7 ms·

Was similarly curious. Reading the rules here: http://zerodayinitiative.com/Pwn2Own2015Rules.html http://zerodayinitiative.com/Pwn2Own2015Rules.html Major poin

Was similarly curious. Reading the rules here: http://zerodayinitiative.com/Pwn2Own2015Rules.html http://zerodayinitiative.com/Pwn2Own2015Rules.html Major points: - You register for which browser + os combination[0]. Then they randomly order the contestants. - When you are called, you have 30 minutes. - The user browses to a particular piece of content that you specify. Then no further user interaction is allowed (like clicking a dialog, downloading a file). [1][2] - The prize money goes to the first successful exploit. Money differs by browser. [0] Chrome, Firefox, IE, Adobe Reader in IE, Adobe Flash in IE. Safari on OSX. Fully patched OS. [1] How does one get to specify the content? What if I have a http header that downloads a file? [2] I remember back in the day, they used to have a fully no interactive version? Like the user was just on the same wireless network?

tptacek 12y ago
The exploits that take down hardened browsers take months to develop. The time limits and race dynamics are theater.
- hnnewguy 12y ago
  >"The time limits and race dynamics are theater." That makes more sense. Otherwise, this is movie-script-like hacking ability.
  - eeeeeeeeeeeee 12y ago
    "I just need to break the encryption......ok...it's done."
- smackfu 12y ago
  It makes a bit more sense in the original context of the contest, where you were doing the attack on the actual hardware you would win. So time limits were so that everyone got a shot, and a race since there was no prize after someone won it.
3pt14159 12y ago
I was curious, so here are the rewards: Windows-based targets: 1. Google Chrome (64-bit): $75,000 (USD) 2. Microsoft Internet Explorer 11 (64-bit with EPM-enabled): $65,000 (USD) 3. Mozilla Firefox: $30,000 (USD) 4. Adobe Reader running in Internet Explorer 11 (64-bit with EPM-enabled): $60,000 (USD) 5. Adobe Flash (64-bit) running in Internet Explorer 11 (64-bit with EPM-enabled): $60,000 (USD) Mac OS X-based targets: 1. Apple Safari (64-bit): $50,000 (USD)
pqomdv 12y ago
So you only have to visit a website and do nothing else? And probably assuming javascript is enabled.
- yebyen 12y ago
  I think you instruct the judges to visit your website, and then demonstrate that you owned their box within the 30 minutes to win the prize.
eridius 12y ago
So if I'm reading this right, you could spend months developing an exploit, and then not even get to use it if another contestant, randomly chosen to go before you, exploits the browser first?
- rudolf0 12y ago
  Yes, I believe so. Though there are other competitions, and also the regular bug bounty programs that most browsers offer.
- smackfu 12y ago
  At that point you would probably submit it through the regular bug bounty program. Pwn2own is just more lucrative.
blacksmith_tb 12y ago
I am surprised that Chrome OS + Chrome isn't an option. If it provided uncrackable, that would be good theater; and if not, still very useful to Google. Unless the possibility of tarnishing its reputation outweighs the benefits...
- liyanchang 12y ago
  I was surprised by how few OS/Browser combinations were tested. For instance, I'd think that the OSX + Chrome population is pretty big and I'd (selfishly) like that combination tested. It feels like, just the fact that this competition and other bug bounty programs exist, means that the big companies here have gotten over reputation tarnish and know that the patch is worth it.
  - lawnchair_larry 12y ago
    Any browser that can be exploited on Windows can be exploited easier on OS X. It lags far behind in mitigations. So, the Chrome/OS X combo is not done because it's redundant.
    - floatboth 12y ago
      Windows has a huge amount of ridiculous attack surface like GUI rendering code in THE KERNEL: http://www.theregister.co.uk/2015/02/12/hacker_kicks_one_bit_xp_to_10_windows_scroll_goal/ http://www.theregister.co.uk/2015/02/12/hacker_kicks_one_bit... I'm pretty sure no system ever is going to be as exploitable as Windows.
- mccr8 12y ago
  Google used to run a separate contest (at the same conference as Pwn2Own) called Pwnium for Chrome OS, but starting this year they are moving to a model where they pay similarly large bounties year-round rather than at contests. http://googleonlinesecurity.blogspot.com/2015/02/pwnium-v-never-ending-pwnium.html http://googleonlinesecurity.blogspot.com/2015/02/pwnium-v-ne...

