · Score: 0

      Japanesey?

  9. What does Tesla's web browser run on nowadays? by Pinky's+Brain · · Score: 2

    The last time they had a browser hack the hackers could control breaks, do they have a decent hardware firewall in place now or is it still a shitshow?

    1. Re:What does Tesla's web browser run on nowadays? by Anonymous Coward · · Score: 0

      Was it breaks in the software? Or, was it the brakes on the wheels?

    2. Re:What does Tesla's web browser run on nowadays? by Anonymous Coward · · Score: 0

      do they have a decent hardware firewall in place now or is it still a shitshow?

      It really wasn't in the first place. The CAN bus is secured, here's a video of the hackers explaining the layout (Explanation of the layout starts at 9:04, but the entire video is interesting if you want to see how well Tesla has secured their cars).

      The "shitshow" you say is just the hackers being able to issue commands which you could already do remotely.

  10. Richard Zhu .. don't let him to get back to China! by Anonymous Coward · · Score: 0

    If that Richard Zhu fella successfully get back to China we'll sure be Royally Fucked !!