IE8, iPhone will fall first day of hacking contest, predicts organizer
Pwn2Own sponsor bets researchers will hack Windows 7, Microsoft's browser, Apple's phone
Computerworld - Microsoft's Internet Explorer 8, not Apple's Safari, will be the first browser to fall in next week's Pwn2Own hacking challenge, the contest organizer said today.
Aaron Portnoy, security research team lead with 3Com TippingPoint, the sponsor of Pwn2Own, also predicted that Apple's iPhone will be the only smartphone hacked during the contest, which starts March 24.
Portnoy, who organized the fourth annual Pwn2Own, changed his predictions from earlier bets he made a month ago because of new information he received from researchers who have registered for the contest. Previously, Portnoy said that Apple's browser would crumble before rivals from Google, Microsoft and Mozilla; he had also declined to speculate on which mobile phone, if any, would collapse under attack.
Researchers will compete for $100,000 in cash prizes next week at CanSecWest, the Vancouver, British Columbia, security conference that has been the home of Pwn2Own. The dual-track contest -- one for browsers, the other for mobile operating systems -- will pit hackers against the latest versions of Chrome, Firefox, Internet Explorer (IE) and Safari running on Windows 7 or Mac OS X. The smartphone track will set hackers against Apple's iPhone 3GS, a Blackberry Bold 9700, a Nokia phone running the Symbian S60 platform and a Motorola, most likely a Droid, powered by Google's Android.
"I have discovered that one of our very own ZDI researchers is armed and ready to take on [IE8] on the very first day," said Portnoy in an e-mailed explanation of why he changed his browser prediction. "This will indeed be an impressive exploit from a technical standpoint."
ZDI, for Zero Day Initiative, is TippingPoint's bug bounty program, which purchases the vulnerabilities and exploits used during Pwn2Own. ZDI reports the vulnerabilities to the appropriate vendors during the contest, but keeps technical details secret until the bugs are patched.
In a post to the TippingPoint blog Tuesday, Portnoy said that attempts to hack IE8 would be especially difficult because of Windows 7 security mechanisms such as DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization). TippingPoint has also barred researchers from exploiting third-party plug-ins the first day of the three-day contest, making it tougher to carry out a successful attack.
"I have seen the prowess of the researcher in question and I have no doubt they will be able to pull off a DEP- and ASLR-bypassing exploit on Day 1," said Portnoy about the impending IE8 attack.
Safari will fall the second day, Portnoy said; last month, he had put his money on Safari to drop first, in part because he said Mac OS X 10.6, aka Snow Leopard, wasn't "on the same level as Windows 7" when it came to security. "I believe that Safari will indeed go down, just not on Day 1," Portnoy said today.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts