Pwn2Own is a computer hacking contest held annually at the CanSecWest security conference, beginning in 2007. Contestants are challenged to exploit widely used software and mobile devices with previously unknown vulnerabilities. Winners of the contest receive the device that they exploited, a cash prize, and a "Masters" jacket celebrating the year of their win. The name "Pwn2Own" is derived from the fact that contestants must "pwn" or hack the device in order to "own" or win it. The Pwn2Own contest serves to demonstrate the vulnerability of devices and software in widespread use while also providing a checkpoint on the progress made in security since the previous year.
Contents
Origins
The first contest was conceived and developed by Dragos Ruiu in response to his frustration with Apple's lack of response to the Month of Apple Bugs and the Month of Kernel Bugs, as well as Apple's television commercials that trivialized the security built into the competing Windows operating system. At the time, there was a widespread belief that, despite these public displays of vulnerabilities in Apple products, OS X was significantly more secure than any other competitors.
On March 20, roughly three weeks before CanSecWest that year, Ruiu announced the Pwn2Own contest to security researchers on the DailyDave mailing list. The contest was to include two MacBook Pros that he would leave on the conference floor hooked up to their own wireless access point. Any conference attendee that could connect to this wireless access point and exploit one of the devices would be able to leave the conference with that laptop. There was no monetary reward. Ruiu further outlined that there would be progressively loosened restrictions on what hacks were acceptable over the three days of the conference.
On the first day of the conference, Ruiu asked Terri Forslof of the Zero Day Initiative (ZDI) to participate in the contest. ZDI has a programme which purchases zero-day attacks, reports them to the affected vendor and turns them into signatures for their own network intrusion detection system, increasing its effectiveness. The vulnerabilities sold to ZDI are made public only after the affected vendor has issued a patch for it. Forslof agreed to have ZDI offer to purchase any vulnerabilities used in the contest for a flat price of $10,000.
Contest 2007
The first contest was intended to highlight the insecurity of Apple's Mac OS X operating system since, at the time, there was a widespread belief that OS X was far more secure than its competitors. The contest took place from Thursday, April 18 to Saturday, April 20, 2007.
Rules
Two MacBook Pro laptops, one 13" and one 15", were left on the conference floor at CanSecWest and joined to a separate wireless network. Only certain attacks were allowed and these restrictions were progressively loosened over the three days of the conference.
In order to win the 15" MacBook Pro, contestants would be required to further escalate their privileges to root after gaining access with their initial exploit.
Outcome
After the $10,000 prize was announced by ZDI and the laptops were not hacked on the first day, Shane Macaulay called up former co-worker Dino Dai Zovi in New York and urged him to compete in the second day. Starting on Thursday night, Dai Zovi found and exploited a previously unknown vulnerability in a QuickTime library loaded by Safari by 3am that night. The following morning, Dai Zovi packaged up his exploit code and sent it to Macaulay at the conference in Vancouver. Macaulay placed Dai Zovi's exploit code on a website and e-mailed the contest organizers a link to it. When clicked on the contest laptop, Dai Zovi's exploit code allowed Shane to take control of the laptop, winning the contest by proxy for Dai Zovi. As a thank you for helping him win the contest, Dai Zovi let Macaulay keep the 15" MacBook Pro. Dai Zovi separately sold the vulnerability to ZDI for the $10,000 prize.
Contest 2008
After the successful 2007 contest, the scope of the Pwn2Own contest was expanded to include a wider array of operating systems and browsers. The contest would demonstrate the widespread insecurity of all software in widespread use by consumers. Dragos refined the contest with the help of a wide panel of industry experts and the contest was administered by ZDI, who would again offer to purchase the vulnerabilities after their demonstration. As with all the vulnerabilities that ZDI purchases, the details of the vulnerabilities used in Pwn2Own would be provided to the affected vendors and public details would be withheld until a patch was made available. All contestants who successfully demonstrated exploits at the contest could sell their vulnerabilities to ZDI for prizes of $20,000 on the first day, $10,000 on the second day, and $5,000 on the third day. Pwn2Own 2008 took place from Thursday, March 26 to Saturday, March 28, 2008.
Rules
In the 2008 contest, there were three different target laptops each running the default installation of either Windows Vista Ultimate SP1, OS X 10.5.2, and Ubuntu Linux 7.10. As in the previous year's contest, Pwn2Own took place over the course of three days and only certain attacks were allowed on each day.
Outcome
The laptop running OS X was exploited on the second day of the contest with an exploit for the Safari browser co-written by Charlie Miller, Jake Honoroff and Mark Daniel of Independent Security Evaluators. Their exploit targeted an open-source subcomponent of the Safari browser.
The laptop running Windows Vista SP1 was exploited on the third day of the contest with an exploit for Adobe Flash co-written by Shane Macaulay, Alexander Sotirov, and Derek Callaway. After the contest, Adobe disclosed that they had co-discovered the same vulnerability internally and had been working on a patch at the time of Pwn2Own.
