×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

First Pwn2Own 2009 Contest Winners Emerge

timothy posted more than 5 years ago | from the good-work-if-you-can-get-it dept.

Security 98

mellowdonkey writes "Last year's CanSecWest hacking contest winner, Charlie Miller, does it again this year in the 2009 Pwn2Own contest. Charlie was the first to compromise Safari this year to win a brand spankin new Macbook. Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well. Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

98 comments

Let me be the first to say (3, Insightful)

Jurily (900488) | more than 5 years ago | (#27261899)

Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well.

Wow.

Let me be the second to say (3, Funny)

Anonymous Coward | more than 5 years ago | (#27261919)

Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well.

Wow.

Wow.

Re:Let me be the second to say (0, Redundant)

Aranykai (1053846) | more than 5 years ago | (#27263979)

In this case, shouldn't the moderation be + Redundant?

Re:Let me be the second to say (0)

Anonymous Coward | more than 5 years ago | (#27264087)

NO.

Re:Let me be the second to say (0)

Anonymous Coward | about 5 years ago | (#27337537)

WoW.

Re:Let me be the first to say (2, Insightful)

von_rick (944421) | more than 5 years ago | (#27262193)

I'm pretty sure he knows more methods to compromise the OS through these browsers. Most likly he'll use those methods at next years' pwn2own. Same could be said about Charlie Miller.

Re:Let me be the first to say (4, Informative)

moderatorrater (1095745) | more than 5 years ago | (#27262549)

Actually, if I'm remembering correctly, Charlie Miller DID say that he knew of more ways to crack into a mac. He also said that Mac was just as insecure as Windows and that Windows gets attacked mainly because of the number of people using it.

Re:Let me be the first to say (2, Interesting)

Laser_iCE (1125271) | more than 5 years ago | (#27262661)

He also said that Mac was just as insecure as Windows and that Windows gets attacked mainly because of the number of people using it.

I tried to find some sort of source for this, but instead found this:

Windows 7 PC Outlasts Mac In Security Test [infopackets.com] , at PWN2OWN.

Re:Let me be the first to say (4, Informative)

Laser_iCE (1125271) | more than 5 years ago | (#27262693)

Nevermind,

Mac easiest to hack, says $10,000 winner [computerworld.com]

Re:Let me be the first to say (2, Informative)

terwey (917072) | more than 5 years ago | (#27264443)

"The MacBook Air was running the current version of Mac OS X, 10.5.2, with all the latest security patches applied." uhm... osx been buggin me quite some time now for updates for 10.5.6!

Re:Let me be the first to say (1, Flamebait)

oaklybonn (600250) | more than 5 years ago | (#27265077)

I wonder how much of "Mac easiest to hack" is due to the fact that WebKit is open source? Its got to be pretty easy to find exploits when you've got the source in front of you! And considering Darwin is open source, I'm surprised they weren't able to find a root exploit as well.

Re:Let me be the first to say (2, Informative)

Simetrical (1047518) | more than 5 years ago | (#27272573)

Its got to be pretty easy to find exploits when you've got the source in front of you!

A comparison of high-profile, seriously damaging Apache and IIS exploits would seem to indicate the opposite. Code Red and Nimda both caused a lot of damage, and targeted IIS. Any comparable stories for Apache, which has a larger market share than IIS by any figures I've seen?

Or heck, look at Firefox vs. IE. IE has historically been much less secure, although Firefox has had its share of screwups too. (Of course, the closed-source software does have a larger market share in this case. But then, WebKit has a smaller market share than either, so by that logic it should be even more secure.)

Even though it may be easier for malicious people to find vulnerabilities in open-source code, it's also easier for benevolent coders and third-party security auditors to find the exact same vulnerabilities and tell the vendor. This is Linus' law [wikipedia.org] at work: given enough eyeballs, all bugs are shallow. There is no reason to assume a priori that open-source applications will be more vulnerable: only study will show that. And it seems like they're less vulnerable than most closed-source software, if anything.

Re:Let me be the first to say (1)

mpeskett (1221084) | more than 5 years ago | (#27284861)

Of course it only applies if the code in question actually gets looked over by a lot of people. True for high profile things like Apache, but smaller open source projects can't be automatically assumed to be more secure - they may well have no more, or less, people actively reviewing their code than an equivalent program from a normal developer.

Re:Let me be the first to say (0)

Anonymous Coward | about 5 years ago | (#27331017)

Yes, but then again, maybe all the (obvious) root exploits in Darwin were already found and patched? As I think WebKit sees more development activity, it's likely to have more undiscovered exploits per kLOC.

