Record Payouts At Hacking Contests
Record Payouts At Hacking Contests
Written by Andrew Johnson   
Monday, 17 March 2014

Hewlett-Packard paid out a total of $850K for security exploits during its two-day Pwn2Own event held at CanSecWest 2014. A further $150K was awarded by Google in its Pwniumn 4 competition that took place on the first day.

Although nobody attempted HP's Grand Prize, dubbed the Unicorn, which was to exploit Internet Explorer 11 running on a 64-bit Windows 8.1 operating system, with the Enhanced Mitigation Experience Toolkit (EMET) running, Pwn2Own contestants compromised IE twice.

On Day One (March 12) by French security research firm VUPEN which employed  use-after-free causing object confusion in the broker, resulting in sandbox bypass; and on Day 2 (March 13) by by Sebastian Apelt and Andreas Schmidt with two use-after-free bugs and a kernel bug.

VUPEN emerged as the dominant player for the fourth year running, also taking down Adobe Flash, Adobe Reader and Mozilla Firefox on Day One, netting a total of $300K. VUPEN withdrew two of its exploits attempts - against Java on Day One and Apple Safari on Day Two. It did however hack Google Chrome on Day Two, for a further $100K, with a use-after-free affecting both Blink and WebKit along with a sandbox bypass, resulting in code execution.

Firefox was the most exploited browser in this year's competition with a total of four exploits all using different techniques, including a use-after-free, a privilege escalation, and an out-of-bounds read and write. Asked why Firefox had attracted such attention Sid Stamm, senior engineering manager of security and privacy at Mozilla told eWeek:

"Pwn2Own offers very large financial incentives to researchers to expose vulnerabilities, and that may have contributed in part to the researchers' decision to wait until now to share their work and help protect Firefox users"

In fact Firefox exploits earned less than any of the others but at $50K the reward far exceeds the $3K offered by Mozilla in its bug bounty program.

Google had put $2.7 Million On Offer For Pwnium 4 for finding serious holes in Chrome OS but in the event awarded just one top prize of $150,000 plus a HP Chromebook 11, although it is considering partial credit for a second researcher.

As a prelude to the contest, security teams from Google and HP's ZDI (zero Day Initiative) went head to head in Pwn4Fun with each team claiming a victory in exploiting recently discovered flaws in Safari and IE. The prizes ($82,500 in total) were donated to the Canadian Red Cross.


Flash Finally Declared Dead - It Was Murder

Adobe has finally announced that Flash will be no more after 2020. If you are one of the many programmers who thought that Flash was already dead this will come as a surprise, but presumably not an un [ ... ]

RoboCup In Its 21st Year

RoboCup 2017 took place last month in Nagoya, Japan 20 years after its beginnings there in 1997. A four-minute video gives an overview of how it has evolved and continues to be at the cutting edge for [ ... ]

More News

Last Updated ( Monday, 17 March 2014 )

RSS feed of news items only
I Programmer News
Copyright © 2017 All Rights Reserved.
Joomla! is Free Software released under the GNU/GPL License.