Slashdot Log In
All Five Smartphones Survive Pwn2Own Contest
Posted by
Soulskill
on Wed Mar 25, 2009 09:41 AM
from the can't-hit-a-mobile-target dept.
from the can't-hit-a-mobile-target dept.
CWmike writes "Although three of the four browsers that were targets in the PWN2OWN hacking contest quickly fell to a pair of researchers, none of the smartphones were successfully exploited. TippingPoint had offered $10,000 for each exploit on any of the phones, which included the iPhone and the BlackBerry, as well as phones running the Windows Mobile, Symbian and Android operating systems. 'With the mobile devices so limited on memory and processing power, a lot of [researchers'] main exploit techniques are not able to work,' said TippingPoint's Terri Forslof. 'Take, for example, [Charlie] Miller's Safari exploit,' referring to Miller's 10-second hack of a MacBook via an unpatched Safari vulnerability that he'd known about for more than a year. 'People wondered why wouldn't it work on the iPhone, why didn't he go for the $10,000?' she said. 'The vulnerability is absolutely there, but it's a lot tougher to exploit on the iPhone.'"
Chrome was the only browser at the contest that was not successfully exploited. We previously discussed day one of the contest, and a summary of day two is available as well.
Related Stories
[+]
IT: Next Pwn2Own Contest Targets IE8, Firefox, iPhone 64 comments
Windows Secrets writes "After two straight years of taking dead aim at Macbooks and Windows-powered machines, hackers at this year's CanSecWest conference will have shiny new targets: Web browsers and mobile phones. According to CanSecWest organisers, there will be two separate Pwn2Own competitions this year — one pitting hackers against IE8, Firefox 3 and Safari and another targeting Google Android, Apple iPhone, Nokia Symbian and Windows Mobile."
[+]
IT: First Pwn2Own 2009 Contest Winners Emerge 98 comments
mellowdonkey writes "Last year's CanSecWest hacking contest winner, Charlie Miller, does it again this year in the 2009 Pwn2Own contest. Charlie was the first to compromise Safari this year to win a brand spankin new Macbook. Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well. Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
All 5, eh? (Score:3, Insightful)
Re: (Score:3, Informative)
Exactly what I was thinking. I went to the article to see what the 5 were and didn't really glean much more information out of it than what was in the summary.
I had no trouble identifying the five that were tested:
iphone, blackberry, windows, symbian, android.
Not any tougher on iPhone according TFA (Score:5, Informative)
"should work on the iPhone but the bug couldn't (be) used twice in the competition."
So the iPhone should be quite vulnerable, but wasn't compromised because it wouldn't have been eligible for the award since it was the same exploit used against OS X in the first day.
Re:Not any tougher on iPhone according TFA (Score:5, Informative)
Parent
A Symbian with a browser? (Score:5, Funny)
Chrome only browser ... (Score:5, Interesting)
Chrome was the only browser in the contest that was not successfully exploited... why didn't they include Opera, or any of the non-webkit open source browsers other than Firefox? (Ok, they may be fairly obscure, but surely Opera is well known enough, right?)
Re:Chrome only browser ... (Score:5, Funny)
They didn't want to give Opera any more ammunition against the other browsers.
Parent
Re:Chrome only browser ... (Score:5, Insightful)
as someone who recently gave Opera another go, i can see why.
i would appear that i've been missing out
Parent
Re: (Score:2, Funny)
Re: (Score:3, Insightful)
I switched to Opera when FF was in version 2, because Opera was considerably faster in most cases. Now that FF is up to speed with Opera, I'm still with it because I'm more familiar with it...and it feels more 'complete' out of the box to me...no need for extensions. For someone who uses it regularly on four different machines (and irregularly on several more), that's important.
Sure, it's not open source, but I'm concerned about free beer more than free speech (not to say that it's unimportant, I just hav
Re: (Score:3, Insightful)
Re:Chrome only browser ... (Score:4, Insightful)
For the same reason high school sports teams don't play NFL teams; it just would be disheartening to the players.
