Feeds

Is no browser safe? Security bods poke holes in Chrome, Safari, IE, Firefox and earn $1m

Big names fail, iOS kernel flaw found during hacking contests

Remote control for virtualized desktops

The Pwn2Own and Pwnium hacking contests at the annual CanSecWest conference in Vancouver have earned security researchers over a million dollars in prizes, exposed 34 serious zero-day flaws in popular code, and earned over $82,000 for the Canadian Red Cross.

In each of the Pwn2Own and Pwnium competitions, contestants are challenged to exploit vulnerabilities in supposedly secure software to execute malicious code – and walk away with cash if their attacks are successfully demonstrated on stage. The techniques used to own a program are privately disclosed so that the bugs can hopefully be fixed.

HP TippingPoint's Pwn2Own competition netted researchers $850,000 as all the major browsers – Chrome, Safari, Internet Explorer and Firefox – fell to attacks within the 30-minute timeframe for each, along with Flash. Only Java held up to the time-limited attacks, although researchers attempting to crack Oracle's code did come up with some interesting techniques that just took too long.

"Bug bounty schemes like Pwn2Own are really now just an extension of proper software testing," Brian Gorenc, manager of vulnerability research for HP's Zero Day Initiative told The Register.

"It's about allowing your software to be picked over by skilled independents who may spot flaws that slipped through the quality control proves. It's well worth the prize money."

Meanwhile in Google's fourth Pwnium competition, one skilled cracker broke into the Chocolate Factory's Chrome OS running on an HP Chromebook 11, earning himself $150,000 and the subverted laptop. Another researcher got part way there and will receive a lesser award from Google for their efforts.

There was also a fun competition between Google and HP, dubbed Pwn4Fun, which raised $82,500 for the Canadian Red Cross and exposed some major flaws. Gorenc said staff at Google found six zero-day vulnerabilities in Microsoft code, as well as a kernel issue in Apple's iOS. ®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Seattle children’s accelerates Citrix login times by 500% with cross-tier insight
Seattle Children’s is a leading research hospital with a large and growing Citrix XenDesktop deployment. See how they used ExtraHop to accelerate launch times.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Managing SSL certificates with ease
The lack of operational efficiencies and compliance pitfalls associated with poor SSL certificate management, and how the right SSL certificate management tool can help.