A hacking contest that has grabbed headlines two years running will take aim next month at browsers and smartphones, according to 3Com Inc.’s TippingPoint, the security company that sponsors the “PWN2OWN” challenge.
“We’re still in the planning stages for how the competition will be structured,” said Terri Forslof, the manager of security response at TippingPoint, regarding discussions she’s had with organizers of CanSecWest, the security conference where the challenge will take place. CanSecWest is slated to begin March 16 in Vancouver, British Columbia.
While the details have yet to be sorted out — including the dollar amounts for prizes and the contest rules — Forslof confirmed that PWN2OWN will actually consist of two separate hacker challenges this year.
The first will be a contest to break into one of several browsers, including Microsoft Corp.’s Internet Explorer 8, which recently reached “release candidate” status; Mozilla Corp.’s Firefox; and Apple Inc.’s Safari.
That contest will play out on a Sony notebook equipped with Windows 7, the still-under-construction successor to Windows Vista.
The second challenge will pit hackers against a variety of smartphone operating systems, including Google Inc.’s Android, Microsoft’s Windows Mobile and Apple’s iPhone operating system, which is a scaled-down version of Mac OS X.
Cash prizes will be awarded, Forslof said today, but the number of prizes and their amounts have yet to be decided. As was the case in the past two years, TippingPoint will be the sole sponsor of the PWN2OWN contest.
Last March at CanSecWest, noted Apple vulnerability researcher Charlie Miller broke into a MacBook Air laptop in under two minutes to win $10,000.
Miller claimed Apple Inc.’s operating system was the “easiest” one to hack. “We wanted to spend as little time as possible coming up with an exploit, so we picked Mac OS X.”
Miller had breached a MacBook Air, one of three laptops up for grabs in the “PWN to OWN” hacker challenge at CanSecWest, a security conference that wraps up today in Vancouver, British Columbia.
For his efforts, he got the computer and a $10,000 cash prize.
The MacBook Air was running the current version of Mac OS X, 10.5.2, with all the latest security patches applied. The other two computers, a Sony Vaio VGN-TZ37CN running Ubuntu 7.10 and a Fujitsu U810 notebook running Windows Vista Ultimate SP1, were also up to date and fully patched.
Miller said it took him and his colleagues “a couple of days to find something, then the rest of the week to work up an exploit and test it.”
Miller didn’t share details of the vulnerability as he was bound by a nondisclosure agreement with 3Com Corp.’s TippingPoint, the security company that ponied up PWN To OWN’s cash prizes. He did confirm, however, that he had exploited a bug in Safari 3.1.
On the first day of last year’s PWN to OWN challenge the rules required researchers to break into one of the laptops using a remote code-execution exploit of a zero-day.
At stake: the laptop and $20,000. Only one researcher stepped up that day, however, and was unsuccessful.
Subsequently, the computers’ exposure to attack was expanded by allowing hackers to go after any client-side applications installed by default, including Web browsers.
Contestants were also allowed to replicate the common tactic of duping a user into following a link in an e-mail or visiting a malicious Web site. In Miller’s case, he had set up a malicious Web site; the URL to that site was typed into Safari’s address bar.
At the same contest, security consultant Shane Macaulay claimed a $5,000 prize for breaching a Fujitsu notebook running Windows Vista Service Pack 1.
This year, Miller is unhappy that that PWN2OWN will not have a Mac OS X component.
“I’m really disappointed that there looks to be no Mac OS X target, as I’m really up to speed on that OS,” said Miller, who will be at CanSecWest as a speaker. Although he was confident that he could hack Apple’s operating system again, he also said he was up to snuff on browsers and smartphones. “I could theoretically do either contest or both,” he said in an e-mail today.
Like others, he’s waiting for more information — including the prize amounts — before deciding whether to participate.
As in previous PWN2OWN contests, winners will assign the rights to their exploits, and the vulnerabilities they triggered, to TippingPoint, which is known for its Zero Day Initiative bug-bounty program, which pays researchers for finding flaws.
“We’ll use the same process,” said Forslof, “where the winner will sign the standard ZDI agreement, and information will be turned over to the vendor.”
TippingPoint does not publicly release details of the vulnerabilities it buys, but instead reports them to the appropriate vendor and uses the information in its own security technology to preemptively block attacks.
Forslof said she and organizers of the conference are also in talks with several vendors about the companies having representatives on site during the contests. Last year, researchers from Microsoft, Apple and McAfee Inc. were at CanSecWest for consultation.
Dragos Ruiu, one of the CanSecWest organizers, “is trying to come up with a different spin on the contest,” said Forslof, “but we’re still sorting it all out.”
Ruiu was not immediately available for comment.
Source: Computerworld.com
