Hacker News Reader

Comment by lost_name | Hacker News Reader

Do people go into Pwn2Own knowing the exploits they will use in advance? I'm not sure I understand the format of such a contest.

View on HN

Was similarly curious. Reading the rules here: http://zerodayinitiative.com/Pwn2Own2015Rules.html

Major points:

- You register for which browser + os combination[0]. Then they randomly order the contestants.

- When you are called, you have 30 minutes.

- The user browses to a particular piece of content that you specify. Then no further user interaction is allowed (like clicking a dialog, downloading a file). [1][2]

- The prize money goes to the first successful exploit. Money differs by browser.

[0] Chrome, Firefox, IE, Adobe Reader in IE, Adobe Flash in IE. Safari on OSX. Fully patched OS.

[1] How does one get to specify the content? What if I have a http header that downloads a file?

[2] I remember back in the day, they used to have a fully no interactive version? Like the user was just on the same wireless network?

The exploits that take down hardened browsers take months to develop. The time limits and race dynamics are theater.

>"The time limits and race dynamics are theater."

That makes more sense. Otherwise, this is movie-script-like hacking ability.

"I just need to break the encryption......ok...it's done."

It makes a bit more sense in the original context of the contest, where you were doing the attack on the actual hardware you would win. So time limits were so that everyone got a shot, and a race since there was no prize after someone won it.

I was curious, so here are the rewards:

Windows-based targets:

1. Google Chrome (64-bit): $75,000 (USD)

2. Microsoft Internet Explorer 11 (64-bit with EPM-enabled): $65,000 (USD)

3. Mozilla Firefox: $30,000 (USD)

4. Adobe Reader running in Internet Explorer 11 (64-bit with EPM-enabled): $60,000 (USD)

5. Adobe Flash (64-bit) running in Internet Explorer 11 (64-bit with EPM-enabled): $60,000 (USD)

Mac OS X-based targets:

1. Apple Safari (64-bit): $50,000 (USD)

So you only have to visit a website and do nothing else? And probably assuming javascript is enabled.

I think you instruct the judges to visit your website, and then demonstrate that you owned their box within the 30 minutes to win the prize.

So if I'm reading this right, you could spend months developing an exploit, and then not even get to use it if another contestant, randomly chosen to go before you, exploits the browser first?

Yes, I believe so. Though there are other competitions, and also the regular bug bounty programs that most browsers offer.

At that point you would probably submit it through the regular bug bounty program. Pwn2own is just more lucrative.

I am surprised that Chrome OS + Chrome isn't an option. If it provided uncrackable, that would be good theater; and if not, still very useful to Google. Unless the possibility of tarnishing its reputation outweighs the benefits...

I was surprised by how few OS/Browser combinations were tested. For instance, I'd think that the OSX + Chrome population is pretty big and I'd (selfishly) like that combination tested.

It feels like, just the fact that this competition and other bug bounty programs exist, means that the big companies here have gotten over reputation tarnish and know that the patch is worth it.

Any browser that can be exploited on Windows can be exploited easier on OS X. It lags far behind in mitigations. So, the Chrome/OS X combo is not done because it's redundant.

Windows has a huge amount of ridiculous attack surface like GUI rendering code in THE KERNEL: http://www.theregister.co.uk/2015/02/12/hacker_kicks_one_bit...

I'm pretty sure no system ever is going to be as exploitable as Windows.

Google used to run a separate contest (at the same conference as Pwn2Own) called Pwnium for Chrome OS, but starting this year they are moving to a model where they pay similarly large bounties year-round rather than at contests.

http://googleonlinesecurity.blogspot.com/2015/02/pwnium-v-ne...

Yes, weeks or months of work goes into finding the bugs, and then working out how to exploit them. The continued "hacked in x minutes" crap is nonsense.

It's basically demo day for browser (and other software) vulnerabilities. Hackers show off their exploits and vendors pay them cash for disclosing them at Pwn2Own instead of selling them on the blackmarket.

They used to sell the hacker, but since they've stopped Pwn2Own is much more popular.

Surely there are 13th amendment concerns with selling the hacker.

Do you mean that they used to sell the exploits to other hackers at Pwn2Own?

Yes. It's basically a bug-bounty system, but the bounty includes more prestige :)

And more money.

And leaving the exploits in the wild for weeks/months beforehand.

This is a valid criticism.

Perhaps more worrying, they may have sold them elsewhere first and informed the purchaser that they have until the competition date to use it. Better business if you have to come back after the disclosure date for more holes...

Nohig ethical at all going on here.

My understanding is that would violate the rules of the competition. Though of course if a competitor were to do that, odds are no one would find out.

Would someone willing to sell exploits on the black market really be concerned with "violating the rules of the competition"?

Well, presumably they'd want to keep the money from the competition. That's definitely an incentive.

I would imagine it'd be fairly hard to the competition to know and revoke the money. Bad guys are almost certainly exploiting various undisclosed vulnerabilities. The bigger issue, I'd assume, is that by doing this competition, you've now killed that bug you previously sold. So long that was disclosed to the buyer though, I imagine you're all set.

Odds are the black market guys find out. I don't know how the market works, but I'd be pretty pissed if I had bought a hole just for it to be patched soon after.

To mitigate this problem, Google has recently announced that they are running a similar program year-round:

http://blog.chromium.org/2015/02/pwnium-v-never-ending-pwniu...

With very lower rewards, the exploit that nettet $110k would probably be getting less than $50k

But you also minimize the risk that someone else will find and report the vulnerability before you do, negating any & all chance of earning a bounty yourself.

I was wondering the same thing. It seems like there would be no way to stop someone from having exploits beforehand. And a single person finding exploits in every major browser in one day seems unlikely.

They have to exploit the fully patched versions (on the day). Prior to the contest, vendors are free to patch the exploits, if found.

Reply on news.ycombinator.com