Hacker challenge takes aim at browsers, smartphones
'PWN2OWN' targets include IE8 on Windows 7, the Android and Apple's iPhone
Computerworld - A hacking contest that has grabbed headlines two years running will take aim next month at browsers and smartphones, according to 3Com Inc.'s TippingPoint, the security company that sponsors the "PWN2OWN" challenge.
"We're still in the planning stages for how the competition will be structured," said Terri Forslof, the manager of security response at TippingPoint, regarding discussions she's had with organizers of CanSecWest, the security conference where the challenge will take place. CanSecWest is slated to begin March 16 in Vancouver, British Columbia.
While the details have yet to be sorted out -- including the dollar amounts for prizes and the contest rules -- Forslof confirmed that PWN2OWN will actually consist of two separate hacker challenges this year.
The first will be a contest to break into one of several browsers, including Microsoft Corp.'s Internet Explorer 8, which recently reached "release candidate" status; Mozilla Corp.'s Firefox; and Apple Inc.'s Safari.
That contest will play out on a Sony notebook equipped with Windows 7, the still-under-construction successor to Windows Vista.
The second challenge will pit hackers against a variety of smartphone operating systems, including Google Inc.'s Android, Microsoft's Windows Mobile and Apple's iPhone operating system, which is a scaled-down version of Mac OS X.
Cash prizes will be awarded, Forslof said today, but the number of prizes and their amounts have yet to be decided. As was the case in the past two years, TippingPoint will be the sole sponsor of the PWN2OWN contest.
Last year at CanSecWest, noted Apple vulnerability researcher Charlie Miller broke into a MacBook Air laptop in under two minutes to win $10,000. The next day, security consultant Shane Macaulay claimed a $5,000 prize for breaching a Fujitsu notebook running Windows Vista Service Pack 1.
For his part, Miller was frustrated that PWN2OWN would not have a Mac OS X component this year.
"I'm really disappointed that there looks to be no Mac OS X target, as I'm really up to speed on that OS," said Miller, who will be at CanSecWest as a speaker. Although he was confident that he could hack Apple's operating system again, he also said he was up to snuff on browsers and smartphones. "I could theoretically do either contest or both," he said in an e-mail today.
Like others, he's waiting for more information -- including the prize amounts -- before deciding whether to participate.
As in previous PWN2OWN contests, winners will assign the rights to their exploits, and the vulnerabilities they triggered, to TippingPoint, which is known for its Zero Day Initiative bug-bounty program, which pays researchers for finding flaws. "We'll use the same process," said Forslof, "where the winner will sign the standard ZDI agreement, and information will be turned over to the vendor."
TippingPoint does not publicly release details of the vulnerabilities it buys, but instead reports them to the appropriate vendor and uses the information in its own security technology to preemptively block attacks.
Forslof said she and organizers of the conference are also in talks with several vendors about the companies having representatives on site during the contests. Last year, researchers from Microsoft, Apple and McAfee Inc. were at CanSecWest for consultation.
Dragos Ruiu, one of the CanSecWest organizers, "is trying to come up with a different spin on the contest," said Forslof, "but we're still sorting it all out."
Ruiu was not immediately available for comment.
Read more about Security in Computerworld's Security Topic Center.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts