News for hackers. Stuff that matters.

A comment on All Major Browsers Fall at Pwn2Own Day Two. Parent comment

Re:All Major Browsers Fall at Pwn2Own Day Two by liyanchang on Friday March 20, 2015 @01:06PM (#9238892)
Was similarly curious. Reading the rules here: http://zerodayinitiative.com/Pwn2Own2015Rules.html

Major points:

- You register for which browser + os combination[0]. Then they randomly order the contestants.

- When you are called, you have 30 minutes.

- The user browses to a particular piece of content that you specify. Then no further user interaction is allowed (like clicking a dialog, downloading a file). [1][2]

- The prize money goes to the first successful exploit. Money differs by browser.

[0] Chrome, Firefox, IE, Adobe Reader in IE, Adobe Flash in IE. Safari on OSX. Fully patched OS.

[1] How does one get to specify the content? What if I have a http header that downloads a file?

[2] I remember back in the day, they used to have a fully no interactive version? Like the user was just on the same wireless network?

[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by tptacek on Friday March 20, 2015 @01:25PM (#9239101)
The exploits that take down hardened browsers take months to develop. The time limits and race dynamics are theater.
[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by hnnewguy on Friday March 20, 2015 @01:57PM (#9239368)
>"The time limits and race dynamics are theater."

That makes more sense. Otherwise, this is movie-script-like hacking ability.

[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by eeeeeeeeeeeee on Friday March 20, 2015 @05:45PM (#9240863)
"I just need to break the encryption......ok...it's done."
[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by smackfu on Friday March 20, 2015 @02:31PM (#9239678)
It makes a bit more sense in the original context of the contest, where you were doing the attack on the actual hardware you would win. So time limits were so that everyone got a shot, and a race since there was no prize after someone won it.
[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by 3pt14159 on Friday March 20, 2015 @01:33PM (#9239190)
I was curious, so here are the rewards:

Windows-based targets:

1. Google Chrome (64-bit): $75,000 (USD)

2. Microsoft Internet Explorer 11 (64-bit with EPM-enabled): $65,000 (USD)

3. Mozilla Firefox: $30,000 (USD)

4. Adobe Reader running in Internet Explorer 11 (64-bit with EPM-enabled): $60,000 (USD)

5. Adobe Flash (64-bit) running in Internet Explorer 11 (64-bit with EPM-enabled): $60,000 (USD)

Mac OS X-based targets:

1. Apple Safari (64-bit): $50,000 (USD)

[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by eridius on Friday March 20, 2015 @02:15PM (#9239542)
So if I'm reading this right, you could spend months developing an exploit, and then not even get to use it if another contestant, randomly chosen to go before you, exploits the browser first?
[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by smackfu on Friday March 20, 2015 @02:32PM (#9239687)
At that point you would probably submit it through the regular bug bounty program. Pwn2own is just more lucrative.
[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by rudolf0 on Friday March 20, 2015 @02:31PM (#9239681)
Yes, I believe so. Though there are other competitions, and also the regular bug bounty programs that most browsers offer.
[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by blacksmith_tb on Friday March 20, 2015 @02:52PM (#9239857)
I am surprised that Chrome OS + Chrome isn't an option. If it provided uncrackable, that would be good theater; and if not, still very useful to Google. Unless the possibility of tarnishing its reputation outweighs the benefits...
[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by mccr8 on Friday March 20, 2015 @04:29PM (#9240491)
Google used to run a separate contest (at the same conference as Pwn2Own) called Pwnium for Chrome OS, but starting this year they are moving to a model where they pay similarly large bounties year-round rather than at contests.

http://googleonlinesecurity.blogspot.com/2015/02/pwnium-v-ne...

[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by liyanchang on Friday March 20, 2015 @03:02PM (#9239944)
I was surprised by how few OS/Browser combinations were tested. For instance, I'd think that the OSX + Chrome population is pretty big and I'd (selfishly) like that combination tested.

It feels like, just the fact that this competition and other bug bounty programs exist, means that the big companies here have gotten over reputation tarnish and know that the patch is worth it.

[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by lawnchair_larry on Friday March 20, 2015 @08:20PM (#9241418)
Any browser that can be exploited on Windows can be exploited easier on OS X. It lags far behind in mitigations. So, the Chrome/OS X combo is not done because it's redundant.
[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by floatboth on Saturday March 21, 2015 @05:51PM (#9244322)
Windows has a huge amount of ridiculous attack surface like GUI rendering code in THE KERNEL: http://www.theregister.co.uk/2015/02/12/hacker_kicks_one_bit...

I'm pretty sure no system ever is going to be as exploitable as Windows.

[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by pqomdv on Friday March 20, 2015 @01:39PM (#9239245)
So you only have to visit a website and do nothing else? And probably assuming javascript is enabled.
[ Parent | on HN ]
Re:All Major Browsers Fall at Pwn2Own Day Two by yebyen on Friday March 20, 2015 @03:27PM (#9240143)
I think you instruct the judges to visit your website, and then demonstrate that you owned their box within the 30 minutes to win the prize.
[ Parent | on HN ]