The nominations for the 2011 Pwnie Awards at Black Hat recognizes Sony for its sheer incompetence at security, and Anonymous, LulzSec and WikiLeaks for cyber-mayhem.
professionals heading to Black Hat can look forward to the Pwnie Awards, the
hacker version of the Academy Awards, this week.
winners of the Pwnie Awards will be announced Aug. 3 at the Black Hat security
conference in Las Vegas. Instead of little Oscars, award recipients receive
gold-painted My Little Pony statuettes, a nod to the fact that
"Pwnies" is pronounced "ponies."
hacking slang term "pwned" means "owned" or controlled by a
Pwnies celebrate superior security skills and catastrophic security
incompetence of security researchers and the community over the past year,
according to the Pwnie Awards Website
The various categories recognize individuals, businesses, malware and its
discoverers that have dominated security headlines from July 1, 2010, to June
awards represent a serious attempt to acknowledge the people and events that
have made the biggest impact on the hacking community over the past year, Dino
Dai Zovi, one of the organizers and judges, told Reuters
will be awarded in eight categories, including best server-side bug, most
innovative research, lamest vendor response, best client-side bug, best
privilege escalation bug, "Most Epic Fail" and "Most Epic
0wnage." The category "Best Song" features original songs
written about security.
kind of awards ceremony does not have an award for best song?" the organizers
rap song written and performed by George
, the hacker who was sued by Sony for jailbreaking
PlayStation 3 and distributing the tool, was nominated in this category.
it's geohot / And for those that don't know / I'm getting sued by Sony,"
the song begins. Other nominees include "Hacker Hacker" by Phenoelit,
a track described as "a homage to the hacker scene," and "Help Yourself to
My Flaws" by Stephano Di Paola, a song describing "the current state of
web application security."
were five nominees for the "Epic Fail" award: Sony, Sony, Sony, Sony
and, again, Sony. Each of the nominations were for different reasons, including
the lawsuit against Hotz, failing to adequately secure Sony
, shutting down PlayStation Network for two months
after the breach, failing to secure other sites that allowed LulzSec to have
some fun, and laying off multiple security staff shortly after the massive data
top award, "Most Epic 0wnage," will go to "hackers responsible
for delivering the most damaging, widely publicized or hilarious 0wnage,"
according to the awards organizers. The nominees are Anonymous
for hacking HBGary Federal
for "hacking everyone,"
WikiLeaks for posting thousands of
classified documents and Bradley Manning for carrying them out on fake Lady
Gaga CDs, and Stuxnet for being the first malware to damage centrifuges used in
nuclear power plants.
Anonymous or LulzSec win the award, the organizers will invite a representative
up to the podium to claim the Pwnies on their behalf, Alex Sotirov, another
organizer, told Reuters. "If somebody from LulzSec or Anonymous decides to
show up and accept their Pwnie, we will give it to them," Sotirov said,
adding, "But they will probably get arrested."
and Magix are nominated for the "Lamest Vendor Response"
award. Novell mischaracterized a remotely exploitable stack overflow in the
OpenSSH implementation on Novell NetWare as a denial-of-service attack. RSA was
nominated because it assured customers there was nothing to worry about after
unknown attackers stole information relating to the SecurID technology in
March. It turned out that there was plenty to worry about as attackers used the
information to create cloned tokens to breach defense contractor Lockheed
Martin in May. When a researcher notified Magix of a vulnerability in its Music
Maker 16 software, the vendor threatened to sue the researcher if he publicized
the proof-of-concept exploit.
best server-side, client-side and privilege escalation bugs award recognizes
the researcher or team who initially discovered them. The nominees include the flaw
in the DHCP client from ISC, the vulnerability exploited during the Pwn2Own
competition at CanSecWest
in March to compromise the BlackBerry, and
various Windows kernel issues. The innovative research award goes to the
"person who published the most interesting and innovative research in the
form of a paper, presentation, tool or even a mailing list post,"
according to the Website.