The Pwn2Own 2010 Contest

The Pwn2Own 2010 organized by DVlabs was over. But there are some interesting information to share.
(Extract from "10 Lessons From The Pwn2Own Hacker Contest")


Google Chrome the Most Secured?

"The only browser that survived Pwn2Own this year was Google Chrome. This led to numerous news reports like this one suggesting that Google's browser was somehow more secure than the others. This is far from the truth. In fact, the vulnerability that caused the iPhone's downfall was in the WebKit engine and also affected the Google Chrome browser. Chrome's sandbox was also held up as a major CanSecWest roadblock but there's already scuttlebutt circulating that at least two security researchers have found a way to break out of the Chrome sandbox. Keep in mind that the iPhone has a sandbox that didn't help much when hackers hijacked the SMS database at Pwn2Own.

Survival at the Pwn2Own contest simply means that researchers weren't motivated enough to give up their vulnerabilities/exploits in exchange for a smartphone and cash prizes. The iPhone survived in 2008, didn't it?"


IE 8 seems to be Most Protected Browser.

"Despite the survival of Google Chrome and the fall of Internet Explorer 8 (running on Windows 7), all the browser hackers at the contest maintained that Microsoft's browser is by far the most difficult to exploit. For starters, IE 8 is the only browser to fully -- and properly -- implement ASLR. Peter Vreugdenhil, the researcher behind the successful IE 8 hack, needed two different vulnerabilities and several exploitation tricks to get it to work. However, because IE is the world's most widely deployed browser, it will continue to attract the attention of hackers and malware writers. Security doesn't equate to safety."


Apple Safari still the Easiest to Hack?

"For the third year in a row, security researcher Charlie Miller successfully compromised a fully patched MacBook Pro machine with a Safari vulnerability and exploit. Despite Apple's best efforts at making it difficult to exploit the Mac OS X, Miller's exploits show that Safari is still easy pickings because it lacks the mitigations found in Microsoft Windows. For example, Safari does not implement ASLR properly and does not have a sandbox to limit the damage from a hacker attack."