Record Payouts At Hacking Contests
Written by Andrew Johnson   
Monday, 17 March 2014

Hewlett-Packard paid out a total of $850K for security exploits during its two-day Pwn2Own event held at CanSecWest 2014. A further $150K was awarded by Google in its Pwniumn 4 competition that took place on the first day.

Although nobody attempted HP's Grand Prize, dubbed the Unicorn, which was to exploit Internet Explorer 11 running on a 64-bit Windows 8.1 operating system, with the Enhanced Mitigation Experience Toolkit (EMET) running, Pwn2Own contestants compromised IE twice.

On Day One (March 12) by French security research firm VUPEN which employed  use-after-free causing object confusion in the broker, resulting in sandbox bypass; and on Day 2 (March 13) by by Sebastian Apelt and Andreas Schmidt with two use-after-free bugs and a kernel bug.

VUPEN emerged as the dominant player for the fourth year running, also taking down Adobe Flash, Adobe Reader and Mozilla Firefox on Day One, netting a total of $300K. VUPEN withdrew two of its exploits attempts - against Java on Day One and Apple Safari on Day Two. It did however hack Google Chrome on Day Two, for a further $100K, with a use-after-free affecting both Blink and WebKit along with a sandbox bypass, resulting in code execution.

Firefox was the most exploited browser in this year's competition with a total of four exploits all using different techniques, including a use-after-free, a privilege escalation, and an out-of-bounds read and write. Asked why Firefox had attracted such attention Sid Stamm, senior engineering manager of security and privacy at Mozilla told eWeek:

"Pwn2Own offers very large financial incentives to researchers to expose vulnerabilities, and that may have contributed in part to the researchers' decision to wait until now to share their work and help protect Firefox users"

In fact Firefox exploits earned less than any of the others but at $50K the reward far exceeds the $3K offered by Mozilla in its bug bounty program.

Google had put $2.7 Million On Offer For Pwnium 4 for finding serious holes in Chrome OS but in the event awarded just one top prize of $150,000 plus a HP Chromebook 11, although it is considering partial credit for a second researcher.

As a prelude to the contest, security teams from Google and HP's ZDI (zero Day Initiative) went head to head in Pwn4Fun with each team claiming a victory in exploiting recently discovered flaws in Safari and IE. The prizes ($82,500 in total) were donated to the Canadian Red Cross.

Banner


Progress On JavaScript SIMD
31/10/2014

While most of the hot news in fast computation centers around the GPU, there are untapped possibilities in most CPUs. JavaScript is currently getting a new set of commands that give it hardware-assist [ ... ]



Firefox Marks 10th Anniversary
10/11/2014

On November 9, 2004 Mozilla released Firefox 1.0. It is celebrating its first decade with the release of Firefox 33.1, billed as a browser for developers.


More News

Last Updated ( Monday, 17 March 2014 )
 
 

   
RSS feed of news items only
I Programmer News
Copyright © 2014 i-programmer.info. All Rights Reserved.
Joomla! is Free Software released under the GNU/GPL License.