Record Payouts At Hacking Contests
Written by Andrew Johnson   
Monday, 17 March 2014

Hewlett-Packard paid out a total of $850K for security exploits during its two-day Pwn2Own event held at CanSecWest 2014. A further $150K was awarded by Google in its Pwniumn 4 competition that took place on the first day.

Although nobody attempted HP's Grand Prize, dubbed the Unicorn, which was to exploit Internet Explorer 11 running on a 64-bit Windows 8.1 operating system, with the Enhanced Mitigation Experience Toolkit (EMET) running, Pwn2Own contestants compromised IE twice.

On Day One (March 12) by French security research firm VUPEN which employed  use-after-free causing object confusion in the broker, resulting in sandbox bypass; and on Day 2 (March 13) by by Sebastian Apelt and Andreas Schmidt with two use-after-free bugs and a kernel bug.

VUPEN emerged as the dominant player for the fourth year running, also taking down Adobe Flash, Adobe Reader and Mozilla Firefox on Day One, netting a total of $300K. VUPEN withdrew two of its exploits attempts - against Java on Day One and Apple Safari on Day Two. It did however hack Google Chrome on Day Two, for a further $100K, with a use-after-free affecting both Blink and WebKit along with a sandbox bypass, resulting in code execution.

Firefox was the most exploited browser in this year's competition with a total of four exploits all using different techniques, including a use-after-free, a privilege escalation, and an out-of-bounds read and write. Asked why Firefox had attracted such attention Sid Stamm, senior engineering manager of security and privacy at Mozilla told eWeek:

"Pwn2Own offers very large financial incentives to researchers to expose vulnerabilities, and that may have contributed in part to the researchers' decision to wait until now to share their work and help protect Firefox users"

In fact Firefox exploits earned less than any of the others but at $50K the reward far exceeds the $3K offered by Mozilla in its bug bounty program.

Google had put $2.7 Million On Offer For Pwnium 4 for finding serious holes in Chrome OS but in the event awarded just one top prize of $150,000 plus a HP Chromebook 11, although it is considering partial credit for a second researcher.

As a prelude to the contest, security teams from Google and HP's ZDI (zero Day Initiative) went head to head in Pwn4Fun with each team claiming a victory in exploiting recently discovered flaws in Safari and IE. The prizes ($82,500 in total) were donated to the Canadian Red Cross.

Banner


What Does The NSA Think Of Cryptographers?
22/11/2014

A recently declassified NSA house magazine, CryptoLog, reveals some interesting attitudes between the redactions. What is the NSA take on cryptography?



President Obama Experiences An Hour of Code
10/12/2014

In a event to mark the beginning of this year's Computer Science Education Week, President Obama produced his first ever line of code, with help from a middle-school pupil.


More News

Last Updated ( Monday, 17 March 2014 )
 
 

   
RSS feed of news items only
I Programmer News
Copyright © 2014 i-programmer.info. All Rights Reserved.
Joomla! is Free Software released under the GNU/GPL License.