With the infamous PWN2OWN contest drawing ever closer, the heat is ramping up. This year’s instalment pitches Apple’s Safari (on the Mac), Google’s Chrome, Internet Explorer 8, and Firefox (all on Windows 7) against one another, while also allowing crackers to take on mobile platforms. Last year’s winner, Charlie Miller, who won by cracking Mac OS X within minutes last year, says Safari on the Mac will be the first to fall.
“It’s an easy target,” Miller stated, “Apple’s products are really friendly to users, and Safari is designed to handle anything, including all kinds of file formats. With a lot of functionality comes the increased chance of bugs. The more complex software is, the less secure it is.” He also added that what makes Safari an even more attractive target is the fact that it runs on Mac OS X, which he states lacks several security features that Windows Vista and Windows 7 do have, such as address space randomisation. “Put Safari atop Mac OS X, and the target’s too good to pass up,” he said.
Miller also said that he believes Internet Explorer 8 and Firefox will survive the contest unscathed. He is not sure about Google’s Chrome, since he’s not too familiar with the browser, but he believes it won’t be cracked either.
Miller is not some random cracker – he has an impressive list of exploits he has uncovered, such as the first exploit on the iPhone, just weeks after its launch, as well as the first one on Google’s Android platform. As such, he will also take a stab at the mobile part of the contest, which pits Symbian, the iPhone, Windows Mobile, Android, and Blackberry against one another. He didn’t say which platform he’d target, but my guess is it would be either Android or the iPhone, seeing his past successes on these platforms.
The PWN2OWN contest will start March 18. Each uncovered exploit in the browser contest will raise 5000 USD, while the mobile contest will raise 10000 USD. Whether or not Miller’s predictions come true remains to be seen, but his track record proves he knows what he’s talking about. While I generally like the PWN2OWN contest, I do have to wonder why they chose Windows 7 – it’s in beta, after all. Sadly, it’s not possible to create a level playing field by using the latest Snow Leopard seed.