Pwn2Own owned all major browsers
h30499.www3.hp.com
Pwn2Own owned all major browsers
1–10 of 67 posts
Re: Pwn2Own owned all major browsers
#2Where's Safari?
Re: Pwn2Own owned all major browsers
#3Where's Safari?
[deleted]
Re: Pwn2Own owned all major browsers
#4It looks like George Hotz [1] is attending! Judging by his work with the PlayStation 3, I expect him to do pretty well at cracking Adobe Reader.
Re: Pwn2Own owned all major browsers
#5Where's Safari?
Directly below "Mozilla Firefox on Windows 7 ($60,000)"
Re: Pwn2Own owned all major browsers
#6Where's Safari?
Directly below "Mozilla Firefox on Windows 7 ($60,000)"
Safari is a target in the event, but has not been pwned yet:
Wednesday:
1:30 - Java (James Forshaw) PWNED
2:30 - Java (Joshua Drake) PWNED
3:30 - IE 10 (VUPEN Security) PWNED
4:30 - Chrome (Nils & Jon) PWNED
5:30 - Firefox (VUPEN Security) PWNED
5:31 - Java (VUPEN Security) PWNED
Thursday:
12pm - Flash (VUPEN Security)
1pm - Adobe Reader (George Hotz)
2pm - IE 10 (Pham Toan)
Re: Pwn2Own owned all major browsers
#7Interesting how Java was pwned thee times in spite of the lowest reward.
Re: Pwn2Own owned all major browsers
#8I don't really understand the competiton. Do people come to these with just the intention of finding exploits, or do they come with the exploit ready, waiting to collect a reward?
Re: Pwn2Own owned all major browsers
#9I don't really understand the competiton. Do people come to these with just the intention of finding exploits, or do they come with the exploit ready, waiting to collect a reward?
Invariably all the researchers / organisations competing have developed their exploits well ahead of the event. The exploits are now pretty involved.
I've linked to a blog post from the Chrome developers that details the exploit that won late 2011 [1]. 'Pinkie Pie', the pseudonym of the person who won it, is pretty infamous in those circles.
[1] http://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1.h...
Re: Pwn2Own owned all major browsers
#10I don't really understand the competiton. Do people come to these with just the intention of finding exploits, or do they come with the exploit ready, waiting to collect a reward?
They have the exploits ready to go, the challenge is whether they can exploit the target system (which is fully patched) within their time slot.
It's a useful excercise, I think, in that it demonstrates that even the most hardened of codebases still has security bugs and it also serves as a cautionary tale for people who think they don't need multiple layers of defence..