Pwn2Own: Down go all the browsers

ZDNet ^ | 3/8/13 | Steven J Vaughn-Nichols

[illiac]

Summary: In the first day of the Pwn2Own cracking contest, Microsoft's Internet Explorer 10, Google's Chrome and Mozilla's Firefox web browsers have all gone down in flames.

Steven J. Vaughan-Nichols

By Steven J. Vaughan-Nichols for Networking | March 7, 2013 -- 18:20 GMT (10:20 PST)

In the eternal war between crackers and security professionals, the hackers have won the latest battle. ZDI_Twitter_AvatarIn ZDI's Pwn2Own hacker competition one browser after another fell. At the CanSecWest conference in Vancouver, Canada, the HP Zero Day Initiative's (ZDI) annual Pwn2Own competition has ended its first day of competition and Microsoft's Internet Explorer (IE) 10, Google's Chrome and Mozilla's Firefox Web browsers have all been cracked. In addition, Java—can anyone be surprised at this?--was also cracked multiple times.

Vupen Security, the French security and hacking company, cracked IE 10. Vupen reported, via Twitter, that they "pwned MS Surface Pro with two IE10 zero-days to achieve a full Windows 8 compromise with sandbox bypass."

Mind you, no one else had anything to boast about on this day. Google, which had just fixed numerous security bugs in the Chrome Web browser prior to Pwn2Own, saw Chrome go down as well. MWR Labs, a branch of UK-based MWR InfoSecurity, took down Chrome 25 on Windows 7 by exploiting multiple "zero-day," or unpatched, browser vulnerabilities.

[freeandfreezing]

A good example of how adding features that appeal to large numbers of end users, and flashy visual designs, are more important to software vendors than security. The market for browsers demands new features, not security, so that is what we get.

It is certainly possible to write browsers that are nearly impossible to attack, but there is little market for them.

[Ernest_at_the_Beach]

Where was the image actually stored?

[ShadowAce]

Firefox 19.0.2 was released less than 24 hours after this announcement to fix this flaw.

Pretty fast.

[BenLurkin]

I have no idea. Found it using Bing.

[for-q-clinton]

No way...Impossible for OSX to go down. At least that’s what we’ve been told by the macbots and apple zealots.

Of course they were saying that even after OSX was the first to lose 3 years in a row!

Oh well, who ever takes security advice from a macbot is an idiot anyway.

[for-q-clinton]

Odd this year they didn’t test safari?

Also it’s amazing that they are saying adobe is the most secure platform this year! Wow they have really turned it around.