• Home
  • About 404TS
  • Contact

404 Tech Support

Where IT Help is Found

  • Articles
    • Code
    • Entertainment
    • Going Green
    • Hardware, Gadgets, and Products
    • Management
    • Network
    • News
    • Operating Systems
    • Security and Privacy
    • Software
    • System Administration
    • Talking Points
    • Tech Solutions
    • Web
    • Webmaster
  • Reviews
  • Media
    • Infographics
    • Videos
  • Tech Events
  • Tools
    • How do I find my IP address?
    • Browser and plugin tests
  • Get a Technical Consultation
You are here: Home / Articles / Security and Privacy / The results of Pwn2Own 2013

The results of Pwn2Own 2013

2013-03-07 by Jason

Reporting on Pwn2Own results always proves to be a popular article and the topic is always interesting with the contest changing a little bit each year. This year’s contest is taking place over yesterday, today, and tomorrow at the CanSecWest 2013 conference. It places bounties on bugs in browsers Chrome, IE, Firefox, and Safari. This year’s twist is also allowing compromises using browser plugins in IE9 on Windows 7 for Adobe Reader XI, Adobe Flash, and Java.

The contest coordinators, HP’s DVLabs, announced yesterday that they would be buying all unique exploits that pre-registered contestants used.

The first contestant to successfully compromise a selected target wins the prizes for the category. Along with the prize money, the contestant will receive the compromised laptop and 20,000 ZDI reward points* which immediately qualifies them for Silver standing.

*Benefits of ZDI Silver standing include a one-time $5,000 USD cash payment, 15% monetary bonus on all ZDI submissions over the next calendar year, 25% reward point bonus on all ZDI submissions over the next calendar year and paid travel and registration to attend the 2013 DEFCON Conference in Las Vegas.

The categories for this year’s competition include:

  • Web Browser
    • Google Chrome on Windows 7 ($100,000)
    • Microsoft Internet Explorer, either
      • IE 10 on Windows 8 ($100,000), or
      • IE 9 on Windows 7 ($75,000)
    • Mozilla Firefox on Windows 7 ($60,000)
    • Apple Safari on OS X Mountain Lion ($65,000)
  • Web Browser Plug-ins using Internet Explorer 9 on Windows 7
    • Adobe Reader XI ($70,000)
    • Adobe Flash ($70,000)
    • Oracle Java ($20,000)

The targets will be running on the latest, fully patched version of the Windows 7, 8, and OS X Mountain Lion. All targets will be installed in their default configurations, as this is how a majority of users will have them configured. As always, the vulnerabilities utilized in the attack must be unknown and not previously reported to the vendor. If a sandbox is present, a full sandbox escape is required to win.

For more details on the contest, the full rules are available at the TippingPoint blog.

From the HP community for Pwn2Own 2013 and @thezdi Twitter accounts, yesterdays entries were all successful.

wednesday results

James Forshaw was able to exploit Java.

Joshua Drake also exploited Java.

VUPEN Security, who dominated pretty well last year, pwned IE 10 on a Microsoft Surface Pro running Windows 8.

Chrome was compromised by MWR Labs. (Brief write-up on their blog.)

Vupen Security came around for a second round of whooping to exploit Firefox and Java.

mwr chrome exploit
MWR Labs Chrome exploit.

Later today Vupen Security, George Hotz, and Pham Toan will give it a shot at demonstrating Flash, Reader, and Internet Explorer 10 exploits.

Stay tuned to this article here on 404 Tech Support and I’ll update it with new notices throughout the #Pwn2Own competition.

Update: Thursday’s contest resulted in more successful exploits.

@VUPEN just took down Adobe Flash for $70k and a grand total of $250k!

George Hotz exploited Adobe Reader XI #pwn2own “The first thing I did was break into the sandbox, the next thing I did was break out” -Hotz

@Benmmurphy was able to join those able to exploit Java.

zdi twitter feed

Filed Under: Security and Privacy

Trending

  • Malware threats to mobile devices
    In Infographics
  • A Directory on Bloatware
    In Software, Talking Points, Tech Solutions
  • Windows 10 will be free for Raspberry Pi 2
    In Hardware, Gadgets, and Products, Operating Systems

Latest Media Posts

Find Out Where To Download SNES ROMs

Find Out Where To Download SNES ROMs

Multifunctional Video Conversion Tools – Wondershare Video Converter

Multifunctional Video Conversion Tools – Wondershare Video Converter

  • Popular
  • Latest
  • Today Week Month All
  • Access to the resource [servershare] has been disallowed Access to the resource [servershare] has been disallowed
  • What is the AllJoyn Router Service on Windows 10? What is the AllJoyn Router Service on Windows 10?
  • How a DirecTV bill really works in 2015 How a DirecTV bill really works in 2015
  • Read the Event Logs on Windows Server Core Read the Event Logs on Windows Server Core
  • Increase IIS Private Memory Limit to improve WSUS availability Increase IIS Private Memory Limit to improve WSUS availability
  • How Virtual Reality Supports Mental Health Therapy How Virtual Reality Supports Mental Health Therapy
  • Key Strategies of Successful Coin Listing on Exchange Key Strategies of Successful Coin Listing on Exchange
  • Keeping Your Mac Healthy: A Comprehensive Guide to Maintenance and Troubleshooting Keeping Your Mac Healthy: A Comprehensive Guide to Maintenance and Troubleshooting
  • Making Distributed Software Development Work: Strategies and Best Practices for Managing Remote Teams Making Distributed Software Development Work: Strategies and Best Practices for Managing Remote Teams
  • customer contactless payment for drink with mobile phon at cafe counter bar,seller coffee shop accept payment by mobile.new normal lifestyle concept The Latest Innovations In Payment Technology
Ajax spinner

Elevator Pitch

404 Tech Support documents solutions to IT problems, shares worthwhile software and websites, and reviews hardware, consumer electronics, and technology-related books.

Subscribe to 404TS articles by email.

Recent Posts

  • How Virtual Reality Supports Mental Health Therapy
  • Key Strategies of Successful Coin Listing on Exchange
  • Keeping Your Mac Healthy: A Comprehensive Guide to Maintenance and Troubleshooting

Search

FTC Disclaimer

404TechSupport is an Amazon.com affiliate; when you click on an Amazon link from 404TS, the site gets a cut of the proceeds from whatever you buy. This site also uses Skimlinks for smart monetization of other affiliate links.
Use of this site requires displaying and viewing ads as they are presented.

Copyright © 2025 · Magazine Pro Theme on Genesis Framework · WordPress · Log in