Re:Let me be the first to say (4, Funny)

drsmithy (35869) | more than 5 years ago | (#27263389)

Actually, if I'm remembering correctly, Charlie Miller DID say that he knew of more ways to crack into a mac. He also said that Mac was just as insecure as Windows and that Windows gets attacked mainly because of the number of people using it.

BURN HIM ! BURN THE HERETIC !

Re:Let me be the first to say (2, Insightful)

Anonymous Coward | more than 5 years ago | (#27264247)

No not burn, just leave him and all the other to their windoze spyware nightmare :)

Re:Let me be the first to say (5, Informative)

tonywong (96839) | more than 5 years ago | (#27262885)

Since no one has placed what 'owned' means, here's the rules from the canwest site:

2009-03-18-01:00:00 PWN2OWN Final Rules

Well after much discussion and deliberation here is the final cut at scenarios for the PWN2OWN competitions.

Browsers and Associated Test PAltform

Vaio - Windows 7

        * IE8
        * Firefox
        * Chrome

Macintosh

        * Safari
        * Firefox

Day 1: Default install no additional plugins. User goes to link.
Day 2: flash, java, .net, quicktime. User goes to link.
Day 3: popular apps such as acrobat reader ... User goes to link

What is owned? - code execution within context of application

=====

I'm presuming that code execution is the first step towards owning the whole box, which may or may not be trivial once you got code execution happening within the app.

Re:Let me be the first to say (1)

Simetrical (1047518) | more than 5 years ago | (#27272591)

What is owned? - code execution within context of application

Does this mean that you win if you execute code in a sandboxed application, even if that means you can't actually harm the user at all?

Re:Let me be the first to say (1)

Hurricane78 (562437) | more than 5 years ago | (#27265781)

The nice thing about this, is that for Firefox, and probably also Safari, the bugs are already fixed.
So all in all, this was a good thing for us all.

The third exploit was a good thing for botnet owners only. ;)

Macintosh (0, Insightful)

Anonymous Coward | more than 5 years ago | (#27261963)

'Security' through obscurity

Cool story bro (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#27261995)

I want to be the very best
Like no one ever was
To catch them is my real test
To train them is my cause (oooh)
I will travel across the land
Searchin' far and wide
Each Pokemon to understand
The power that's inside! (Power inside!)

Pokemon!
It's you and me.
I know it's my destiny!
Pokemon!
Ooh you're my best friend
In a world we must defend!
Pokemon!
A heart so true
Our courage will pull us through
You teach me and I'll teach you
Pokemon!
(Gotta catch 'em) Gotta catch 'em Gotta catch 'em all!

Every challenge along the way
With courage I will face
I will battle everyday
To claim my rightful place!
Come with me, the time is right!
There's no better team
Arm and arm, we'll win the fight!
It's always been a dream!

Pokemon!
It's you and me.
I know it's my destiny!
Pokemon!
Ooh you're my best friend
In a world we must defend!
Pokemon!
A heart so true
Our courage will pull us through
You teach me and I'll teach you
Pokemon!
(Gotta catch 'em) Gotta catch 'em (Pokemon!)

Pokemon!
It's you and me.
I know it's my destiny!
Pokemon!
Ooh you're my best friend
In a world we must defend!
Pokemon!
A heart so true
Our courage will pull us through
You teach me and I'll teach you
Pokemon!
(I'll catch you!)
(Gotta catch 'em Gotta catch 'em Gotta catch 'em all!
Pokemon!

Hmmm.... (2, Insightful)

Khyber (864651) | more than 5 years ago | (#27262097)

Well, I'm not surprised it didn't take but a few moments for the contest to be won.

Man can make it, man can break it. That's it.

Re:Hmmm.... (5, Funny)

Anonymous Coward | more than 5 years ago | (#27262189)

But Safari was created by the Gods at Apple....

Re:Hmmm.... (5, Funny)

ijakings (982830) | more than 5 years ago | (#27262837)

Firefox Three for the Elven-kings under the sky,
IE Seven for the Dwarf-lords in their halls of stone,
Netscape Nine for Mortal Men doomed to die,
One Safari for the Dark Lord on his dark throne
In the Land of Apple where the Shadows lie.
One Browser to rule them all, One Browser to find them,
One Browser to bring them all and in the darkness bind them
In the Land of Apple where the Shadows lie.

Re:Hmmm.... (0)

Anonymous Coward | more than 5 years ago | (#27265051)

this makes you wonder if the widespread adopting of WebKit is actually a bad thing...

Re:Hmmm.... (1)

Lars T. (470328) | more than 5 years ago | (#27266875)

It's about time the iPhone got copy&paste, else one couldn't write masterpieces like that on it!

Re:Hmmm.... (2, Interesting)

rthille (8526) | more than 5 years ago | (#27263457)

Yeah, but from what I read, the attack was via a PERL regex library used by the javascript engine. So it was in something Apple just used and not something they wrote from scratch. <sarcasm> I'm sure had Apple written the whole thing from scratch, there'd be no bugs...</sarcasm>

Re:Hmmm.... (1)

drinkypoo (153816) | more than 5 years ago | (#27263943)

Yeah, but from what I read, the attack was via a PERL regex library used by the javascript engine. So it was in something Apple just used and not something they wrote from scratch. <sarcasm> I'm sure had Apple written the whole thing from scratch, there'd be no bugs...</sarcasm>

While we're conjecturing wildly (well, you didn't cite) Apple has a history of failing to keep their Open Source components current, especially perl modules (there was a discussion here recently about manually-updated perl modules being whacked by an Apple 'update'.)

Re:Hmmm.... (3, Informative)

makomk (752139) | more than 5 years ago | (#27266473)

No, it was via Safari's very outdated internal copy (probably even a fork, from what I recall) of the pcre regex library. I think the equivalent bug had been fixed in the upstream library ages before.

Re:Hmmm.... (2, Funny)

rthille (8526) | more than 5 years ago | (#27272963)

heh, my memory had conflated pcre and perl. That'll teach me to look shit up.

Re:Hmmm.... (0)

Anonymous Coward | about 5 years ago | (#27335513)

Only if you count ripping off Konqueror's rendering engine "creating".

Re:Hmmm.... (1)

doas777 (1138627) | more than 5 years ago | (#27262431)

well, security research is something you prep for, not do on the fly. no doubt they have been polishing the exploits and throughly testing them "off stage", as it were.

Re:Hmmm.... (1)

broken_chaos (1188549) | more than 5 years ago | (#27262553)

No kidding. Basically it was a draw from the summary's hat for who won the computers, from what I can gather. At least, that's the impression I'm getting...

It's also very unclear what constitutes "pwned". Even reading the rules, "code execution in the context of the application" or something... Does that mean these exploits are actually usable to do something malicious, or do they just, say, crash the browser?

Re:Hmmm.... (1)

doas777 (1138627) | more than 5 years ago | (#27262663)

good point. i was wondering what the runner-up did that put his exploits outside the criteria of the contest.

Re:Hmmm.... (2, Insightful)

rts008 (812749) | more than 5 years ago | (#27262847)

Does that mean these exploits are actually usable to do something malicious,...

Yes.

The code executed by the contestant may not be malicious, it is only meant to showcase the exploit being used. If I were a contestant, I would not run malicious code on the laptop I was hoping to take home with me! Maybe download a Kubuntu .iso and Wubi.exe, and execute Wubi.....

Used in the wild, the exploit would almost certainly be used to execute malicious code, I'd think.

Re:Hmmm.... (2, Insightful)

MadnessASAP (1052274) | more than 5 years ago | (#27263049)

It's also very unclear what constitutes "pwned". Even reading the rules, "code execution in the context of the application" or something... Does that mean these exploits are actually usable to do something malicious, or do they just, say, crash the browser?

Seems pretty cut and dry to me, it means they were able to inject their own code into the processes memory and get it too execute. So no privilege escalation but you can now do whatever said application would theoretically been able to do.

Re:Hmmm.... (3, Insightful)

RiotingPacifist (1228016) | more than 5 years ago | (#27263635)

thats why its time for andriod style security on the desktop , firefox should ONLY be able to write to a downloads folder & its profile, OO should ONLY be able to read/write to disk, NO network access,.

Re:Hmmm.... (1)

Dr. Smoove (1099425) | more than 5 years ago | (#27267265)

"Android style security"??? It's a sad day on /. when someone calls mandatory access control "android style security".

Re:Hmmm.... (2, Interesting)

Simetrical (1047518) | more than 5 years ago | (#27272731)

thats why its time for andriod style security on the desktop , firefox should ONLY be able to write to a downloads folder & its profile

So what if the user uses "Save Page As..."? You'd have to have an infrastructure that allows spawning a file picker as a separate app with its own permissions. What if the user customizes the directory for storing the web cache? What if Firefox creates an executable in a prohibited location and then runs it? Etc. Firefox is an awfully big application; it would be hard to pin it down with hard-and-fast rules on what directories it can access.

OO should ONLY be able to read/write to disk, NO network access,.

That's a real impediment. Just write out your malicious script to the user's home directory somewhere, and append some lines to ~/.bashrc or whatever startup files you like.

What's really needed isn't so much restricting what files the program can access, but how it can access them. Bitfrost [wikipedia.org] has a very interesting approach. I haven't looked at Android, but I'd assume it's similar in some ways. You need a fair amount of infrastructure for this to work, though.

Re:Hmmm.... (1)

UnRDJ (712762) | more than 5 years ago | (#27264497)

Now let's consider how many inexperienced users run everything as administrator/root. Those botnets don't make themselves!

Re:Hmmm.... (1)

MadnessASAP (1052274) | more than 5 years ago | (#27264887)

I think most slashdotters can understand the implications of what happens when an application running as root get compromised. Those that don't probably work at Microsoft :-).

WTF ? (0, Insightful)

Anonymous Coward | more than 5 years ago | (#27262177)

Either these guys are very good.

or something is very wrong with the security features of these Apps

Re:WTF ? (3, Informative)

JB19000 (1389999) | more than 5 years ago | (#27262399)

Nonsense, all exploits used at these have already been know to at least the competitor. Afterwords they are submitted to the developers. This competition is used to give recognition to security researchers and improve browsers not to prove anything about a certain program.

Re:WTF ? (0, Flamebait)

fat_mike (71855) | more than 5 years ago | (#27265005)

Do you really believe that these things involve anything more than "I'm uber-geek, all shall bow before me" contests?

If these "Pwn20wn" things were serious then they wouldn't be advertised on here.

Also you suck and so does your grammar, gramer, grammer, gemmar. Fuck, somebody write me a Linux grammar checker.

Re:WTF ? (0, Funny)

Anonymous Coward | more than 5 years ago | (#27262419)

I'll tell you what's very wrong with the security features of these apps: they're all written in C++.

Re:WTF ? (0)

Anonymous Coward | more than 5 years ago | (#27266465)

I`m writing my applications in C you insensitive clod

Re:WTF ? (0)

Anonymous Coward | more than 5 years ago | (#27269617)

Real men write in objective-C

Re:WTF ? (3, Insightful)

JumpDrive (1437895) | more than 5 years ago | (#27262499)

I think that something is very wrong with the security features of these apps or the OS on which they were run.
I'd like to see a browser stabilized so that more work can be done on the security. I always wonder, how can they may a secure browser if they are constantly adding features to it?
What else do we need for a browser to do?
I'm serious, what else do we really need a browser to do? Can we stop for awhile and work on making one more secure?

Re:WTF ? (1)

rastos1 (601318) | more than 5 years ago | (#27267483)

We run a marathon. If I stop now to reconsider my strategy, the other guys will keep going and leave me behind. If I come up with better strategy while thinking, I will make up the loss sooner or later. However the rules are different here: If the gap between the main group and me grows too much, I get disqualified. Now the question is whether I can come up with better strategy at all and whether I can do it before the gap grows too much.

Re:WTF ? (3, Insightful)

doas777 (1138627) | more than 5 years ago | (#27262519)

it's seems to me to be an indication that we are pushing new functionality before the basis upon which it functions is mature enough to be safely reviewed. the complexity of a given computing environment is increasing at an approximately exponential rate, so there is more and more that need be tested and vetted everyday.
there are just some things that we need to accept aren't safe yet. As much as I like active web pages like this one, the problems with CGI and javascript persist even today, despite a decade+ of review and testing. I find online banking and drivers license registeration very convient, but at the same time, I firmly believe that there is no way to be safe when performing fiscal transactions online. don't get me wrong, I use these services, but I wish the chaotic computing environment would slow down a bit so we can catch up with the securiy problems of last year, before facing next years.

Or, ... (3, Insightful)

reiisi (1211052) | more than 5 years ago | (#27262621)

Once or twice meant something, but now it's an institution.

Meaning that somebody is going to try to make a career of breaking the easiest part of the system at this contest.

Meaning that these guys are going to sit on their exploits.

Meaning that this contest, running at a set time once a year, is now meaningless.

Except for advertising potential. You know, keeping your product name in the headlines.

The respective companies should offer a running bounty on exploits on their browsers. Yeah, that would spoil all the pageantry of Pwn20wn, but do we really need another pageant?

Re:Or, ... (3, Insightful)

Nazlfrag (1035012) | more than 5 years ago | (#27265145)

They change the rules and targets each year. Nobody will sit on an exploit all year because there's no way to know what to hang on to, or whether the hole will still be there in a month, let alone a year. It's used to promote the Zero Day Initiative [zerodayinitiative.com] which pays you directly for exploits, no fancy contest needed. The contest serves its purpose perfectly. It's never been a meaningful way to stop exploits anyway, just a promotional vehicle for the conference and the respective companies. Nobody's going to make a career out of this competition. If they were good enough to do that, they could make a comfortable living from the ZDI.

Re:Or, ... (3, Insightful)

pyrrhonist (701154) | more than 5 years ago | (#27265693)

Nobody will sit on an exploit all year because there's no way to know what to hang on to, or whether the hole will still be there in a month, let alone a year.

That's exactly what happened [zdnet.com] this year:

I actually found this bug before last year's Pwn2Own but, at the time, it was harder to exploit. I came to CanSecWest last year with two bugs but only one exploit. Last year, you could only win once so I saved the second bug. Turns out, it was still there this year so I wrote another exploit and used it this year.

Re:Or, ... (4, Insightful)

Fred_A (10934) | more than 5 years ago | (#27265855)

That's exactly what happened [zdnet.com] this year:

I actually found this bug before last year's Pwn2Own but, at the time, it was harder to exploit. I came to CanSecWest last year with two bugs but only one exploit. Last year, you could only win once so I saved the second bug. Turns out, it was still there this year so I wrote another exploit and used it this year.

So in a way what this event did is help keep a known vulnerability open for a year more than it should have been. Which means that there is a fair chance that in the mean time some body else might have found and used it in the wild.

Brilliant.

Re:Or, ... (2, Informative)

Simetrical (1047518) | more than 5 years ago | (#27272789)

That's exactly what happened [zdnet.com] this year:

I actually found this bug before last year's Pwn2Own but, at the time, it was harder to exploit. I came to CanSecWest last year with two bugs but only one exploit. Last year, you could only win once so I saved the second bug. Turns out, it was still there this year so I wrote another exploit and used it this year.

So in a way what this event did is help keep a known vulnerability open for a year more than it should have been. Which means that there is a fair chance that in the mean time some body else might have found and used it in the wild.

Brilliant.

Wrong. Read the rest of the link:

Did you consider reporting the vulnerability to Apple?

I never give up free bugs. I have a new campaign. It's called NO MORE FREE BUGS. Vulnerabilities have a market value so it makes no sense to work hard to find a bug, write an exploit and then give it away. Apple pays people to do the same job so we know there's value to this work. No more free bugs.

He wouldn't have given up the bug if not for the contest. He'd have sat on it anyway until he found someone else to pay him for it.

Re:Or, ... (3, Informative)

BZ (40346) | more than 5 years ago | (#27265271)

> The respective companies should offer a running bounty on exploits on their browsers.

You mean like http://www.mozilla.org/security/bug-bounty.html [mozilla.org] ?

The problem is that browser exploits sell for about $10,000 at the moment (that's how much various "security" companies will pay for them). The bug bounty above is $500...

Re:Or, ... (1)

Plunky (929104) | more than 5 years ago | (#27266019)

Alas, the bad guys will always want to pay more for the exploit as its more valuable to them. Get this: $10,000 is nothing, they can make millions in profit!

Re:Or, ... (1)

reiisi (1211052) | more than 5 years ago | (#27277449)

Well, yeah, but I'm not sure I'd call it profit.

Ill-gotten gains have the baggage of having been gotten by ill means. When you start taking from other people, you start forgetting how to make your own.

I know the economy is bad. It's always bad. That's part of the puzzle we are trying to solve, how to provide for ourselves and our own in an adversarial economy. When we solve that puzzle well, we add value to the economy and to our own state of being. When we steal, we take away from both.

Of course, the bad guys don't understand this, and maybe it isn't worth quibbling over words, but I think I would have said "rake in" instead of "make", and not said profit. What to say instead of profit, I'm not sure. Any ideas?

I have your answer. (1)

Khyber (864651) | more than 5 years ago | (#27265297)

Straight from the horse's mouth:

"Why Safari? Why didnâ(TM)t you go after IE or Safari?

Itâ(TM)s really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs donâ(TM)t do. Hacking into Macs is so much easier. You donâ(TM)t have to jump through hoops and deal with all the anti-exploit mitigations youâ(TM)d find in Windows.

Itâ(TM)s more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesnâ(TM)t have anti-exploit stuff built into it."

That's right - Windows is harder to exploit because it's so damned convoluted. Macs are easy prey because they don't have that convolution built-in as a security measure.

Re:I have your answer. (2, Informative)

Simetrical (1047518) | more than 5 years ago | (#27272837)

Straight from the horse's mouth:

"Why Safari? Why didn't you go after IE or Safari?

It's really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don't do. Hacking into Macs is so much easier. You don't have to jump through hoops and deal with all the anti-exploit mitigations you'd find in Windows.

It's more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesnâ(TM)t have anti-exploit stuff built into it."

That's right - Windows is harder to exploit because it's so damned convoluted. Macs are easy prey because they don't have that convolution built-in as a security measure.

Wrong. He gives more details than you quoted:

With my Safari exploit, I put the code into a process and I know exactly where it's going to be. There's no randomization. I know when I jump there, the code is there and I can execute it there. On Windows, the code might show up but I don't know where it is. Even if I get to the code, it's not executable. Those are two hurdles that Macs don't have.

He's saying that Windows uses recognized security techniques like DEP [wikipedia.org] and ASLR [wikipedia.org] , and Mac doesn't. (Linux does use both of those, to varying extents depending on distro and configuration.)

Re:I have your answer. (1)

Khyber (864651) | more than 5 years ago | (#27280787)

ASLR is simply making sure core files aren't always loaded into the same address space - making it more convoluted. There are more twists, more hoops, more folds to go through, before you can get to what you want.

Convoluted - adj: Complex, intricate or complicated; Having numerous overlapping coils or folds

Re:I have your answer. (1)

Simetrical (1047518) | more than 5 years ago | (#27283923)

ASLR is simply making sure core files aren't always loaded into the same address space - making it more convoluted. There are more twists, more hoops, more folds to go through, before you can get to what you want.

Convoluted - adj: Complex, intricate or complicated; Having numerous overlapping coils or folds

So are you saying ASLR is a bad thing? If so, why? If not, why did you use the clearly derogatory terminology "so damned convoluted"?

Anyway, a non-executable stack has nothing to do with being convoluted, and that's also an obstacle that he mentioned.

Re:I have your answer. (1)

Khyber (864651) | more than 5 years ago | (#27284655)

Windows is so damned convoluted, that is what I said. ASLR is a good thing. I find it funny that the one thing that people tend to complain about - all the twists and turns in Windows and how sloppy and make-shift it is, ends up making it somewhat more secure in one form.

Sandboxing to rescue (0)

Anonymous Coward | more than 5 years ago | (#27262363)

If browsers would be truely sandboxed, no big worries. Sandbox could be even recreated at every start from safe binary cache on harddisk so compromise would only affect the current session inside sandbox. Sandbox could be even completely separate slimmed down virtual session.

It is not impossibe to teach people to restart it after surfing porn. It is impossible to prevent them visiting malicious sites.

Re:Sandboxing to rescue (2, Informative)

doas777 (1138627) | more than 5 years ago | (#27262557)

i think the problem is, that if you completely isolate the browser, it becomse less useful, so no one wants to. also interprocess communication is a kernel level thing, so whatever process is running inherently has the ability to work with other processes and threads. all you have to do is break the protections within the process and you have some real control.
they are getting better with this, but they still have a long way to go.

Re:Sandboxing to rescue (0)

Anonymous Coward | more than 5 years ago | (#27262589)

So it would be cool if all it could get was your bank account data from the site you just logged into a moment ago? Or did you mean that each web page you visit gets its own independent sandbox?

Re:Sandboxing to rescue (1)

Beardo the Bearded (321478) | more than 5 years ago | (#27262603)

Don't you read slashdot? [slashdot.org] There's a known hack to take control of the CPU and circumvent the entire OS.

Your computer is only yours by the whims of others.

Re:Sandboxing to rescue (1)

Goaway (82658) | more than 5 years ago | (#27264027)

That only works in ring 0, that is, if you are already root. Thus, it can only make a bad exploit even worse, it won't help you get out of a sandbox.

ScoreAfter Day 1 (for the TL;DR crowd) (4, Informative)

Deathlizard (115856) | more than 5 years ago | (#27262627)

Browsers
Chrome: 0
IE8: 1
Firefox: 1(1)*
Safari: 2(1)*

Mobile Browsers
Blackberry: 0
Android: 0
iPhone: 0
Nokia/Symbian: 0
Windows Mobile: 0

*Numbers in parenthesis indicate Successful exploits that fell outside the contest criteria and therefore could not be rewarded.

Re:ScoreAfter Day 1 (for the TL;DR crowd) (3, Interesting)

Slashdot Suxxors (1207082) | more than 5 years ago | (#27262861)

Has nobody tried "hacking" the mobile devices? You'd think with all the BBs/iPhones/WM and Symbian devices out there, there would be a market for exploiting them.

Re:ScoreAfter Day 1 (for the TL;DR crowd) (0)

Anonymous Coward | more than 5 years ago | (#27265539)

Higher is worse, right?

No linux? (0)

Anonymous Coward | more than 5 years ago | (#27263065)

Not clear in the article, but the exploits were only under windows and osx?

Re:No linux? (3, Insightful)

RiotingPacifist (1228016) | more than 5 years ago | (#27263653)

firefox is firefox, it runs on linux, it can be exploited on linux. NOSCRIPT FTW

Re:No linux? (2, Insightful)

ld a,b (1207022) | more than 5 years ago | (#27263799)

The same hole can have different levels of exploitability in different OSes. FF for Windows cannot take advantage of ASLR because Windows XP didn't support it. In Linux it should be enabled by default by now. MacOS X has nothing at all yet.

If all OSes would implement all of OpenBSD security features, even if not perfectly, the amount of exploitable bugs would decrease considerably. The bug is still there, but the black hat is met with a harsh environment totally unlike the green garden that are major OSes.

Re:No linux? (1)

vistapwns (1103935) | more than 5 years ago | (#27264269)

FF on Vista does use ASLR and DEP, but not protected mode like IE. This can be verified with Process Explorer run on Vista with FF open, just add "ASLR" and "DEP" columns.

No details? (2, Insightful)

rbanzai (596355) | more than 5 years ago | (#27263205)

I checked the article and there don't appear to be any details. A few of these hacking contests have been a bit overblown so I'd like to know what manner of exploit they used.

If it's another "well you need physical access to the machine and know the admin username and password" then it's no big deal. If it's "we had the user click a link and all hell broke loose" that would be much more interesting.

Re:No details? (5, Interesting)

ld a,b (1207022) | more than 5 years ago | (#27263591)

>"we had the user click a link and all hell broke loose"

That is exactly what happened with Safari on MacOS, in seconds. I guess the others fell just as easily, but with a bit more crude exploits.

We don't get to know the details because vendors get to fix the hole before anything is published, which is long after all of us have forgotten about the contest.

What really is misleading is that Windows 7 and MacOS are implied pwned when it appears that only the browsers were taken.

With IE8 purportedly running in a "sandbox", breaking out of that was interesting by itself and hopefully a bit more difficult than just escalating privileges in MacOS.

I miss Linux too. A hole in firefox means being just one local exploit away from pwning your box.

Not clear if sandbox was breached (0)

benjymouse (756774) | more than 5 years ago | (#27265731)

Per the contest rules it wasn't necessary to break out of the sandbox, so at this point it is not clear that that happened. Simply executing code in context of the application (browser) would be enough. You can still do a lot of damage inside the browser, i.e. install password/certificate snooping, monitor and inject traffic etc. But it all ends with the browser session. You cannot read/write users' files much less compromise the machine.

Unlike Firefox, Opera and Safari, Chrome and IE actually has such a sandbox. Chrome actually has a 2-level sandbox and a process-per-tab while IE only has a single sandboxed process common to all tabs.

In addition to that IE has a really big supply of extra defenses such as heap encryption, various stack overflow protections, mechanisms designed to foil exception handler exploitation etc. At least some of these must have been broken in the attack against IE8. Recently a couple of security researchers demonstrated how most (if not all) of these mitigation mechanisms (except for sandbox) could be broken by leveraging perfectly valid code to reduce entropy (most of these mitigation mechanisms work by introducing entropy or encryption thus lowering the chance of a successful attack)

Firefox, Opera and Safari has no sandbox and practically no extra mitigation mechanisms to speak of, except for those offered by the operating system. Again, OSX is a the bottom of the heap here, with practically NO extra mitigation techniques. Vista offers the most, especially on 64bit.

For the last couple of years, Firefox (not IE) has been the browser with the most vulns. Combine that with the fact that it has no sandbox, no extra mitigation techniques and that it relies heavily on extensions and plugins the quality of which cannot be controlled by Mozilla. That's a recipe for a security disaster. On Windows and on any other OS.

You can argue that SELinux may be able to achieve something akin to a sandbox. While it can certainly lock down an app pretty tight, it does have 2 issues: 1) It's highly impractical. Mainstream users will not be able to set up a profile and no mainstream distro has been able to supply a built-in profile which suit the needs of the general user. 2) While a profile may prohibit/allow certain calls, it cannot do so based on what the user wants to do. If FF needs to read or write from/to a directory, it will be allowed to do so always. The IE/Chrome sandbox design always denies local file system access. To be able to upload/download files the browser process must interact with a higher privileged process to do the actual marshalling of files. Obviously such a design is inherently stronger.

Re:Not clear if sandbox was breached (1)

drerwk (695572) | more than 5 years ago | (#27267093)

But it all ends with the browser session. You cannot read/write users' files much less compromise the machine.

If you can execute in the applications context, I think you can write to the preferences files - even if the app is in a sandbox. At that point you might be able to save your hack and have it reloaded at start up. You might save your hack as file: //homepage.html and load that.

Re:Not clear if sandbox was breached (1)

benjymouse (756774) | more than 5 years ago | (#27273349)

If you can execute in the applications context, I think you can write to the preferences files - even if the app is in a sandbox.

No, not in a sandbox. That\s the difference between something like SELinux and a real sandbox. With SELinux you will be allowed to do what you legitimately need to be able to do. In a sandbox you will have to ask the broker process to perform the privileged operations. Neither Chrome nor IE let the rendering process access the local file system. Instead they supply a broker/helper process. Typically this process will interact with the user, i.e. if downloading a file it will display a dialog or visual element to let the user choose if/where to download the file to.

You are right that if you protect Firefox with SELinux, it still needs to be able to access the preferences store. Thus a contaminated instance will be allowed to do the same, i.e. it will be able to change settings without user interaction or consent.

Chrome actually takes it one step further, isolating each tab in its own process. This (in theory) prevents cross-contamination between tabs. If an attacker successfully compromises one tab he can still not intercept communications from/to the other tabs. While IE has a sandbox it doesn't protect individual tabs, merely the browser itself and the file system.

Re:No details? (0)

Anonymous Coward | more than 5 years ago | (#27267051)

I guess the others fell just as easily, but with a bit more crude exploits.

That's not what this interview with the Safari winner seems to indicate [zdnet.com] . He says that IE8 and Windows in general is tougher to crack than safari and OSX.

A little off topic, but I was checking out this reddit "viewer" that shows activity in real time and the interview article was getting _slammed_ with downvotes.

Sensored? (1, Funny)

Anonymous Coward | more than 5 years ago | (#27263291)

Is it just me, or does it look like they censored Nils' zipper when he was showing off his winnings?

Re:Sensored? (0)

Anonymous Coward | more than 5 years ago | (#27263695)

Incorrect. It is his ID badge. You can see it in the other shots.

Re:Sensored? (4, Funny)

93 Escort Wagon (326346) | more than 5 years ago | (#27263715)

Is it just me, or does it look like they censored Nils' zipper when he was showing off his winnings?

I have no idea - but why were you were looking down there in the first place?

Re:Sensored? (0)

Anonymous Coward | more than 5 years ago | (#27265645)

On the image right above that one you will realize that it's actually some card attached to his pants, which has probably his name or favorite food on it.

Re:Sensored? (0)

Anonymous Coward | more than 5 years ago | (#27269473)

all the cool kids wear their name badges at the bottom of their shirt and backwards

Didn't write the exploits in seconds did they?! (2, Interesting)

BestNicksRTaken (582194) | more than 5 years ago | (#27266075)

The speed factor seems pointless in this exercise - if they didn't write the exploits there and then at the conference, it effectively boils down to who can stick his thumbdrive in the slot and double-click the fastest!

Why did it take longer to kill IE8/Firefox if the exploits were already written and just needed to be run by clicking a URL?

Make the fsckers write their own exploits, and make them do it at the show. THAT would be worth 10k.

Re:Didn't write the exploits in seconds did they?! (0)

Anonymous Coward | more than 5 years ago | (#27269375)

boring too. What you don't seem to understand here is that these exploits are worth 10k to the companies. the real question is how much these exploits are worth on the black market..

Re:Didn't write the exploits in seconds did they?! (0)

Anonymous Coward | about 5 years ago | (#27331169)

Because IE and Firefox are slower than Safari?

What details...? (3, Interesting)

argent (18001) | more than 5 years ago | (#27266405)

Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program.

I see no details here.

Like they don't care? (2, Interesting)

SirSlud (67381) | about 5 years ago | (#27337811)

Who the hell cares about Windows, Macs, Linux?

Put these folks on voting machines - it's way more important to protect the sanctity of democracy than to point out exploitable browsers.

I get the economics of it, but this is what insurance is for. Software companies care about security, but at some point this becomes more about mental masturbation - cracking will always occur. Why not create some incentive to put the desire to crack on important systems rather than worry about jo-shmoes machine getting compromised.

Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...