Pwn2Own: Why are Software Vendors Responsible for Security?

By +Dietrich Schmitz

(tap tap....is this mic on?)

Windows 8 (x86) Security
A veritable leaking collander.

Each year Pwn2Own comes, I think about the current state of Vendor software development.

So far as I can tell, several hackers have succeeded in pawning Windows Legacy (x86).  And from my perspective security should not be part of the responsibility of third-party software developers, that is, to bolster their applications with security sandboxes.

No, this is a complete diversion from the real, ongoing, old story.  Microsoft's Windows 8 Legacy (x86) suffers from and inherits the circa 2000 WinNT kernel replete with all of its attendant security woes-- Windows is a collander.

Read More

Pwn2Own 2013 Begins Today: Release the Hounds!

By +Dietrich Schmitz

The annual CanSecWest Conference begins today.  As has been tradition each year, a Pwn2Own contest will commence and run through Friday, March 8, 2013.

Hackers come each year to claim cash and other prizes for providing a successful 'proof of concept' exploit (crack) which demonstrates the ability to gain administrative control (system root) , of a given configured device running one of several browsers: Google Chrome, Mozilla Firefox, Apple Safari.

Read More

Untouchable ChromeOS: Can the Pwn2Own 2013 Hackers Crack It?

By Dietrich T. Schmitz

It's time for the annual CanSecWest 2013 conference this week.  Each year, a Pwn2Own Contest is held to challenge Hackers (Black Hats) to find a way around the security of Browsers running on Microsoft Windows and Apple OSX hardware.

The newest entry in this challenge is Google's ChromeOS Samsung 550 Series 5 Laptop.  This is a first for Linux.  Google's confidence and swagger is evident with a prize purse of $3.14M (pi) awaiting any hacker who can provide a proof of concept exploit which succeeds in penetrating what Google claims is the world's safest operating system.

Read More

ChromeOS in the House at CanSecWest Pwn2Own 2013

Let it not be said that Linus Torvalds has any difficulty getting his point across.  We have witnessed his sharp, caustic, sometimes quite harsh 'shock jock' exchanges with both awe and respect many times over.

Charlie wins Apple via pwn2own (Photo credit: ggee)

Very recently, a 'chit chat' was had regarding SecureBoot routines possibly becoming part of the Linux Mainline Kernel which was met with a strong rebuttal from Linus who made it clear in no uncertain terms--no secureboot signing code in the kernel will ever happen.   NEVER!

Recalling another incident, a few years back, and this one is a 'classic', Linus Torvalds wrote:

Read More