Zitat von 2k4u

Hat er als Laptop ein MacBook Air bekommen? Dann würde ich mich nämlich nur über die 10000$ freuen

Zitat von Nivek

Nice !

Im Text unterm Titel steht "10.000 Euro", obwohl es 10.000 Dollar sein sollten .

Zitat von ionee

Nicht ganz richtig... angeblich hat er eine Lücke in Safari ausgenutzt um den Inhalt einer Datei auf der Festplatte auszulesen. Ob die lücke auch in Safari für Win vorhanden ist soll nicht bekannt sein.

Zitat von LivingDeadDoll

Kommt davon wenn alles immer bunter, schneller, besser sein mus

Zitat von VNPeter

Kann ja sein das er das zuhause "vorgefertigt" hat.

Zitat von sTyle

Ich glaube kaum dass er den Exploit in 2 Minuten entdecken konnte und dann ausnutzte, da hat er sicher länger im Vorfeld danach gesucht.. etwas irreführend zu sagen er hätte das ding in 2 minuten gehackt .. finde ich

Zitat von CanSecWest

Rules

1. Attacks remain confidential until prize is claimed

Players will connect to the targets with a crossover cable and we will
not record the network traffic or log anything other than what is done
by default.

Successful exploits can be delivered directly to Tipping Point after the
we verify that you control the target.

In the event that internet connectivity is required (eg. IM clients)
we will put the target online behind a firewall. We won't sniff at the
firewall, but we can make no guarentees for upstream networks. (so be
careful what you send over the Internet!)

2. No wireless attacks in the conference area

Players with intent to use wireless attacks must inform us in advance.
We will relocate to a secluded, undisclosed location where there won't
be dozens of people watching the traffic.

3. One attacker per target at a time

As is obvious from rule #1 and rule #2, one player gets exclusive access
to any target at one time.

4. Players take turns, no hogging the targets

Players are limited to 30 minutes per attempt. We will mercilessly
disconnect your cable at the end of each attack slot. Be fast!
We will reboot the targets before each session begins.

5. First come, first served access to targets.

Players get in line for their turns and may take an unlimited number
of turns. If a player runs out of time and no one else is waiting for
access to the target he may continue for another turn. Players may not
have more than 1 turn in any 30 minute period. (That means we won't
reboot a target any time you feel like it)

6. Remote, pre-authentication attacks are required to win

Players may not physically touch the targets or look at the target's
display. Players are required to demonstrate to our satisfaction that
arbitrary code runs on the target.

7. Attackers control the default route for the target.

Players may become the target's default gateway in order to perform man
in the middle attacks.

8. Contest officials visit attacker web servers

Players may direct us to visit a web server running on the player's
computer. Players may specify which browser to use.

Keep the URL reasonable. We're not going to type weird addresses in.
Once we hit enter that's it. We will not click on any links.

9. Contest officials read email from attackers

Autopreview (Preview panes, etc) is enabled on mail readers, but we will
not click on links contained therein or open attachments.

10. Contest officials will add attackers on IM and read their messages.

They will not click on links or open file transfers.

11. Client Application list:

The fully patched client-side applications that qualify for a prize includes:

. Adobe PDF
. Adobe Flash
. Microsoft Silverlight
. Microsoft Internet Explorer
. Microsoft Outlook/Outlook Express
. Firefox
. Safari
. iChat
. Apple Mail
. Skype
. Adium
. Pigdin
. Kmail
. Thunderbird
. AOL, Yahoo!, and MSN official IM clients
. Java/JRE

Other software may be added to this list at our discretion of if we
deem it represents a significant attack target on normal internet
clients at large.

12. Winning exploits must be true 0day.

They may not have already been submitted to the affected vendor or
to third parties.

13. Each machine will be secured to common industry best practices:

We'll get Andrea Barisani from our Hardening Linux Dojo (which still
has seats available to look over the Ubuntu machine, and the
Microsoft/iSec/Core DTF folks to secure the Windows box, and Josh
Ryder our local Mac zealot to look at the OSX wafer.

Special Thanks:

-LTC Ron Dodge, USMA, for agreeing to be in the hot seat as the judge.
-The folks at 3com Tipping Point ZDI for helping out.
-The folks at White Wolf Security for assistance in the design, prep, and
running the challenge.