The laptop running Ubuntu was not exploited.
Contest 2009
After having considerably more success targeting web browsers than any other category of software, the third Pwn2Own focused on popular browsers used on consumer desktop operating systems. It added another category of mobile devices which contestants were challenged to hack via many remote attack vectors including email, SMS messages, and website browsing. Pwn2Own 2009 took place over the three days of CanSecWest from Thursday, March 18 to Saturday, March 20, 2009. All contestants who demonstrated successful exploits at the contest were offered rewards for the underlying vulnerabilities by ZDI, $5,000 for browser exploits and $10,000 for mobile exploits.
Web browser rules
The browser targets were Internet Explorer 8, Firefox, and Chrome installed on a Sony Vaio running Windows 7 Beta and Safari and Firefox installed on a MacBook running Mac OS X. All browsers were fully patched and in default configurations on the first day of the contest. As in previous years, the attack surface ontest expanded over the three days.
Multiple winners per target were allowed, but only the first contestant to exploit each laptop would get it.
Mobile device rules
The mobile device targets included BlackBerry, Android, iPhone, Symbian and Windows Mobile phones in their default configurations. The specific devices included:
As with the browser contest, the attack surface available to contestants expanded over three days.
In order to prove that they were able to successfully compromise the device, contestants had to demonstrate they could collect sensitive data from the mobile device or incur some type of financial loss from the mobile device owner.
Multiple winners per device were allowed, but only the first contestant to exploit each mobile device would get it (along with a one-year phone contract).
Outcome
Based on the increased interest in competing this year, ZDI arranged a random selection to determine which team went first against each target.
The first contestant to be selected was Charlie Miller. He exploited Safari on OS X without the aid of any browser plugins. In interviews after winning the contest, Miller stressed that while it only took him minutes to run his exploit against Safari it took him many days to research and develop the exploit he used.
A researcher identified only as Nils was selected to go after Miller. Nils successfully ran an exploit against Internet Explorer 8 on Windows 7 Beta. In writing this exploit, Nils had to bypass anti-exploitation mitigations that Microsoft had implemented in Internet Explorer 8 and Windows 7, including Data Execution Protection (DEP) and Address Space Layout Randomization (ASLR).
Nils continued trying the other browsers. Although Miller had already exploited Safari on OS X, Nils exploited this platform again, then moved on to exploit Firefox successfully.
Near the end of the first day, Julien Tinnes and Sami Koivu (remote) successfully exploited Firefox and Safari on OS X with a vulnerability in Java. At the time, OS X had Java enabled by default which allowed for reliable exploitation against that platform. However, due to having reported the vulnerabilities to the vendor already, Tinnes' participation fell outside the rules of the contest and was unable to be rewarded.
The next days of the contest did not attract any additional contestants. Chrome, as well as all of the mobile devices, went unexploited in Pwn2Own 2009.
Contest 2010
The competition started at March 24, 2010 and had a total cash prize pool of US$100,000. On March 15—nine days before the contest was to begin—Apple released sixteen patches for WebKit and Safari.
Software to exploit
$40,000 of the $100,000 was reserved for web browsers, where each target is worth $10,000.
Day 1
Day 2
Day 3
Target: Mobile Phones
$60,000 of the total $100,000 cash prize pool was allotted to the mobile phone portion of the contest, each target was worth $15,000.
Successful exploits
Opera
The Opera web browser was left out of the contests as a target: The ZDI team argued that Opera had a low market share and that Chrome and Safari are only included "due to their default presence on various mobile platforms". However, Opera's rendering engine, Presto, is present on millions of mobile platforms.
Contest 2011
The 2011 contest took place between March 9 until 11th during the CanSecWest conference in Vancouver, Canada.
Targets
The web browser targets for the 2011 contest included Microsoft Internet Explorer, Apple Safari, Mozilla Firefox, and Google Chrome. New to the Pwn2Own contest was the fact that a new attack surface was allowed for penetrating mobile phones, specifically over cellphone basebands. The mobile phone targets were Dell Venue Pro running Windows Phone 7, iPhone 4 running iOS, BlackBerry Torch 9800 running BlackBerry OS 6.0, and Nexus S running Android 2.3.
Teams
The following teams registered for the desktop browser contest:
For the mobile browser category, the following teams registered:
Day 1
During the first day of the competition Safari and Internet Explorer were defeated by researchers.
Safari was version 5.0.3 installed on a fully patched Mac OS X 10.6.6. French security firm VUPEN was first to attack the browser, and five seconds after the browser visited its specially crafted malicious web page, it had both launched a standard harmless payload (to demonstrate that arbitrary code had been executed) and written a file to the hard disk (to demonstrate that the sandbox had been bypassed).
Internet Explorer was a 32-bit version 8 installed on 64-bit Windows 7 Service Pack 1. Security researcher Stephen Fewer of Harmony Security was successful in exploiting IE. This was demonstrated Just as with Safari.
Day 2
In day 2 the iPhone 4 and Blackberry Torch 9800 were both exploited.