My guess is that Opera never really got the attention because it never had a big company pushing it (MS, Apple, Google, and Firefox had the whole Mozilla/FOSS thing).
Parent
Hmm (Score:5, Funny)
Miller's 10-second hack of a MacBook via an unpatched Safari vulnerability that he'd known about for more than a year.
Definitely a black hat then, as I'm assuming if he'd reported the vulnerability when he'd found it even Apple would have patched it by now.
Re:Hmm (Score:5, Interesting)
Did you consider reporting the vulnerability to Apple?
I never give up free bugs. I have a new campaign. It's called NO MORE FREE BUGS. Vulnerabilities have a market value so it makes no sense to work hard to find a bug, write an exploit and then give it away. Apple pays people to do the same job so we know there's value to this work. No more free bugs.
Parent
Re:Hmm (Score:5, Interesting)
No, it's because he's not going to do free work for Apple.
That's precisely the attitude of a black hat. A responsible hacker notifies the vendor or author of the issue, giving them a reasonable amount of time to release a fix. If the fix is forthcoming in a timely manner, the hacker should be thanked in the release notes and is then free to post a description of the issue along with a proof of concept exploit if they like. If a fix is not forthcoming in a timely manner, and no reasonable explanation given by the vendor or author, then the hacker releases the description in the knowledge that they've adhered to the widely acknowledged good practice. This is responsible full disclosure.
A black hat doesn't notify the vendor in order to gain some kind of material benefit - be it selling the exploit or using it directly for personal gain. Funnily enough personal gain is what this guy did it for, making him a scumbag black hat hacker.
Parent
Re: (Score:3, Insightful)
You talked earlier about the value of vulnerabilities. Was it a surprise that he (Nils) basically gave up three "high-value" bugs for $5,000 each?
It's clear he's incredibly talented. I was shocked when I saw someone sign up to go after IE 8. You can get paid a lot more than $5,000 for one of those bugs. I've talked to a lot of smart, knowledgeable people and no one knows exactly how he did it. He could easily get $50,000 for that vulnerability. I'd say $50,000 is a low-end price point.
For the amount of time he spent to do what he did on IE and Firefox, he could have found and exploited five or 10 Safari bugs. With the way they're paying $5,000 for every verifiable bug, he could have spent that same time and resources and make $25,000 or $30,000 easily just by going after Safari on Mac.
You are under obligation to inform the vendor (Score:3, Insightful)
The static point is that if you find an exploit, you are under no obligation to inform the vendor. You are not evil if you do not inform the vendor.
I couldn't disagree more. If I walk by a house and see that the door is standing wide open, and then I see the owner on the street a couple minutes later, the ethics are clear. I should tell the guy he left his door open. I'm under no legal obligation but I should because it is the right thing to do. If he gets robbed later I should feel bad because I could have helped prevent it.
Well maybe you say, no, they're a business. Doesn't matter. If I'm in a jewelry store and see that a clerk forgot to put away a d
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Why Safari? Why didn't you go after IE or Safari?
It's really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don't do. Hacking into Macs is so much easier. You don't have to jump through hoops and deal with all the anti-exploit mitigations you'd find in Windows.
It's more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesn't have anti-exploit stuff built into it.
With my Safari exploit, I put the code into a process and I know exactly where it's going to be. There's no randomization. I know when I jump there, the code is there and I can execute it there. On Windows, the code might show up but I don't know where it is. Even if I get to the code, it's not executable. Those are two hurdles that Macs don't have.
It's clear that all three browsers (Safari, IE and Firefox) have bugs. Code execution holes everywhere. But that's only half the equation. The other half is exploiting it. There's almost no hurdle to jump through on Mac OS X.
Looks like all that supposed security you hear about in Mac OS X is really just a huge joke.
Re:Hmm (Score:4, Funny)
Looks like all that supposed security you hear about in Mac OS X is really just a huge joke.
