4 ms·
All browsers were compromised last Wednesday (except Safari on ML) http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/ http://www.zdnet.com/pwn2o
by free652 14y ago
All browsers were compromised last Wednesday (except Safari on ML)
http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/ http://www.zdnet.com/pwn2own-down-go-all-the-browsers-700001...
- fjarlq 14y agoSafari wasn't. Also, nobody compromised Safari at Pwn2own last year.
- deleted 14y ago[deleted]
- officialjunk 14y agoprobably bc they are saving those safari bug bounty's for iOS: https://twitter.com/i0n1c/status/309585202810867712 https://twitter.com/i0n1c/status/309585202810867712 i highly doubt it was because no one could pwn safari.
- fjarlq 14y agoInteresting perspective. Charlie Miller teased about it and a conversation involving i0n1c ensued: https://twitter.com/0xcharlie/status/310018569058525184 https://twitter.com/0xcharlie/status/310018569058525184
- eksith 14y agoThis may be the cynic in me, but I feel that's because exploits fetch quite a sum in the black market these days.
- Someone 14y agoIf so, why would somebody spend months working on a IE10 exploit (http://threatpost.com/en_us/blogs/pwn2own-browser-exploits-getting-harder-more-expensive-find-030613 http://threatpost.com/en_us/blogs/pwn2own-browser-exploits-g...) and then demo that here instead of selling it in the market? If the market pays lots of money for Mac OS X exploits, why would it pay less for Windows ones? It can't be market share and I doubt it is because Mac users have faster Internet (so that their machines can be bigger DDOS sources, have more money to steal from them (both may or may not be true, but I doubt that fully offsets the difference in market share) Another only thing I can think of why Mac exploits would be more expensive is that buyers expect Mac zero days to last longer, but I doubt that, too. That leaves two reasons: because it is so easy that nobody considers it a challenge, and everybody expects someone else to pick up the price, or because it is too hard. Alternative theories welcome.
- eksith 14y agoI really have no specific explanation for it (that's really not the crew I hang out with), but exploits for the Mac ecosystem, iOS in particular, are in very high demand and do cost more. Some theories: I don't necessarily think it's because Mac 0-days last longer, but I know they do consider it a challenge; The difficulty may factor in to the price somehow. Maybe because there's the presumption the average user on iOS may have more cash to burn than the average Windows user. They may have more to gain by hitting Apple employees for trade secrets. Of course, all this is pure speculation.
- lawnchair_larry 14y agoThat's not quite accurate. iOS exploits are worth a lot, bit OS X exploits are not worth as much. There is no relation between the two in terms of value. It's also much easier to write OS X exploits than it is to write Windows exploits in general. Windows has always been far ahead of OS X in terms of mitigations. Safari on OS X is considered a soft target compared to the other browsers. It is the least difficult and has the fewest users. That is why the payout is less.
- eksith 14y agoNever mentioned OS X. Parent did, I didn't. OS X's "soft target" status would explain why Pwn2own offered a lesser prize for Safari on it, but iOS is a different beast altogether and more likely to be carried around by Apple devs on their mobile devices. Hence my theory they may be after trade secrets.
- lawnchair_larry 14y agoYou did, because Mac and OS X are synonymous :) It has nothing to do with being after trade secrets from Apple employees. The people who sell both iOS and Mac (OS X) exploits do not sell them to people trying to steal Apple's trade secrets.
- othermaciej 14y ago
- iopq 14y agoI don't see any mention of Opera :)