I’m currently out on a client engagement, but early results over Twitter say that Internet Explorer 8 on Windows 7, Firefox on Windows 7, Safari on Mac OS X, and Safari on iPhone were all exploited within seconds in the Pwn2Own contest at the CanSecWest conference. While these exploits took the developers weeks or months to complete, that’s still a clean sweep.
There is a very simple lesson in these results:
If your security program relies on preventing or eliminating vulnerabilities and exploits, it is not a security program.
Reader interactions
4 Replies to “Hello World. Meet Pwn2Own.”
@rich,
You’re right. SMS is not the only data at risk. Also available are contacts, music, photos and more.
Rich,
While I get where you’re coming from when you state:
“If your security program relies on preventing or eliminating vulnerabilities and exploits, it is not a security program.”
I think there needs to be just a tad more context around it… Because, well, most organizations that are just starting to look at security programs at different levels this would imply that they’re very immature in the sense of being able to deal with things things like vulnerabilities in the organization. But, you have to start somewhere so I guess I wouldn’t full on agree with the statement. So to “rely” on it I agree with you – but many don’t know how to deal with it otherwise.
As for pwn2own – iPhone SMS database got popped, which might imply other stored information is at risk, but that’s just my speculation.
I’m not there so I don’t know for sure, but my understanding is they got remote code execution on everything except the iPhone. Threatpost should have more through the day…
G’day again,
Do you have any information about how deeply these guys were able to penetrate the host operating system, after breaking the browser?
Did they execute code as the running user?
Did they gain privilege escalation (i.e. System on Windows or Root on OS X)?
I think that it is safe to assume that any system can be hacked. The level to which it is actually controlled by the hacker, and the measures taken to mitigate the outcome of being hacked will determine the “cost”.
Interesting stuff – please keep us posted!