IE8, iPhone will fall first day of hacking contest, predicts organizer
Pwn2Own sponsor bets researchers will hack Windows 7, Microsoft's browser, Apple's phone
Computerworld - Microsoft's Internet Explorer 8, not Apple's Safari, will be the first browser to fall in next week's Pwn2Own hacking challenge, the contest organizer said today.
Aaron Portnoy, security research team lead with 3Com TippingPoint, the sponsor of Pwn2Own, also predicted that Apple's iPhone will be the only smartphone hacked during the contest, which starts March 24.
Portnoy, who organized the fourth annual Pwn2Own, changed his predictions from earlier bets he made a month ago because of new information he received from researchers who have registered for the contest. Previously, Portnoy said that Apple's browser would crumble before rivals from Google, Microsoft and Mozilla; he had also declined to speculate on which mobile phone, if any, would collapse under attack.
Researchers will compete for $100,000 in cash prizes next week at CanSecWest, the Vancouver, British Columbia, security conference that has been the home of Pwn2Own. The dual-track contest -- one for browsers, the other for mobile operating systems -- will pit hackers against the latest versions of Chrome, Firefox, Internet Explorer (IE) and Safari running on Windows 7 or Mac OS X. The smartphone track will set hackers against Apple's iPhone 3GS, a Blackberry Bold 9700, a Nokia phone running the Symbian S60 platform and a Motorola, most likely a Droid, powered by Google's Android.
"I have discovered that one of our very own ZDI researchers is armed and ready to take on [IE8] on the very first day," said Portnoy in an e-mailed explanation of why he changed his browser prediction. "This will indeed be an impressive exploit from a technical standpoint."
ZDI, for Zero Day Initiative, is TippingPoint's bug bounty program, which purchases the vulnerabilities and exploits used during Pwn2Own. ZDI reports the vulnerabilities to the appropriate vendors during the contest, but keeps technical details secret until the bugs are patched.
In a post to the TippingPoint blog Tuesday, Portnoy said that attempts to hack IE8 would be especially difficult because of Windows 7 security mechanisms such as DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization). TippingPoint has also barred researchers from exploiting third-party plug-ins the first day of the three-day contest, making it tougher to carry out a successful attack.
"I have seen the prowess of the researcher in question and I have no doubt they will be able to pull off a DEP- and ASLR-bypassing exploit on Day 1," said Portnoy about the impending IE8 attack.
Safari will fall the second day, Portnoy said; last month, he had put his money on Safari to drop first, in part because he said Mac OS X 10.6, aka Snow Leopard, wasn't "on the same level as Windows 7" when it came to security. "I believe that Safari will indeed go down, just not on Day 1," Portnoy said today.
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Ponemon 2014 SSH Security Vulnerability Report According to research by the Ponemon Institute, 3 out of 4 enterprises have no security controls in place for SSH which leaves organizations...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!