Hacker News Reader

Comment by liyanchang | Hacker News Reader

Was similarly curious. Reading the rules here: http://zerodayinitiative.com/Pwn2Own2015Rules.html

Major points:

- You register for which browser + os combination[0]. Then they randomly order the contestants.

- When you are called, you have 30 minutes.

- The user browses to a particular piece of content that you specify. Then no further user interaction is allowed (like clicking a dialog, downloading a file). [1][2]

- The prize money goes to the first successful exploit. Money differs by browser.

[0] Chrome, Firefox, IE, Adobe Reader in IE, Adobe Flash in IE. Safari on OSX. Fully patched OS.

[1] How does one get to specify the content? What if I have a http header that downloads a file?

[2] I remember back in the day, they used to have a fully no interactive version? Like the user was just on the same wireless network?

View on HN

The exploits that take down hardened browsers take months to develop. The time limits and race dynamics are theater.

>"The time limits and race dynamics are theater."

That makes more sense. Otherwise, this is movie-script-like hacking ability.

"I just need to break the encryption......ok...it's done."

It makes a bit more sense in the original context of the contest, where you were doing the attack on the actual hardware you would win. So time limits were so that everyone got a shot, and a race since there was no prize after someone won it.

I was curious, so here are the rewards:

Windows-based targets:

1. Google Chrome (64-bit): $75,000 (USD)

2. Microsoft Internet Explorer 11 (64-bit with EPM-enabled): $65,000 (USD)

3. Mozilla Firefox: $30,000 (USD)

4. Adobe Reader running in Internet Explorer 11 (64-bit with EPM-enabled): $60,000 (USD)

5. Adobe Flash (64-bit) running in Internet Explorer 11 (64-bit with EPM-enabled): $60,000 (USD)

Mac OS X-based targets:

1. Apple Safari (64-bit): $50,000 (USD)

So if I'm reading this right, you could spend months developing an exploit, and then not even get to use it if another contestant, randomly chosen to go before you, exploits the browser first?

At that point you would probably submit it through the regular bug bounty program. Pwn2own is just more lucrative.

Yes, I believe so. Though there are other competitions, and also the regular bug bounty programs that most browsers offer.

I am surprised that Chrome OS + Chrome isn't an option. If it provided uncrackable, that would be good theater; and if not, still very useful to Google. Unless the possibility of tarnishing its reputation outweighs the benefits...

Google used to run a separate contest (at the same conference as Pwn2Own) called Pwnium for Chrome OS, but starting this year they are moving to a model where they pay similarly large bounties year-round rather than at contests.

http://googleonlinesecurity.blogspot.com/2015/02/pwnium-v-ne...

I was surprised by how few OS/Browser combinations were tested. For instance, I'd think that the OSX + Chrome population is pretty big and I'd (selfishly) like that combination tested.

It feels like, just the fact that this competition and other bug bounty programs exist, means that the big companies here have gotten over reputation tarnish and know that the patch is worth it.

Any browser that can be exploited on Windows can be exploited easier on OS X. It lags far behind in mitigations. So, the Chrome/OS X combo is not done because it's redundant.

Windows has a huge amount of ridiculous attack surface like GUI rendering code in THE KERNEL: http://www.theregister.co.uk/2015/02/12/hacker_kicks_one_bit...

I'm pretty sure no system ever is going to be as exploitable as Windows.

So you only have to visit a website and do nothing else? And probably assuming javascript is enabled.

I think you instruct the judges to visit your website, and then demonstrate that you owned their box within the 30 minutes to win the prize.

Reply on news.ycombinator.com