5 ms·

Pwn2own day one: Safari, IE8 fall, Chrome unchallenged

51 points by sigzero 16y ago

twodayslate 16y ago
Sound like Google is making their challenge harder than everyone else. That just isn't fair.
- elliottcarlson 16y ago
  Is that the case? My understanding was that they were offering an additional bounty however the rules to claim that was a bit more strict than the standard pwn2own rules. I could be mistaken though...
  - billybob 16y ago
    Not sure if the rules were stricter, but Chrome's increased bounty from Google was the main thing I wanted to hear about in this contest. It's a nice PR move if Chrome isn't hacked successfully, and probably a nice recruitment move if it is.
adsr 16y ago
Kind of odd, since the Safari vulnerability was in WebKit.
- Xuzz 16y ago
  Chrome has superior sandboxing of the rendering engine than Safari, so even if you could crash Chrome with the bug, actually doing something "useful" would be significantly more difficult.
  - adsr 16y ago
    Theoretically that may be, but this time Chrome won only because the contestant didn't show up. "The third browser to be tested was scheduled to be Chrome. However, the contestant registered to attempt the attack did not show up, so the browser remains unbeaten."
    - jamesaguilar 16y ago
      I wonder if there is a reason he didn't show up. For example, perhaps he was incapable of demonstrating any exploit. It's not as simple as "it would have been compromised if the contestant showed up."
      - adsr 16y ago
        Of course it's not that simple! I did not mean to imply that. By the same token as it's not as simple as, he/she wasn't able to produce an exploit.
    - trotsky 16y ago
      No one competes if no one has a working sploit. You have to sign up months in advance.
      - adsr 16y ago
        Yes, but the contest really test the ability of a hacker more than the weakness of a browser. It's hardly scientific.
keyle 16y ago
Well I just found out that Google Chrome 10.0 is out. Thanks for that.
- Devilboy 16y ago
  Chrome now beats every other major browser in the version number department.
  - nkassis 16y ago
    There not really version but iteration cycles.
    - nkassis 16y ago
      "They are" had to correct that.
  - lean 16y ago
    trivial, but Opera's at 11
    - silversmith 16y ago
      Emphasis on major :)
    - Herald_MJ 16y ago
      Chromium's at 11 too ;-)
jedsmith 16y ago
> This is because, in a change to historic competition rules, the system configuration was frozen last week, so the last-minute fix hasn't prevented exploitation. then later > One possible reason for this is that Google published a Chrome update yesterday, closing at least 24 security flaws. The would-be Chrome attacker may have been depending on one of these flaws to attack the browser. I thought the configuration was frozen last week. Was that only for Apple? On first read, this seems like a faulty conclusion based on the earlier statement.
- elliottcarlson 16y ago
  It sounds like the system configuration being frozen doesn't change the browser updates that might occur last second.
- trotsky 16y ago
  You're right about the inconsistency, it seems an older version of chrome would be the target. I think this rule was unannounced though, or maybe even made up in the last 24 hours as google and apple pushed updates. So understandable I think, or at least I made the same mistake :/
- blinkingled 16y ago
  AFAIK the contest requires you to exploit an previously unknown vulnerability. (Contest rules link is down on cansecwest site.) Which means even though Apple patched the 60 vulnerabilities the researcher used a one that was not known and thus not patched.
JonnieCache 16y ago
...Address Space Layout Randomization (ASLR) are well-known Note that unless things have changed (something which I can find no evidence for,) snow leopard still lags behind windows and linux in its ASLR, in that it doesnt randomise all the key parts of the kernel. Hopefully this will be fixed in lion. http://www.theregister.co.uk/2009/08/29/snow_leopard_security/ http://www.theregister.co.uk/2009/08/29/snow_leopard_securit... https://secure.wikimedia.org/wikipedia/en/wiki/Address_space_layout_randomization#Mac_OS_X https://secure.wikimedia.org/wikipedia/en/wiki/Address_space... EDIT: although apparently, as ever, the community comes to the rescue. Stefan Esser presents steps to randomise dyld's address space yourself: http://antid0te.com/antid0te-for-snow-leopard-rebasing-dyld.html http://antid0te.com/antid0te-for-snow-leopard-rebasing-dyld....
alperakgun 16y ago
it is sad to see apple mac/osx fail now for the 5th year in pwn2own; that means apple doesnt take their task seriously,as much as they take ux polishing and leak-hyping. that explains why on mac os/x safari usage lags behind others; given a competitive environment apple products can't compete.
- sigzero 16y ago
  Well...the last Safari update patched 50 things. So, I am hoping that some light is shining into the Apple security brain.

