Java, Adobe Plug-Ins, Browsers All Fail to Survive Pwn2Own Contest
Researchers demonstrated four zero-day attacks against Java and successfully compromised Adobe's plug-ins, Microsoft's IE10, Mozilla's Firefox and Google's Chrome.Security researchers claimed nearly $500,000 in bounties for demonstrating previously unknown—or zero-day—attacks against all major browsers and three popular browser plug-ins at the annual Pwn2Own competition at the CanSecWest conference in Vancouver, B.C. The three-day contest, which ends March 8, requires that security professionals play the role of attackers and compromise fully patched versions of popular browsers running on Windows 8 and Mac OS X. After a successful attack, which requires that the researcher gain control over the target system, the contestants must turn over the details of the vulnerability to Hewlett-Packard's Zero Day Initiative (ZDI), which runs the competition. Those details are then passed to vendors to be patched.
"All of these individuals who come in and participate in the competition, they are bringing zero days that were not known at the time of the competition," said Brian Gorenc, manager of vulnerability research for HP's Security Research Labs. "So it is bleeding-edge research, especially when it comes to bypassing the sandboxes and the various plug-ins and browsers, which is why we offer the money we do."The company will pay two teams of researchers—offensive security firm VUPEN and a pair of researchers—$100,000 each for finding and exploiting critical flaws in Microsoft's Internet Explorer 10 and Google's latest version of the Chrome browser. In addition, the flaws found in Adobe's Flash and Reader plug-ins will net VUPEN and researcher George Hotz each $70,000. Finally, the successful compromise using Mozilla's Firefox will earn VUPEN another $60,000 and four separate exploits of Java will net the researchers who found them $20,000 each. HP coordinated with each affected software developer to get the information on the flaws to the appropriate security team.