tptacek 12y ago

The exploits that take down hardened browsers take months to develop. The time limits and race dynamics are theater.

hnnewguy 12y ago
>"The time limits and race dynamics are theater." That makes more sense. Otherwise, this is movie-script-like hacking ability.
- eeeeeeeeeeeee 12y ago
  "I just need to break the encryption......ok...it's done."
smackfu 12y ago
It makes a bit more sense in the original context of the contest, where you were doing the attack on the actual hardware you would win. So time limits were so that everyone got a shot, and a race since there was no prize after someone won it.

3pt14159 12y ago

I was curious, so here are the rewards: Windows-based targets: 1. Google Chrome (64-bit): $75,000 (USD) 2. Microsoft Internet Explorer 11 (64-bit with EPM-enabled): $65,000 (USD) 3. Mozilla Firefox: $30,000 (USD) 4. Adobe Reader running in Internet Explorer 11 (64-bit with EPM-enabled): $60,000 (USD) 5. Adobe Flash (64-bit) running in Internet Explorer 11 (64-bit with EPM-enabled): $60,000 (USD) Mac OS X-based targets: 1. Apple Safari (64-bit): $50,000 (USD)

pqomdv 12y ago

So you only have to visit a website and do nothing else? And probably assuming javascript is enabled.

yebyen 12y ago
I think you instruct the judges to visit your website, and then demonstrate that you owned their box within the 30 minutes to win the prize.

eridius 12y ago

So if I'm reading this right, you could spend months developing an exploit, and then not even get to use it if another contestant, randomly chosen to go before you, exploits the browser first?

rudolf0 12y ago
Yes, I believe so. Though there are other competitions, and also the regular bug bounty programs that most browsers offer.
smackfu 12y ago
At that point you would probably submit it through the regular bug bounty program. Pwn2own is just more lucrative.

blacksmith_tb 12y ago

I am surprised that Chrome OS + Chrome isn't an option. If it provided uncrackable, that would be good theater; and if not, still very useful to Google. Unless the possibility of tarnishing its reputation outweighs the benefits...

liyanchang 12y ago
I was surprised by how few OS/Browser combinations were tested. For instance, I'd think that the OSX + Chrome population is pretty big and I'd (selfishly) like that combination tested. It feels like, just the fact that this competition and other bug bounty programs exist, means that the big companies here have gotten over reputation tarnish and know that the patch is worth it.
- lawnchair_larry 12y ago
  Any browser that can be exploited on Windows can be exploited easier on OS X. It lags far behind in mitigations. So, the Chrome/OS X combo is not done because it's redundant.
  - floatboth 12y ago
    Windows has a huge amount of ridiculous attack surface like GUI rendering code in THE KERNEL: http://www.theregister.co.uk/2015/02/12/hacker_kicks_one_bit_xp_to_10_windows_scroll_goal/ http://www.theregister.co.uk/2015/02/12/hacker_kicks_one_bit... I'm pretty sure no system ever is going to be as exploitable as Windows.
mccr8 12y ago
Google used to run a separate contest (at the same conference as Pwn2Own) called Pwnium for Chrome OS, but starting this year they are moving to a model where they pay similarly large bounties year-round rather than at contests. http://googleonlinesecurity.blogspot.com/2015/02/pwnium-v-never-ending-pwnium.html http://googleonlinesecurity.blogspot.com/2015/02/pwnium-v-ne...