Apple Thoughts - News & Reviews on all things Apple

"Virtually every major browser and operating system were targets at this week's "Pwn2Own" hacking contest, with Apple Safari, Mozilla Firefox, and Internet Explorer 8 vulnerabilities exploited, along with flaws in the iPhone OS."

Once again, first day of competition and Safari along with Internet Explorer 8 and Firefox all failed to foil the hackers. A pair from Germany was also able to get access to a non-jailbroken iPhone to run unauthorized code and unlock the iPhone for use on unapproved carriers. You can read more about it at the CanSecWest site. Luckily they only reveal how they do it to the software companies so they can put in a fix. 

"In a repeat performance of last year, security researcher Charlie Miller arrived at the CanSecWest conference this week with a prepared exploit to use in cracking Safari running on Mac OS X. Unsurprisingly, Miller was able to use his exploit to immediately win the event's "Pwn2Own" contest, generating headlines that suggested that Macs are inherently less secure, despite the fact that every browser involved in the contest failed on the first day."

Ouch. Safari falls first again, although this doesn't say how long he worked on his "exploit" of Safari before the competition began. I'd call for an umpires ruling since that seems like cheating, but how can you really call it cheating when it is a hacking competition?

"The Pwn2Own hacking contest, held during the CanSecWest Security Conference in March, will pit hackers against browsers from Microsoft, Apple, Mozilla and Google. The hackers will also have a chance to "pwn" an iPhone as well as other mobile devices."

TippingPoint's Zero Day Initiative (ZDI) team is sponsoring the contest for the 3rd consecutive year. They are going to officer $5,000 USD for each browser hack and $10,000 USD for each mobile hack. The contest will be held during the CanSecWest Security Conference from March 16th through March 20th in Vancouver, BC.

Last year it was a Macbook Air that was hacked on day two by exploiting a Safari Browser security flaw, the winner took home $10,000 USD. Guess that isn't such a big deal anymore so they dropped the bounty!