Hacker challenge takes aim at browsers, smartphones
'PWN2OWN' targets include IE8 on Windows 7, the Android and Apple's iPhone
Computerworld - A hacking contest that has grabbed headlines two years running will take aim next month at browsers and smartphones, according to 3Com Inc.'s TippingPoint, the security company that sponsors the "PWN2OWN" challenge.
"We're still in the planning stages for how the competition will be structured," said Terri Forslof, the manager of security response at TippingPoint, regarding discussions she's had with organizers of CanSecWest, the security conference where the challenge will take place. CanSecWest is slated to begin March 16 in Vancouver, British Columbia.
While the details have yet to be sorted out -- including the dollar amounts for prizes and the contest rules -- Forslof confirmed that PWN2OWN will actually consist of two separate hacker challenges this year.
The first will be a contest to break into one of several browsers, including Microsoft Corp.'s Internet Explorer 8, which recently reached "release candidate" status; Mozilla Corp.'s Firefox; and Apple Inc.'s Safari.
That contest will play out on a Sony notebook equipped with Windows 7, the still-under-construction successor to Windows Vista.
The second challenge will pit hackers against a variety of smartphone operating systems, including Google Inc.'s Android, Microsoft's Windows Mobile and Apple's iPhone operating system, which is a scaled-down version of Mac OS X.
Cash prizes will be awarded, Forslof said today, but the number of prizes and their amounts have yet to be decided. As was the case in the past two years, TippingPoint will be the sole sponsor of the PWN2OWN contest.
Last year at CanSecWest, noted Apple vulnerability researcher Charlie Miller broke into a MacBook Air laptop in under two minutes to win $10,000. The next day, security consultant Shane Macaulay claimed a $5,000 prize for breaching a Fujitsu notebook running Windows Vista Service Pack 1.
For his part, Miller was frustrated that PWN2OWN would not have a Mac OS X component this year.
"I'm really disappointed that there looks to be no Mac OS X target, as I'm really up to speed on that OS," said Miller, who will be at CanSecWest as a speaker. Although he was confident that he could hack Apple's operating system again, he also said he was up to snuff on browsers and smartphones. "I could theoretically do either contest or both," he said in an e-mail today.
Like others, he's waiting for more information -- including the prize amounts -- before deciding whether to participate.
As in previous PWN2OWN contests, winners will assign the rights to their exploits, and the vulnerabilities they triggered, to TippingPoint, which is known for its Zero Day Initiative bug-bounty program, which pays researchers for finding flaws. "We'll use the same process," said Forslof, "where the winner will sign the standard ZDI agreement, and information will be turned over to the vendor."
TippingPoint does not publicly release details of the vulnerabilities it buys, but instead reports them to the appropriate vendor and uses the information in its own security technology to preemptively block attacks.
Forslof said she and organizers of the conference are also in talks with several vendors about the companies having representatives on site during the contests. Last year, researchers from Microsoft, Apple and McAfee Inc. were at CanSecWest for consultation.
Dragos Ruiu, one of the CanSecWest organizers, "is trying to come up with a different spin on the contest," said Forslof, "but we're still sorting it all out."
Ruiu was not immediately available for comment.
Read more about Security in Computerworld's Security Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts