Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Pwn2Own 2012 Set To Reveal More Browser Vulnerabilities Than In the Past

Soulskill posted more than 2 years ago | from the quality-over-quantity-but-quantity-is-good-too dept.

Security 57

darthcamaro writes "In any given year, Slashdot always has stories about how a researcher hacked a browser in only a few minutes at the Pwn2own hacking challenge. This year the rules are a bit different, and instead of hackers winning for just one vulnerability, the rules allow for multiple vulnerabilities to be presented. The winner isn't the first one to hack a browser, but is the one that can hack the browser the most. 'In the past, due to the way the competition was architected, we had lots of sensationalist headlines, things like "Mac hacked in three seconds,"' said Aaron Portnoy, Manager of the Security Research Team at HP TippingPoint. 'We don't think that type of sensationalism was representative of all the research that was going on.'"

cancel ×

57 comments

Sorry! There are no comments related to the filter you selected.

The security of all browsers needs to be looked at (-1, Flamebait)

bejiitas_wrath (825021) | more than 2 years ago | (#38802153)

Is IE represented as the most insecure web browser or is this evenly spread over most common web browsers? I would think that the open source browsers would be more secure than a closed source option like Opera or IE, but maybe Firefox has some vulnerabilities as well.

Re:The security of all browsers needs to be looked (1)

g0bshiTe (596213) | more than 2 years ago | (#38804243)

All browsers are insecure. IE beats out Firefox in some aspects as does Firefox beat IE, same with Opera and Safari. I love my Firefox. I think it just comes down to preference. I also used to be one of those that claimed Firefox was the most secure browser, until I found out it wasn't.

Re:The security of all browsers needs to be looked (1)

Anonymous Coward | more than 2 years ago | (#38804531)

Truth be told, Firefox was not hacked last year. Jus' sayin'.

Re:The security of all browsers needs to be looked (1)

Goaway (82658) | more than 2 years ago | (#38807283)

Firefox is pretty much the least secure browser at this time.

Re:The security of all browsers needs to be looked (1)

RebelWebmaster (628941) | more than 2 years ago | (#38811293)

*Citation please.

Actually an extremely good point (4, Insightful)

Riceballsan (816702) | more than 2 years ago | (#38802169)

The time is pretty irelevant. I mean it isn't like the hackers hadn't seen the OS's or browsers before they set foot on the floor and were going blind. That is like giving someone a sudoku puzzle a month in advance, having him do it from memory and claiming that this guy is so smart he can solve the sudoku puzzle in 30 seconds.

Re:Actually an extremely good point (0)

Anonymous Coward | more than 2 years ago | (#38802241)

Well, see, the point is that he's able to solve the sudoku at all.

Re:Actually an extremely good point (3, Insightful)

Riceballsan (816702) | more than 2 years ago | (#38802259)

Right, but solving it in an hour or solving it in 30 seconds makes no difference. When the goal of the tournament is who can solve it fastest, it doesn't prove he is any better then the other competitors when the contest ends after the first person solves it

Re:Actually an extremely good point (4, Funny)

somersault (912633) | more than 2 years ago | (#38803381)

It does if he has a gun pointed to his head while getting a blow job.. man that was an awful film..

Re:Actually an extremely good point (1)

EdIII (1114411) | more than 2 years ago | (#38811261)

It may have been an awful film from a technical perspective... but that was one hell of an interview process.

Re:Actually an extremely good point (1)

thue (121682) | more than 2 years ago | (#38803841)

If the exploit works by the user viewing a web page, an exploit which requires the user to view the web page for 3 seconds is significantly more powerful than an exploit which requires the user to view the web page for an hour.

I know that the exploits are more proff of concept, and that the hour long exploit may (or may not) be capable of running faster. But time to exploit is still not totally irrellevant.

Re:Actually an extremely good point (3, Insightful)

mikael_j (106439) | more than 2 years ago | (#38802401)

It gets even more ridiculous when the Apple or Microsoft brand sudoku puzzle is the first one scheduled to be solved and everyone screams about how this is proof that those puzzles are easier to solve than the Mozilla or Google brand puzzles.

And yeah, this has happened in previous years, Safari scheduled to be attacked first so the media and anti-Apple people online scream about how Safari is the least secure browser because it was broken "first" (even though if you look at the event schedule this obviously happened because the demonstrations of the browsers were all scheduled at different times with it simply being the first target as opposed to all browsers being attacked simultaneously).

Re:Actually an extremely good point (4, Interesting)

mjwx (966435) | more than 2 years ago | (#38802465)

And yeah, this has happened in previous years, Safari scheduled to be attacked first so the media and anti-Apple people online scream about how Safari is the least secure browser because it was broken "first"

I dont suppose that you've considered that Safari gets broken first and fastest because there are a lot of undiscovered exploits, due largely to the fact that no-one targets safari as a browser due to low usage. Pwn2Own requires an entirely new exploit (otherwise I'm sure IE would be down in a number of nanoseconds)

BTW, Safari was not simply broken first, it was broken fastest, this is important as you pointed out the demonstrations took place at different times.

IE, Chrome and Firefox all have larger user bases, it stands to reason that they will have fewer undiscovered exploits then Safari because they are targeted more often.

Re:Actually an extremely good point (3, Insightful)

drsmithy (35869) | more than 2 years ago | (#38803597)

Shush, this is Slashdot. Marketshare and userbase are never factors.

Re:Actually an extremely good point (1)

Dinghy (2233934) | more than 2 years ago | (#38805513)

Pwn2Own requires an entirely new exploit (otherwise I'm sure IE would be down in a number of nanoseconds)

Actually that's one of the changes, they no longer require a zero day:

In a new twist, Pwn2Own 2012 will also be taking aim at known vulnerabilities. These are browser issues that were disclosed at some point in the past year, but do not yet have a public exploit. The researchers will need to actually exploit the given vulnerability in order to score additional points.

So if an vulnerability exists but has not been shown to be exploitable, if you can show that it is, you get points.

Re:Actually an extremely good point (1)

guruevi (827432) | more than 2 years ago | (#38805877)

Safari is still based on WebKit which also runs Chrome, Konqueror, Android and a host of other commercial and open source browsers.

Re:Actually an extremely good point (3, Interesting)

tlhIngan (30335) | more than 2 years ago | (#38806777)

I dont suppose that you've considered that Safari gets broken first and fastest because there are a lot of undiscovered exploits, due largely to the fact that no-one targets safari as a browser due to low usage. Pwn2Own requires an entirely new exploit (otherwise I'm sure IE would be down in a number of nanoseconds)
 

Possible, but given it's Pwn2Own, the machine you "pwned" is the machine you win.

And given in the past you had a choice of Macbook Pro (OS X), a Sony Vaio (Windows) and sometihng else (for Linux), and had the ability to choose what computer you wanted, what would you go for?

Most would go for the Macbook purely because it's a nice decent machine that happens to look and function great (and runs Windows and Linux). If I had a series of exploits that worked on all three platforms, I'd go after the Mac first just to win that over a Sony. Then I'd go for the Sony next (if it wasn't for the crapware, at least they're nice looking machines).

Once that was won, people concentrated on the next machine that was second on their list, etc. Smart contestants go after the computer no one is breaking in as they have a greater chance of winning a free computer.

And despite the /. crowd chanting "FUNCTION FIRST, not form", most people seem to consistently go for the Macs.

Given the machines are all around the same value, perhaps a fairer comparison would be if everyone of them was a Macbook Pro or so, running the OS of choice (after all, Windows and Linux run great on a Macbook Pro - I know Ubuntu has a EFI installer that boots natively).

Re:Actually an extremely good point (1)

_0xd0ad (1974778) | more than 2 years ago | (#38807617)

you had a choice of Macbook Pro (OS X), a Sony Vaio (Windows) and sometihng else (for Linux) ...
And despite the /. crowd chanting "FUNCTION FIRST, not form", most people seem to consistently go for the Macs.

And despite what most people seem to consistently do, last time I blew a tidy sum on a laptop, I bought a Sony Vaio.

As you said... nice machine, after the crapware was cleaned up a bit.

Re:Actually an extremely good point (0)

Anonymous Coward | more than 2 years ago | (#38809827)

Ofcource.. people want the macbook pro because its easiest to exploit.. err.. no..wait.. they want to exploit the macbook pro first because its hard to get.. err no wait.

Oops.. did I say that these security consultants who earn hundreds of thousands of dollars from their consulting are desperate for a laptop? Wait.. ofcource they are ! Thats why they're in this competition. They're hard up for cash ! They want a macbook !

Re:Actually an extremely good point (1)

RyuuzakiTetsuya (195424) | more than 2 years ago | (#38818079)

I'd go after the Mac first just to win that over a Sony.

Living the dream. Owning apple and sony products with out giving them a single dime!

Re:Actually an extremely good point (5, Interesting)

Anonymous Coward | more than 2 years ago | (#38802549)

Safari scheduled to be attacked first so the media and anti-Apple people online scream about how Safari is the least secure browser because it was broken "first"

The schedule is not relevant, the Mac was hacked in the shortest amount of time which is why we say it was hacked "first".

And what pissed all you fanboys off wasn't how fast it got hacked, but the statement by the hacker that he chose the Mac because "it was the easiest to compromise quickly".

If Apple would stop its misleading marketing campaign, and if Apple's users would stop with the constant "Derp derp my Mac is 100% immune to any and all malicious activity of any kind" then we wouldn't laugh at your ass all the time.

Re:Actually an extremely good point (1)

mikael_j (106439) | more than 2 years ago | (#38803159)

And what pissed all you fanboys off wasn't how fast it got hacked, but the statement by the hacker that he chose the Mac because "it was the easiest to compromise quickly".

Skip the ad hominems, will you?

And most complaints were about the media blowing this out of proportion while leaving details out (I've seen lots of pwn2own reports in the media where it was basically stated "the first browser to get hacked was Apple's Safari raising concerns that blablabla..." with no mention of the fact that this was not a "everyone goes in blind and attacks the browser of their choice for the first time simultaneously" situation) and the anti-fanboys hollering about how this proved that everything Apple had ever done was inferior to everything else ever made.

Re:Actually an extremely good point (0)

Anonymous Coward | more than 2 years ago | (#38803299)

Fanboys on both sides detract from the main point - there is no room for complacency in security. It doesn't matter if your browser and OS combination of choice are the most secure, security is still important. You should still take steps to ensure your security and the companies responsible should still be striving for added security. For that reason it's absolutely a good thing that traditionally what were seen as the most secure browsers got hacked and made the news. What good will it do with the new model where IE is flagged up as the worst browser? We all know that already, it will just encourage non-IE users to get complacent again.

Re:Actually an extremely good point (0)

Anonymous Coward | more than 2 years ago | (#38803295)

If Apple would stop its misleading marketing campaign

Citation?

Re:Actually an extremely good point (1)

Anonymous Coward | more than 2 years ago | (#38803443)

Just looking at the stories from last year, it does seem like the order played into it. One story about IE8's exploit last year says:

The only other browser to fall Wednesday was Apple's Safari 5, which dropped to a team from French security company Vupen minutes before Fewer took his shot at IE8.

And really, the "Apple Hacked First" headlines will always get more attention than "IE Hacked First", so it does make business sense to have that one scheduled first to ensure the most clickable story gets out.

Re:Actually an extremely good point (-1)

Anonymous Coward | more than 2 years ago | (#38804411)

Still waiting on that Mac Malware that causes Mac users to line up at Best Buy with the Windows users because their machines have been rendered unusable...

Re:Actually an extremely good point (0)

Anonymous Coward | more than 2 years ago | (#38809905)

Why would they go to best buy? Everytime I enter an apple store there are countless people bringing in their broken apple products at the "genius" bar because they are just as shitty as the rest.

OSX marketting has succeeded in telling people that the ability to run fewer games fewer apps and connecting to fewer devices should costs higher than the alternatives.

Its quite interesting actually. Ofcource not all people are that stupid... but it aligns well with general statistics. 10% of the population could be just that stupid.

Re:Actually an extremely good point (0)

Anonymous Coward | more than 2 years ago | (#38812727)

... it's called iTunes.

Re:Actually an extremely good point (1)

intheshelter (906917) | more than 2 years ago | (#38804955)

What Apple marketing campaign are you referring to exactly? I think you're making some grand statements, but I don't remember any marketing campaign saying they were invulnerable, unhackable, etc.

Re:Actually an extremely good point (0, Informative)

Anonymous Coward | more than 2 years ago | (#38802527)

The time is pretty irelevant. I mean it isn't like the hackers hadn't seen the OS's or browsers before they set foot on the floor and were going blind. That is like giving someone a sudoku puzzle a month in advance, having him do it from memory and claiming that this guy is so smart he can solve the sudoku puzzle in 30 seconds.

Actually everything is scripted, so all they have to do is launch the executable.

Still my bet is on Internet Explorer to lose again, badly.

Re:Actually an extremely good point (0)

Anonymous Coward | more than 2 years ago | (#38802701)

The time is pretty irelevant. I mean it isn't like the hackers hadn't seen the OS's or browsers before they set foot on the floor and were going blind. That is like giving someone a sudoku puzzle a month in advance, having him do it from memory and claiming that this guy is so smart he can solve the sudoku puzzle in 30 seconds.

Actually everything is scripted, so all they have to do is launch the executable.

Still my bet is on Internet Explorer to lose again, badly.

What do you mean by again? Safari has been hacked the quickest (not because scheduled first, but quickest, the last few years and if the time to hack are not of interest -- still the winner saying that Safari on OSX was the easiest platform to compromise should be of interest).

Re:Actually an extremely good point (1)

GordonBX (1059078) | more than 2 years ago | (#38802741)

And yet the prize for winning the contest ... a shiny new MacBook Air. Go figure.

Re:Actually an extremely good point (1)

Anonymous Coward | more than 2 years ago | (#38802851)

And yet the prize for winning the contest ... a shiny new MacBook Air. Go figure.

I love this argument. There was a 15k$ cash price to the winner in addition to the laptop. So you are claiming that the MacBook Air is so shiny that they would risk the 15k$ casch price by not going after the easiest target just to get it. RDF indeed.

Re:Actually an extremely good point (1)

FranktehReaver (2441748) | more than 2 years ago | (#38803863)

That and the MacBook line up has a higher retail cost and looks better on paper saying they won a more expensive laptop.

Re:Actually an extremely good point (1)

morgauxo (974071) | more than 2 years ago | (#38805853)

Hey I'll take one of those! Sounds like a good hardware platform to run Linux on to me!

Re:Actually an extremely good point (0)

Anonymous Coward | more than 2 years ago | (#38803371)

Decided to RTFA, it says, for Safari on a Mac:

Within five seconds of surfing to the rigged site, he successfully launched the calculator app and wrote a file on the disk without crashing the browser.

For Windows:

Using the target machine, he clicked on a link and immediately launched the calculator app (calc.exe).

Maybe we're just fuzzing hairs, but five seconds and immediately could be seen as the same length of time (immediately sounds faster, but it's just the word of the guy doing the report).

Re:Actually an extremely good point (1)

windcask (1795642) | more than 2 years ago | (#38803453)

Maybe the best way to do this sort of thing would be to use a nightly build, then. This might close some vulns, open others, and leave others still alone. You wouldn't know until you started.

Re:Actually an extremely good point (0)

Anonymous Coward | more than 2 years ago | (#38803707)

Seeing as how finding a vulnerability and a stable exploit which uses said vulnerability takes these teams upwards of two weeks, that'd be a fairly boring contest where nothing happens, no free advertising for CanSecWest plastered over the internet, etc. :)

Re:Actually an extremely good point (1)

RyuuzakiTetsuya (195424) | more than 2 years ago | (#38803493)

Well, not just that, but, past entries have done what, written a file to disk and executed something like the calculator?

Big hairy deal. I'm not concerned until we see a mac drive by that also escalates to root.

Re:Actually an extremely good point (2)

drsmithy (35869) | more than 2 years ago | (#38803609)

Big hairy deal. I'm not concerned until we see a mac drive by that also escalates to root.

Nothing on my computer I care about, needs root privileges to access.

Re:Actually an extremely good point (1)

morgauxo (974071) | more than 2 years ago | (#38805921)

That's still a pretty big deal. If you can get that far you can probably compromise an individual user's data. Even if not you could probably at least start a browser pointed to some shock site. That could be a pretty big deal on a workplace or school computer.

