Pwn2Own and Pwnium 3 Details Announced – Competitions Offer Big Bucks for Hacking Skills

Jan 31, 2013

Amber Ankerholz

HP’s Zero Day Initiative (ZDI) announces details for the annual Pwn2Own competition.

Pwn2Own 2013 will be held at the CanSecWest security conference March 6-8 in Vancouver, BC. This year, HP ZDI is offering rewards for vulnerabilities and exploitation techniques in the following categories.

Web browsers:

Google Chrome on Windows 7 (US$ 100,000)
Microsoft Internet Explorer – either IE 10 on Windows 8 (US$ 100,000) or IE 9 on Windows 7 (US$ 75,000)
Mozilla Firefox on Windows 7 (US$ 60,000)
Apple Safari on OS X Mountain Lion (US$ 65,000)

Web browser plugins using Internet Explorer 9 on Windows 7:

Adobe Reader XI (US$ 70,000)
Adobe Flash (US$ 70,000)* Oracle Java (US$ 20,000)

Also this year, Google worked with ZDI on the Pwn2Own rules and will be underwriting a portion of the winnings. According to the Chromium blog, the new rules enable “a contest that significantly improves Internet security for everyone.”
Additionally, Google has announced another competition – Pwnium 3 – with rewards totaling up to US$ 3.14159 million for vulnerabilities in Chrome OS. The categories and reward for this competition are:

US$ 110,000 for a browser- or system-level compromise in guest mode or as a logged-in user, delivered via a web page.
US$ 150,000 for a compromise with device persistence – guest to guest with interim reboot, delivered via a web page.

“The attack must be demonstrated against a base (WiFi) model of the Samsung Series 5 550 Chromebook, running the latest stable version of Chrome OS. Any installed software (including the kernel and drivers, etc.) may be used to attempt the attack,” according to the Chromium blog.

Related content

Insecure Candidates: Chrome Wins Hacking Contest

At the CanSecWest Vancouver 2009 conference's PWN2OWN hacker's competition the Safari, Internet Explorer 8 and Firefox browsers were successfully hacked to run code on their systems. The Chrome browser was recognized as being the least impacted by the hackers.

more »
With and Not Against: Canonical Collaborates on Chrome OS

The Chrome OS announcement caused speculation from many sides as to what effect the Google platform would have on other Linux distros. At least Canonical could benefit from it.

more »
Competition Announced: Calling all Firefox Mobile Add-on Developers

Firefox announces a competition designed to educate and reward the mobile add-on developer community.

more »
Linux Chrome with Gtk+: Cross-Platform Complication

If Google were to use Qt, things would be much simpler and Chrome would have a unified interface under Windows, Linux and Mac OS X. But Google isn't satisfied with Qt.

more »
Google Chrome Ready For Business

Google announced that Chrome is ready for business and the wait to deploy Chrome and Google Apps for Business is over.

more »