51 points by sigzero 16y ago

twodayslate 16y ago

Sound like Google is making their challenge harder than everyone else. That just isn't fair.

elliottcarlson 16y ago
Is that the case? My understanding was that they were offering an additional bounty however the rules to claim that was a bit more strict than the standard pwn2own rules. I could be mistaken though...
- billybob 16y ago
  Not sure if the rules were stricter, but Chrome's increased bounty from Google was the main thing I wanted to hear about in this contest. It's a nice PR move if Chrome isn't hacked successfully, and probably a nice recruitment move if it is.

adsr 16y ago

Kind of odd, since the Safari vulnerability was in WebKit.

Xuzz 16y ago
Chrome has superior sandboxing of the rendering engine than Safari, so even if you could crash Chrome with the bug, actually doing something "useful" would be significantly more difficult.
- adsr 16y ago
  Theoretically that may be, but this time Chrome won only because the contestant didn't show up. "The third browser to be tested was scheduled to be Chrome. However, the contestant registered to attempt the attack did not show up, so the browser remains unbeaten."
  - jamesaguilar 16y ago
    I wonder if there is a reason he didn't show up. For example, perhaps he was incapable of demonstrating any exploit. It's not as simple as "it would have been compromised if the contestant showed up."
    - adsr 16y ago
      Of course it's not that simple! I did not mean to imply that. By the same token as it's not as simple as, he/she wasn't able to produce an exploit.
  - trotsky 16y ago
    No one competes if no one has a working sploit. You have to sign up months in advance.
    - adsr 16y ago
      Yes, but the contest really test the ability of a hacker more than the weakness of a browser. It's hardly scientific.

keyle 16y ago

Well I just found out that Google Chrome 10.0 is out. Thanks for that.

Devilboy 16y ago
Chrome now beats every other major browser in the version number department.
- nkassis 16y ago
  There not really version but iteration cycles.
  - nkassis 16y ago
    "They are" had to correct that.
- lean 16y ago
  trivial, but Opera's at 11
  - silversmith 16y ago
    Emphasis on major :)
  - Herald_MJ 16y ago
    Chromium's at 11 too ;-)

jedsmith 16y ago

> This is because, in a change to historic competition rules, the system configuration was frozen last week, so the last-minute fix hasn't prevented exploitation. then later > One possible reason for this is that Google published a Chrome update yesterday, closing at least 24 security flaws. The would-be Chrome attacker may have been depending on one of these flaws to attack the browser. I thought the configuration was frozen last week. Was that only for Apple? On first read, this seems like a faulty conclusion based on the earlier statement.

elliottcarlson 16y ago
It sounds like the system configuration being frozen doesn't change the browser updates that might occur last second.
trotsky 16y ago
You're right about the inconsistency, it seems an older version of chrome would be the target. I think this rule was unannounced though, or maybe even made up in the last 24 hours as google and apple pushed updates. So understandable I think, or at least I made the same mistake :/
blinkingled 16y ago
AFAIK the contest requires you to exploit an previously unknown vulnerability. (Contest rules link is down on cansecwest site.) Which means even though Apple patched the 60 vulnerabilities the researcher used a one that was not known and thus not patched.

JonnieCache 16y ago

...Address Space Layout Randomization (ASLR) are well-known Note that unless things have changed (something which I can find no evidence for,) snow leopard still lags behind windows and linux in its ASLR, in that it doesnt randomise all the key parts of the kernel. Hopefully this will be fixed in lion. http://www.theregister.co.uk/2009/08/29/snow_leopard_security/ http://www.theregister.co.uk/2009/08/29/snow_leopard_securit... https://secure.wikimedia.org/wikipedia/en/wiki/Address_space_layout_randomization#Mac_OS_X https://secure.wikimedia.org/wikipedia/en/wiki/Address_space... EDIT: although apparently, as ever, the community comes to the rescue. Stefan Esser presents steps to randomise dyld's address space yourself: http://antid0te.com/antid0te-for-snow-leopard-rebasing-dyld.html http://antid0te.com/antid0te-for-snow-leopard-rebasing-dyld....

alperakgun 16y ago

it is sad to see apple mac/osx fail now for the 5th year in pwn2own; that means apple doesnt take their task seriously,as much as they take ux polishing and leak-hyping. that explains why on mac os/x safari usage lags behind others; given a competitive environment apple products can't compete.

sigzero 16y ago
Well...the last Safari update patched 50 things. So, I am hoping that some light is shining into the Apple security brain.