A lot of it is, yes. And, some of that supposed security in Windows Vista... really is improved security, not a joke.
From the average user's perspective, Macs are more secure right now, because they're not targeted. I don't run any antivirus software on my Mac, because I'm confident that I won't encounter a Mac virus. In general, the people writing viruses don't know how to write for Macs, and the people writing for Macs don't want to write viruses. There used to be a handful of Mac viruses back in the 90s, but those have all gone away. Every once in awhile we hear about a new proof of concept, but nothing ever really comes of it.
But there's nothing inherent about the way Mac OS X works that guarantees this situation to remain true. As Macs gain marketshare, they'll gain mindshare among malware authors. As buying a Mac becomes a more attractive option to regular people, it will become a more attractive option to malware authors, and once they have a Mac to play with, they'll start writing malware for it.
Meanwhile, everybody says Vista is a joke; they'll upgrade when you pry XP from their cold dead fingers. People who have never even tried Vista bitch about "Cancel / Allow" dialogs. They say Microsoft completely dropped the ball by breaking compatibility with older software. While I'll be the first to agree that UAC's UI leaves much to be desired, I do leave it turned on*, and I generally know when to expect a prompt. For the thing in the system tray that needs Administrator privileges, I went to the trouble of working around UAC by adding it as a scheduled task that runs on login - this is far too complicated for normal users, and obviously either the software that needs this needs to be updated, or UAC needs an "always allow" option.
Microsoft broke compatibility because they had to in order to improve security. Every once in awhile an argument breaks out on Slashdot that goes something like this:
1) Windows sucks, because normal user accounts have Administrator privileges, which is just like running as root on Linux, which nobody ever does.
2) That's because if you don't have Administrator privileges, half your applications won't run.
3) Windows sucks, because Linux apps run just fine without needing root privileges.
4) It's not Microsoft's fault, it's the application developers' fault for designing their app with the expectation that it will always have Administrator privileges.
5) It is Microsoft's fault, because those app devs designed their app to work on Win98, which had no concept of per-user security, so apps could reliably expect to have unfettered write access to C:\Program Files. Microsoft shouldn't have allowed this.
6) Macs are awesome!
7) It's the year of Linux on the desktop!
8) Shut up, both of you.
Microsoft knew the status quo was broken, and that brokenness isn't sustainable. Their only long-term choice was to break compatibility by forcing applications to conform to new security standards. They've done that, and everyone bitched, but the apps have been fixed. Nobody realizes the apps have been fixed, because everybody switched back to (or stayed with) XP, but Windows 7 will be hugely popular (Microsoft is also fixing some of the real problems with Vista).
Parent
Grammar Nazi alert (Score:3, Funny)
"none....was..." puhleeze!
Final Score (From DVLabs blog) (Score:5, Informative)
Browsers
Chrome: 0***
IE8: 1**
Firefox: 1(1)*
Safari: 2(1)*
Mobile Browsers
Android: 0
iPhone: 0
Nokia/Symbian: 0
Windows Mobile: 0
Blackberry: 0****
*Numbers in parenthesis indicate Successful exploits that fell outside the contest criteria and therefore could not be rewarded.
**Exploit Confirmed by MS
***Chrome was impacted by one of the flaws, although exploit was not possible using any current known techniques.
****The Blackberry was attempted and resulted in "Something Interesting", but not an exploit.
Re:Apple security (Score:4, Funny)
[citation needed]
Parent
Re:Phones (Score:4, Informative)
A quick Google Pulled up the Phones as:
Phones (and associated test platform)
* Blackberry(TBA)
* Android(Dev G1)
* iPhone(locked 2.0)
* Nokia/Symbian(N95-1)
* Windows Mobile (HTC Touch)
The Blackberry was apparently a "Bold", at least, that's what one of the related blog posts refers to.
Parent
Re:DIE HACKER DIE (Score:4, Funny)
DIE HACKER DIE
Your German is unintelligible to me.
Parent