Displaying items by tag: Pwn2Own

A couple of days ago we posted a story about a group of developers that complained to Valve about their lack of a Bug Bounty. In their complaint was an inference that having a form of reward would make people want to identify and report bugs and exploits in a timely manner. On the surface that would seem to make sense, but there is a flip side to this line of thinking. There will also be times when people will wait to report something to ensure they get the most money out of their efforts.

In the browser wars there is always going to be the argument over which browser is “better”. You will hear people talk about how fast, secure, cool, feature rich their favorite browser is, but in the end all of them really fall short of where they should be. Oddly enough it is Microsoft’s Internet Explorer that gets the brunt of the jokes and jabs (in many cases rightly so). However at this year’s Pwn2Own it was Mozilla’s FireFox that got tossed around like a rag doll.

Google’s previously unassailable Chrome web browser has now been hacked three times in only two days. The first two we have already told you about in a previous article. Vupen a French research company found a 0-day exploit that allowed them to jump out of Google’s Sand Box and then another that allowed them to execute arbitrary code on the OS that Chrome was installed on (in this case Windows). Vupen did this as part of the Pwn2Own competition held every year.

Although not incredibly big news it looks like Microsoft’s Internet Explorer 9 has fallen to exploits on Thursday during the Pwn2Own competition. Once again it was Vupen that managed the exploit. Interestingly enough as with Chrome it took two separate attacks to get past the security in place for IE 9. One is something that has been present in every version of Internet Explorer since IE6 and the other is a non-disclosed 0-day exploit to get past the protected mode available in IE.

The Pwn2Own completion is in full swing and this year we find that Google’s Chrome web browser is the first to fall. Google has claimed in the past that Chrome is the most secure browser (in addition to claiming it is faster). Meanwhile many IT and security experts had questioned this and are concerned about things that Chrome does when installed on an operating system. Still this is the first time the browser has fallen during the infamous competition.