Re:Actually an extremely good point (0)

Anonymous Coward | more than 2 years ago | (#38809717)

time is very relevant
it's the difference between a stranger sitting around you for an extended period of time versus someone simply walking past you

and so what if they had seen the OS and browsers beforehand
guess what? it's what most people actually use

Also helps with vulnerability hoarding (5, Informative)

slimjim8094 (941042) | more than 2 years ago | (#38802201)

I heard that it's been the case before that discovered vulnerabilities would be kept secret so that they could be used across multiple years. This changes the incentive to reward whoever's found the most, which is what the point was all along - exposing as many vulnerabilities as possible.

Re:Also helps with vulnerability hoarding (3, Interesting)

robbak (775424) | more than 2 years ago | (#38802353)

As well, all contestants should reveal all techniques they intend to use a part of their application. All these reports would be provided to the vendors after the competition.

Re:Also helps with vulnerability hoarding (0)

Anonymous Coward | more than 2 years ago | (#38803125)

I don't think you've thought that through.

You want to build a list of competition winning techniques well in advance of the event that concerns quite a large group of very skilled hackers.

Re:Also helps with vulnerability hoarding (1)

Krneki (1192201) | more than 2 years ago | (#38804907)

As well, all contestants should reveal all techniques they intend to use a part of their application. All these reports would be provided to the vendors after the competition.

No-go, this exploits are worth a shit load of money on the black market. Unless you are willing to pay for the discovery all you will achieve is to push this people back in the underground and while you don't know how they work, at least you know they are out there.

My plan (2, Funny)

Anonymous Coward | more than 2 years ago | (#38802235)

1. Hack the browser once using a single vulnerability.
2. Install lots of new vulnerabilities on the compromised machine.
3. Win the contest by exploiting each of those vulnerabilities.
4. PROFIT!!!

Sensationalist headlines (1)

Idbar (1034346) | more than 2 years ago | (#38804359)

This its great, so now slashdot won't have sensationalist headlines saying they hacked a browser in X seconds! They will have headlines saying a browser was hacked N times! There will be no sensationalism for sure!

Keep the faith! (0)

Anonymous Coward | more than 2 years ago | (#38802737)

Man, remember Aaron Portnoy? That guy complained a lot!

Reinstate Linux (-1)

Anonymous Coward | more than 2 years ago | (#38803115)

Its sad that they nowadays refuse Linux as a platform for browser testing. I can agree its pretty boring to have one platform that wont be broken so easily, but its a good benchmark against Windows and its abundance of security issues.

Linux refused for browser testing? (1)

microphage (2429016) | more than 2 years ago | (#38803539)

"Its sad that they nowadays refuse Linux as a platform for browser testing. I can agree its pretty boring to have one platform that wont be broken so easily, but its a good benchmark against Windows and its abundance of security issues".

Where does it say you can't use Linux for browser testing?

The only targets are OS X Lion or Windows 7 (3, Interesting)

Sits (117492) | more than 2 years ago | (#38804111)

Where does it say you can't use Linux for browser testing?

From the rules page [zerodayinitiative.com] :

The targets will be running on the latest, fully patched version of either Windows 7 or Lion.

Back in 2008, Linux was a available as a target in Pwn2Own [engadget.com] but in an interview Aaron Portnoy of TippingPoint explained that Linux is now not included in Pwn2Own to avoid controversy [internetnews.com] .

No longer Linux (1)

devent (1627873) | more than 2 years ago | (#38804653)

Since they no longer do it with Linux, who cares. Could it be that 2008 Firefox on Ubuntu was un-hacked? It's not good advertisement if a open source system can't be hacked, while the two commercial systems are hacked in seconds?

Re:No longer Linux (2)

Krneki (1192201) | more than 2 years ago | (#38805037)

Since they no longer do it with Linux, who cares. Could it be that 2008 Firefox on Ubuntu was un-hacked? It's not good advertisement if a open source system can't be hacked, while the two commercial systems are hacked in seconds?

Last year neither firefox nor Chrome on Windows OS were hacked.

Re:No longer Linux (1)

ledow (319597) | more than 2 years ago | (#38805115)

Mmm, that's odd, I have to agree.

Especially given that both HP and Google are funding it, one of which probably has an interest in a non-open OS being trounced by an open one, and the other of which supports both types of OS on its hardware (and isn't really "competing" or "allied" with Apple in those terms either).

Weird.

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?