Pwn2Own targets mobiles

Powered by SC Magazine
 

Attacks mat require little user interaction to steal data.

HP will launch a hacking contest where participants will be awarded for compromising mobile devices.

Based on the Pwn2Own contest, which is held at the CanSecWest conference in Vancouver, this will be held at EUSecWest in Amsterdam in September.

HP said that this will be specifically geared at the mobile device industry, with prizes of up to $US200,000 offered to the first researcher in each category to successfully compromise a device via a mobile web browser, Near Field Communication (NFC), SMS  cellular baseband.

HP said that the primary goal is to demonstrate the current security posture of the most prevalent mobile technologies in use today, and competitors will be able to use a radio frequency (RF) enclosure to conduct the ‘attacks' without violating local laws.

To enter, contestants can pre-register by email at zdiAThp.com. On-site registration will still be available if the targets have not been compromised and if the required hardware and software prerequisites are available. Each contestant will have a 30-minute time slot in which to complete their attempt (not including time to set up the network or device prerequisites).

A successful attack against these devices must require little or no user interaction and must compromise or exfiltrate useful data from the phone. Any attack that can incur cost upon the owner of the device (such as silently calling long-distance numbers, eavesdropping on conversations and so forth) is within scope.

To avoid interfering with licensed carrier networks, all RF attacks must be completed within the provided RF isolation enclosure and the vulnerabilities utilised in the attack must be a zero-day.

ZDI (Zero Day Initiative) reserves the right to determine what constitutes a successful attack and all vulnerabilities revealed by contest winners will be disclosed to affected vendors through HP's Zero Day Initiative.

Winners will receive the device itself, a BlackBerry PlayBook courtesy of RIM and the prize money is $US100,000 for the cellular baseband compromise; $US40,000 each for the SMS and NFC compromises and $US20,000 for the mobile web browser attack.

Also awarded is 20,000 ZDI reward points, automatically qualifying the winner for silver standing, to include a one-time $US5,000 cash payment, 15 per cent monetary bonus on all ZDI submissions over the next calendar year, a 25 per cent reward point bonus on all ZDI submissions over the next calendar year and paid travel and registration to attend the 2013 DefCon in Las Vegas.

This article originally appeared at scmagazineuk.com

Copyright © SC Magazine, UK edition


Pwn2Own targets mobiles
Tags
 
 
 
Top Stories
IBM denies plans to cut 112k jobs
But admits to further restructuring.
 
ATO investigates 25 tech giants in tax hunt
Prepared to take tax evaders to court.
 
Immigration, Customs restructure IT leadership
Customs CIO promoted into transformation role.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Franchisees, here's something you should know about
Jan 23, 2015
You need to know the Code if you are a franchisee or franchisor as the penalties are significant.
Xero users rejoice! Quoting has finally arrived
Jan 23, 2015
It has taken years, but Xero has at last added integrated quoting to its online accounting software.
You can now get a no-contract wi-fi tablet from Telstra
Jan 17, 2015
Telstra has began selling wi-fi tablets out of contract without paying extra for cellular ...
Get your business ready for 2015: mobile payments
Jan 2, 2015
These handy apps from MYOB, Xero and others can reduce your administrative load and improve ...
Xero prepares for key feature coming in 2015
Dec 19, 2014
Xero users will be able to track how their business is comparing to other Xero users.
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  36%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  9%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 3003

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 954

Vote