Pwn2Own targets mobiles

Powered by SC Magazine
 

Attacks mat require little user interaction to steal data.

HP will launch a hacking contest where participants will be awarded for compromising mobile devices.

Based on the Pwn2Own contest, which is held at the CanSecWest conference in Vancouver, this will be held at EUSecWest in Amsterdam in September.

HP said that this will be specifically geared at the mobile device industry, with prizes of up to $US200,000 offered to the first researcher in each category to successfully compromise a device via a mobile web browser, Near Field Communication (NFC), SMS  cellular baseband.

HP said that the primary goal is to demonstrate the current security posture of the most prevalent mobile technologies in use today, and competitors will be able to use a radio frequency (RF) enclosure to conduct the ‘attacks' without violating local laws.

To enter, contestants can pre-register by email at zdiAThp.com. On-site registration will still be available if the targets have not been compromised and if the required hardware and software prerequisites are available. Each contestant will have a 30-minute time slot in which to complete their attempt (not including time to set up the network or device prerequisites).

A successful attack against these devices must require little or no user interaction and must compromise or exfiltrate useful data from the phone. Any attack that can incur cost upon the owner of the device (such as silently calling long-distance numbers, eavesdropping on conversations and so forth) is within scope.

To avoid interfering with licensed carrier networks, all RF attacks must be completed within the provided RF isolation enclosure and the vulnerabilities utilised in the attack must be a zero-day.

ZDI (Zero Day Initiative) reserves the right to determine what constitutes a successful attack and all vulnerabilities revealed by contest winners will be disclosed to affected vendors through HP's Zero Day Initiative.

Winners will receive the device itself, a BlackBerry PlayBook courtesy of RIM and the prize money is $US100,000 for the cellular baseband compromise; $US40,000 each for the SMS and NFC compromises and $US20,000 for the mobile web browser attack.

Also awarded is 20,000 ZDI reward points, automatically qualifying the winner for silver standing, to include a one-time $US5,000 cash payment, 15 per cent monetary bonus on all ZDI submissions over the next calendar year, a 25 per cent reward point bonus on all ZDI submissions over the next calendar year and paid travel and registration to attend the 2013 DefCon in Las Vegas.

This article originally appeared at scmagazineuk.com

Copyright © SC Magazine, UK edition


Pwn2Own targets mobiles
Tags
 
 
 
Top Stories
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
The CISO’s dilemma: Do you trust your partner’s partner?
[Blog post] How far down the chain do you check?
 
Microsoft confirms Australian Azure launch
Available from next week.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Do you direct debit customers? Read this
Oct 10, 2014
Authorities have been targeting direct debit practices with iiNet and Dodo receiving formal ...
Optus expands 4G coverage
Oct 10, 2014
If you rely on an Optus phone for work you might be interested to know that there are now 200 ...
Microsoft Office is now free for some charities
Oct 10, 2014
Microsoft has announced that eligible Australian non-profit organisations and charities can now ...
Vodafone lights up 4G in Adelaide
Oct 9, 2014
Live and work in Adelaide? Vodafone has switched on its 4G network in the city and suburbs.
Next year tradies will be able to take payments using ingogo
Oct 3, 2014
Ingogo is going to provide a card payment service for Xero users.
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  25%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  22%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 300

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  58%
 
No
  42%
TOTAL VOTES: 113

Vote