At this week's Pwn2Own hacking contest, the iPhone, Safari, Internet Explorer 8 and Firefox browsers were all taken down within minutes. Vincenzo Iozzo and Ralf-Philipp Weinmann took down the iPhone browser in under five minutes, and left with $15,000 in prize money. Weinmann is most notorious for being part of a team that cracked WEP Wi-Fi security in 2007, faster than was previously recorded. ...
Read full articleOriginally posted by Run4two:Well I would say if these guys are cracking IE, firefox, and the iphone they most likely got good enough jobs already but who knows.
How much is the knowledge of a good exploit worth to these major companies? It seems the monetary awards aren't close to the value. Are these truly the best exploits out there? One would think the prize should be something outside the box, a 2 yr. minimum contract working in the security and piracy division of these companies at a decent salary.
Originally posted by Josipher:They are all the same speed on the machines I use. The only difference is add-ons and site compatibility.
Go Chrome!!!
fanboyish i know but i simply love how fast this thing is ^^
Originally posted by wealldoit:Well seen as Opera only has a 2% market share they probably didn't think it was worth it.
So we can assume the fastest and finest Windows browser ever -OPERA- wasn't even in the contest. Why not? Couldn't TippingPoint and Pwn2Own even scratch Opera's paintwork? Or was this 'contest' a glorified commercial for Google Chrome?
Quote:
There are bugs in Chrome but they’re very hard to exploit. I have a Chrome vulnerability right now but I don’t know how to exploit it. It’s really hard. They’ve got that sandbox model that’s hard to get out of. With Chrome, it’s a combination of things — you can’t execute on the heap, the OS protections in Windows and the Sandbox.
Originally posted by ville30:
The reason why Chrome is taking longer is that it is a new browser. The hackers have far more experience dealing with the other browsers whose architecture has changed very little over the years.
Originally posted by john_swan:And that is exactly what every programmer (group) does, including those at MS. It's still an impossibility to release completely secure code, and you know that to be true if you work(ed) for a s'ware group. Sure there are ways to test the code and eliminate extraneous or wobbly code, but you can never close holes that are yet to be discovered. As long as code is written, it can, and Will be broken.
You determine the source code with the most defects then rewrite the code.
Our software group implemented hundreds of bug fixes and new features but reduced the lines of code in the process. We used static analysis of our source code to find software defects yet to be discovered. We removed source code to support features never released to custommer because project was cancelled while still in engineering. We removed thousands of patches that were never needed because a software engineer did not understand how the microprocessor worked.
Subscribe to AfterDawn's weekly newsletter.
