
I was waiting for a work order at the office while I was browsing over some forum sites. It was just recently last March 26-28, 2008 that
CanSecWest held its annual PWN2OWN contest. The name of the game is simple. Any registered attendee of CanSecWest 2008 can participate as a contestant. One contestant, one machine and hack at least one, if not, all machines running in different operating systems. You hack the machine, and you own the machine. Basically, you "pawn" and you "own".
Here are the contest rules:
- There are three target platforms all set and installed with typical client and user configurations. Once you are able to hack it, you get to keep it. These are the target:
- VAIO VGN-TZ37CN running with Linux Ubuntu 7.10
- Fujitsu U810 running with Vista Ultimate Edition SP1
- MacBook Air running in OSX 10.5.2
- Each of these machines contains a special text file that holds the procedure in claiming another set of prize/s.
- In the contest's three-day duration. Target machines are set with higher security level. First day involves hacking only with the operating system. Then moving to the second and third day, more applications will be installed on these target machines to increase its potential security level.
- The contest was not used to exploit the performance of these platforms in terms of security. This was just to guide the vendors and buyers by addressing the vulnerability of these platforms.
Throughout the whole duration of this contest and with over 400 participants, two (2) persons emerged to successfully pawn these machines with one laptop each. These are in the name of Shane McCauley and Charlie Miller winning the MacBook Air and Windows Vista respectively.
MacBook Air was hacked first in this contest with just
two minutes upon the start of the contest. This was done by utilizing some loopholes that the hacker found within the Safari Web Browser. Every thing was set in the first day and was successfully hacked on the second minute of the second day after applying user interaction with an email opened in Safari.
Second hacked was the Vista Ultimate Edition SP1. It was in some hours after the start of the second day when Vista's system was successfully dominated. It was through the Java software installed in the system. It was some in flaw of the Java-Windows combination that allowed this attack to succeed.
And the last man or the last "system" standing was the Linux System having been surviving multiple attacks from 400 hackers. There were some bugs found in the Ubuntu Linux operating system but the attendees did not want to work in making the exploit code for such bug.
With this, I leave you with your own critiques in lieu with these operating system platforms. It might impress or it might depress.
More detailed information can be found on these links:
http://cansecwest.com/post/2008-03-20.21:33:00.CanSecWest_PWN2OWN_2008http://channel9.msdn.com/ShowPost.aspx?PostID=393788#393788http://apple.slashdot.org/apple/08/03/28/0126221.shtml