Internet Gale Warning Declared for March 9-17
The sponsors of #Pwn2Own haven't learned a key lesson: when hosting a gunfight, keep the competitors happy.
Pwn2Own is a highly anticipated feature of the CanSecWest technology security conference, which opens March 9.
For those unfamiliar with Pwn2Own, it's basically a white-hat (the good guys, in web parlance) hacking contest. Contestants line-up to defeat the security of say, an unmodified iPhone or a particular web browser. If the exploit successfully allows the contestant full access to the device, the contestant wins a cash prize (or in previous years, the compromised device itself) and the exploit is kept under wraps for six months. The exploit is privately shared by the contest's sponsors with the owner of the software platform compromised giving them time to fix the security hole before its details are shared with a wider audience later in the year.
Three-year reigning winner Charlie Miller from Baltimore's Internet Security Evaluators (actually there are multiple winners, but unlike Little League Baseball not everyone wins) is so agitated by the Pwn2Own sponsors that he has threatened to unleash his latest slew of exploits into the Wild.
His points are worthy of review by the event sponsors, but for the purposes of this conversation they are irrelevant. Any of the event's competitors could unleash great harm to the Internet-using community by releasing their known exploits to the public directly.
Using these un- or under-vetted exploits, malicious hackers ("black hats" in web parlance) would find wide swaths of installed users whose computers, browsers or networks are ripe for the pickings. Security vendors such as McAfee and Norton would scramble to provide some coverage against this zero day attack, but the sheer volume of a mass attack would overwhelm their support lines even if they can provide protection, which is no sure thing.
There would likely be pockets of very unhappy computer users worldwide among both individual users and organizations unable to recover their systems quickly absent completely wiping hard drives. Data loss would be inevitable.
The reactions of the Pwn2Own sponsors over the next week are important. If they can accommodate Charlie Miller and his colleagues without compromising the competition, they may very well--as they usually do this time each year--provide more hints and tips to operating system, device and software manufacturers that lead to more secure computing.
If Pwn2Own's sponsors fail to heed the call, our most conservative readers might be wise to power down for a few days starting March 9. Just in case someone gets grumpy at the OK Corral.