The iPhone was running iOS 4.2.1, however the flaw exists in version 4.3 of the iOS. Security researchers Charlie Miller and Dion Blazakis were able to gain access to the iPhone's address book through a vulnerability in Mobile Safari by visiting their exploit ridden webpage.
The Blackberry Torch 9800 phone was running BlackBerry OS 6.0.0.246. The team of Vincenzo Iozzo, Willem Pinckaers, and Ralf Philipp Weinmann took advantage of a vulnerability in the Blackberry's WebKit based web browser by visiting their previously prepared webpage.
Firefox, Android, and Windows Phone 7 were scheduled to be tested during day 2, but the security researchers that had been chosen for these platforms did not attempt any exploits. Sam Thomas had been selected to test Firefox, but he withdrew stating that his exploit was not stable. The researchers that had been chosen to test Android and Windows Phone 7 did not show up.
Day 3
No teams showed up for day three. Chrome and Firefox were not hacked.
Contest 2012
For 2012 the rules were changed to a capture-the-flag style competition with a point system. The new format caused Charlie Miller, successful at the event in past years, to decide not to attend.
At Pwn2Own, Chrome was successfully exploited for the first time. VUPEN declined to reveal how they escaped the sandbox, saying they would sell the information. Internet Explorer 9 on Windows 7 was successfully exploited next. Firefox was the third browser to be hacked using a zero day exploit.
Safari on Mac OS X Lion was the only browser left standing at the conclusion of the zero day portion of pwn2own. Versions of Safari that were not fully patched and running on Mac OS X Snow Leopard were compromised during the CVE portion of pwn2own. It should be noted that significant improvements in the security mitigations within Mac OS X were introduced in Lion.
Controversy with Google
Google withdrew from sponsorship of the event because the 2012 rules did not require full disclosure of exploits from winners, specifically exploits to break out of a sandboxed environment and demonstrated exploits that did not "win". Pwn2Own defended the decision, saying that it believed that no hackers would attempt to exploit Chrome if their methods had to be disclosed. Google offered a separate "Pwnium" contest that offered up to $60,000 for Chrome-specific exploits. Non-Chrome vulnerabilities used were guaranteed to be immediately reported to the appropriate vendor. Sergey Glazunov and a teenager identified as "PinkiePie" each earned $60,000 for exploits that bypassed the security sandbox. Google issued a fix to Chrome users in less than 24 hours after the Pwnium exploits were demonstrated.
Contest 2013
Google returned as a sponsor and the rules were changed to require full disclosure of exploits and techniques used. Web browsers Google Chrome, Internet Explorer and Firefox, along with Windows 8 and Java, were exploited.
French security firm VUPEN has successfully exploited a fully updated Internet Explorer 10 on Microsoft Surface Pro running a 64-bit version of Windows 8 and fully bypassed Protected Mode sandbox without crashing or freezing the browser. The VUPEN team then exploited Mozilla Firefox, Adobe Flash, and Oracle Java .
Nils and Jon from MWRLabs were successful at exploiting Google Chrome using WebKit and Windows kernel flaws to bypass Chrome sandbox and won $100,000.
George Hotz exploited Adobe Acrobat Reader and escaped the sandbox to win $70,000. James Forshaw, Joshua Drake, and Ben Murphy independently exploited Oracle Java to win $20,000 each.
Apple Safari on Mountain Lion was not targeted as no teams showed up.
Mobile Pwn2Own 2013
The Mobile Pwn2Own 2013 contest was held November 13–14, 2013, during the PacSec 2013 Conference in Tokyo, Japan.
Pinkie Pie won $50,000. Google released Chrome updates on 14 Nov to address the vulnerabilities exploited.
Contest 2014
At Pwn2Own 2014, VUPEN successfully exploited fully updated Internet Explorer 11, Adobe Reader XI, Google Chrome, Adobe Flash, and Mozilla Firefox on a 64-bit version of Windows 8.1, to win a total of $400,000—the highest payout to a single competitor to date. The company used a total of 11 distinct zero-day vulnerabilities.
Nico Joly of the VUPEN team—was the sole competitor to take on Windows Phone (the Lumia 1520) this year, entering with an exploit aimed at IE 11 mobile. He was successfully able to exfiltrate the cookie database; however, the sandbox held and he was unable to gain full control of the system.
Apple Safari on Mac OS X Mavericks and Adobe Flash on Windows 8.1 were successfully exploited by Liang Chen of Keen Team and Zeguang Zhao of team509. They collected $140,000 in prize money.
Internet Explorer 11 on Windows 8.1 was successfully exploited by Sebastian Apelt and Andreas Schmidt for a prize of $100,000.
Mozilla Firefox was exploited by Jüri Aedla, Mariusz Młyński, and George Hotz each independently, winning $50,000 each.
An anonymous participant exploited Google Chrome; however, upon review contest judges declared this a partial win due to one portion of the presentation’s collision with a vulnerability exploited earlier in the week in the Pwnium competition.