Pwn2Own

jbcohen · 09-11-2014, 01:42 PM

Is a computer security contesst that happens once each year on the fall where hackers get a chance to hack into any of the provided devices, if they can hack into it they can keep the device. I have seen the results from prior years at http://en.wikipedia.org/wiki/Pwn2Own and I have seen some interesting results.

First I note that apple appears in the list of hacked devices in 2011 and 2014 indicating that apple is vunerable however not as much as other devices are. Although ios has not been hacked for the last three years and it was not the OS that got hacked last year it was Safari that got hacked.

Second, I have noted that windows has not been hacked, its always been through the software that runs on windows that it has been hacked.

Third, all of the major web browsers except one has been hacked including IE, Chrome, Firefox and Safari. Only Opera remains in the clear.

Lastly, with the exclusion of apple, there are no tablets on the list or ereaders.

This list has given me a lot of food for thought

Glorfindel · 09-12-2014, 12:18 PM

Opera! +1

Glorfindel · 09-12-2014, 12:33 PM

FYI some of your info is incorrect.
Opera was not in the competition
The Windows kernal was hacked.

eschwartz · 09-12-2014, 02:39 PM

Opera is security through obscurity. Bad idea.

Internet Explorer was being constantly hacked throughout the competitions. IE is a core Windows OS component. So yes, Windows itself was hacked.
Besides for which, how do you think they were supposed to get the code to the device in question, if not though the browsers? The browsers which loaded plugins from both user-installed software and OS software like .NET, Silverlight, and QuickTime.

I do note that the second year, a Ubuntu Linux 7.10 laptop was part of the competition. In linux's one and only appearance, it did not get exploited. Draw your own conclusions.

eschwartz · 09-12-2014, 02:41 PM

https://en.wikipedia.org/wiki/Pwn2Own#Contest_2013

Quote:

Nils and Jon from MWRLabs were successful at exploiting Google Chrome using WebKit and Windows kernel flaws to bypass Chrome sandbox and won $100,000.

pholy · 09-24-2014, 01:01 AM

yeah, I think I'd rather have the $100,000.00 than the Windows Kernel...

09-11-2014, 01:42 PM	#1
jbcohen Wizard Posts: 3,025 Karma: 11196738 Join Date: Oct 2010 Location: Piper College Device: Samsung A21	Pwn2Own Is a computer security contesst that happens once each year on the fall where hackers get a chance to hack into any of the provided devices, if they can hack into it they can keep the device. I have seen the results from prior years at http://en.wikipedia.org/wiki/Pwn2Own and I have seen some interesting results. First I note that apple appears in the list of hacked devices in 2011 and 2014 indicating that apple is vunerable however not as much as other devices are. Although ios has not been hacked for the last three years and it was not the OS that got hacked last year it was Safari that got hacked. Second, I have noted that windows has not been hacked, its always been through the software that runs on windows that it has been hacked. Third, all of the major web browsers except one has been hacked including IE, Chrome, Firefox and Safari. Only Opera remains in the clear. Lastly, with the exclusion of apple, there are no tablets on the list or ereaders. This list has given me a lot of food for thought

09-12-2014, 12:18 PM	#2
Glorfindel Force-Aware Elf Posts: 4,757 Karma: 11557898 Join Date: Feb 2014 Location: Valinor Device: Kindle 4 w/SO	Opera! +1

09-12-2014, 12:33 PM	#3
Glorfindel Force-Aware Elf Posts: 4,757 Karma: 11557898 Join Date: Feb 2014 Location: Valinor Device: Kindle 4 w/SO	FYI some of your info is incorrect. Opera was not in the competition The Windows kernal was hacked.

09-12-2014, 02:39 PM	#4
eschwartz Ex-Helpdesk Junkie Posts: 19,422 Karma: 85397180 Join Date: Nov 2012 Location: The Beaten Path, USA, Roundworld, This Side of Infinity Device: Kindle Touch fw5.3.7 (Wifi only)	Opera is security through obscurity. Bad idea. Internet Explorer was being constantly hacked throughout the competitions. IE is a core Windows OS component. So yes, Windows itself was hacked. Besides for which, how do you think they were supposed to get the code to the device in question, if not though the browsers? The browsers which loaded plugins from both user-installed software and OS software like .NET, Silverlight, and QuickTime. I do note that the second year, a Ubuntu Linux 7.10 laptop was part of the competition. In linux's one and only appearance, it did not get exploited. Draw your own conclusions.

09-24-2014, 01:01 AM	#6
pholy Booklegger Posts: 1,801 Karma: 7999816 Join Date: Jun 2009 Location: Toronto, Ontario, Canada Device: BeBook(1 & 2010), PEZ, PRS-505, Kobo BT, PRS-T1, Playbook, Kobo Touch	yeah, I think I'd rather have the $100,000.00 than the Windows Kernel...