A hacking contest slated for next month will award cash prizes of $10,000 to anyone who can break into the most popular smartphones, including Apple Inc.’s iPhone and Research In Motion Ltd.’s BlackBerry.
The Pwn2Own contest will kick off March 18 at the CanSecWest security conference in Vancouver, B.C.
It will offer a dual-track hacking challenge for the first time, said Terri Forslof, security response manager at 3Com Inc.’s TippingPoint unit, the contest sponsor.
Pwn2Own has made headlines in its two previous years for hacks of Apple’s Mac OS X and Microsoft Corp.’s Windows. But this year, the content will focus on mobile devices and Web browsers, said Forslof.
“Mobile is a new frontier of sorts,” said Forslof. “We’ve seen mobile exploits in the past, but still don’t see a lot of focus in that area.”
Forslof said “computing on the go” is becoming pervasive and people rely on these devices for e-mail and accessing the Web. “So it seemed prudent to have a look at them, and the contest is a good forum for that.”
The contest will pit hackers against five smartphone operating systems, including Windows Mobile, Google Inc.’s Android, Symbian, and the operating systems used by the iPhone and BlackBerry.
The first to break into any of the five smartphones gets to keep that device with a one-year service contract, but each successful exploit pays out $10,000.
TippingPoint, which operates the Zero Day Initiative (ZDI) bug-bounty program and purchases the rights to the vulnerabilities and exploit code used during the contest, has not capped the number of bugs it will buy.
“We’re not going to limit it this year,” Forslof said. “In the first year, we had a one-bug, one-winner kind of contest. Last year, it was sort of similar, although we offered three prizes.”
Pwn2Own’s second track will feature a battle between hackers and browsers on Windows and Mac OS X. Attacks against Internet Explorer 8 (IE8), which recently reached “release candidate” status, Firefox and Chrome will play out on a Sony Vaio laptop running Windows 7, while a MacBook will host Safari and Firefox on Apple’s operating system.
TippingPoint will award cash prizes of $5,000 for each browser bug successfully exploited and give the targeted laptop to the first hacker who breaks into any of the browsers.
If there are more than five entries in the two contest categories, TippingPoint will also award additional $5,000 prizes for Most Interesting Browser Flaw, Most Interesting Mobile Flaw, and Best in Show, Forslof said.
As during previous Pwn2Own contests, TippingPoint will reduce the difficulty of the challenge each day that a winner is not declared. “The first day, the smartphones will be the raw metal,” said Forslof, “so we’ll be looking for network exploits, Wi-Fi and so on.
From that point, we’ll open up the devices to the standard applications that come with the phone, but we won’t install third-party applications or allow downloads.”
A similar tack will be used for the browser competition: The first day will feature full-patched editions with default configurations. On the second day, TippingPoint will add a select group of third-party plug-ins, such as Flash Player.
TippingPoint will not publicly release details of the Pwn2Own bugs, but will instead report them to the vendors and use the information in its own security technology to preemptively block attacks.
The contest will start March 18 and run through March 20.
As was the case in the past two years, TippingPoint will be the sole sponsor of the PWN2OWN contest.
Last March at CanSecWest, noted Apple vulnerability researcher Charlie Miller broke into a MacBook Air laptop in under two minutes to win $10,000.
Miller claimed Apple Inc.’s operating system was the “easiest” one to hack. “We wanted to spend as little time as possible coming up with an exploit, so we picked Mac OS X.”
Miller had breached a MacBook Air, one of three laptops up for grabs in the “PWN to OWN” hacker challenge at CanSecWest, a security conference that wraps up today in Vancouver, British Columbia.
For his efforts, he got the computer and a $10,000 cash prize.
The MacBook Air was running the current version of Mac OS X, 10.5.2, with all the latest security patches applied. The other two computers, a Sony Vaio VGN-TZ37CN running Ubuntu 7.10 and a Fujitsu U810 notebook running Windows Vista Ultimate SP1, were also up to date and fully patched.
Miller said it took him and his colleagues “a couple of days to find something, then the rest of the week to work up an exploit and test it.”
Miller didn’t share details of the vulnerability as he was bound by a nondisclosure agreement with 3Com Corp.’s TippingPoint, the security company that ponied up PWN To OWN’s cash prizes. He did confirm, however, that he had exploited a bug in Safari 3.1.
On the first day of last year’s PWN to OWN challenge the rules required researchers to break into one of the laptops using a remote code-execution exploit of a zero-day.
At stake: the laptop and $20,000. Only one researcher stepped up that day, however, and was unsuccessful.
Subsequently, the computers’ exposure to attack was expanded by allowing hackers to go after any client-side applications installed by default, including Web browsers.
Contestants were also allowed to replicate the common tactic of duping a user into following a link in an e-mail or visiting a malicious Web site. In Miller’s case, he had set up a malicious Web site; the URL to that site was typed into Safari’s address bar.
At the same contest, security consultant Shane Macaulay claimed a $5,000 prize for breaching a Fujitsu notebook running Windows Vista Service Pack 1.
This year, Miller is unhappy that that PWN2OWN will not have a Mac OS X component.
“I’m really disappointed that there looks to be no Mac OS X target, as I’m really up to speed on that OS,” said Miller, who will be at CanSecWest as a speaker.
Although he was confident that he could hack Apple’s operating system again, he also said he was up to snuff on browsers and smartphones. “I could theoretically do either contest or both,” he said in an e-mail today.
Like others, he’s waiting for more information — including the prize amounts — before deciding whether to participate.
As in previous PWN2OWN contests, winners will assign the rights to their exploits, and the vulnerabilities they triggered, to TippingPoint, which is known for its Zero Day Initiative bug-bounty program, which pays researchers for finding flaws.
“We’ll use the same process,” said Forslof, “where the winner will sign the standard ZDI agreement, and information will be turned over to the vendor.”
TippingPoint does not publicly release details of the vulnerabilities it buys, but instead reports them to the appropriate vendor and uses the information in its own security technology to preemptively block attacks.
Forslof said she and organizers of the conference are also in talks with several vendors about the companies having representatives on site during the contests. Last year, researchers from Microsoft, Apple and McAfee Inc. were at CanSecWest for consultation.
Dragos Ruiu, one of the CanSecWest organizers, “is trying to come up with a different spin on the contest,” said Forslof, “but we’re still sorting it all out.”
Source: Computerworld.com
