Hacker Challenge Takes Aim At Browsers, Smartphones

Computerworld — The hacking contest that has grabbed headlines two years running will take aim next month at browsers and smartphones, according to the security company that sponsors the "PWN2OWN" challenge.

"We're still in the planning stages for how the competition will be structured," said Terri Forslof , the manager of security response for 3Com Inc.'s TippingPoint , regarding discussions she's had with organizers of CanSecWest , the security conference slated to begin March 16 in Vancouver, British Columbia.

While the details have yet to be sorted out -- including the dollar amounts for prizes and the contest rules -- Forslof confirmed that PWN2OWN will actually consist of two separate hacker challenges this year.

The first will be a contest to break into one of several browsers, including Microsoft Corp. 's Internet Explorer 8 (IE8), which recently reached "release candidate" ; Mozilla Corp.'s Firefox; and Apple Inc. 's Safari.

That contest will play out on a Sony notebook equipped with Windows 7, the still-under-construction successor to Windows Vista.

The second challenge will pit hackers against a variety of smartphone operating systems, including Google Inc.'s Android, Microsoft's Windows Mobile and Apple's iPhone operating system, which is a scaled-down version of Mac OS X.

Cash prizes will be awarded, Forslof said today, but the number of prizes and their amounts remains to be decided. As with the past two years, TippingPoint will be the sole sponsor of the PWN2OWN contest.

Last year at CanSecWest, noted Apple vulnerability researcher Charlie Miller broke into a MacBook Air laptop in under two minutes to win $10,000. The next day, security consultant Shane Macaulay claimed a $5,000 prize for breaching a Fujitsu notebook running Windows Vista Service Pack 1 (SP1).

For his part, Miller was frustrated that PWN2OWN would not have a Mac OS X component this year.

"I'm really disappointed that there looks to be no Mac OS X target, as I'm really up to speed on that OS," said Miller, who will be at CanSecWest as a speaker. Although he was confident that he could hack Apple's operating system again, he also said he was up to snuff on both browser and smartphones. "I could theoretically do either contest or both," he said in an e-mail today.

Like others, he's waiting for more information -- including the prize amounts -- before deciding whether to participate.

As in previous PWN2OWN contests, winners will assign the rights to their exploits, and the vulnerabilities they triggered, to TippingPoint, which is known for its Zero Day Initiative bug-bounty program that pays researchers for finding flaws. "We'll use the same process," said Forslof, "where the winner will sign the standard ZDI agreement, and information will be turned over to the vendor."

TippingPoint does not publicly release details of the vulnerabilities it buys, but instead reports them to the appropriate vendor, and uses the information in its own security technology to preemptively block attacks.

Forslof said she and organizers of the conference are also in talks with several vendors about the companies having representatives on site during the contests. Last year, researchers from Microsoft, Apple and McAfee Inc. were at CanSecWest for consultation.

"I know Dragos [Ruiu] is trying to come up with a different spin on the contest," said Forslof, "but we're still sorting it all out."

Ruiu, one of the CanSecWest organizers, was not immediately available for comment.