Conference’s Mac Hack contest a three-way race this year.

Organizers of the CanSecWest conference happening in Vancouver next week have re-introduced their Mack Hack contest. Only this year, it’s a three-way race. Here are the rules, as explained by Dragos Rui, the conference’s organizer.

Announcing CanSecWest PWN2OWN 2008.

===================================

Three targets, all patched.  All in typical client configurations with

typical user configurations.  You hack it, you get to keep it.

Each has a file on them and it contains the instructions and how to

claim the prize.

Targets (typical road-warrior clients):

         VAIO VGN-TZ37CN running Ubuntu 7.10

         Fujitsu U810 running Vista Ultimate SP1

         MacBook Air running OSX 10.5.2

This year’s contest will begin on March 26th, and go during the

presentation hours and breaks of the conference until March 28th.

The main purpose of this contest is to present new vulnerabilities in

these systems so that the affected vendor(s) can address them.

Participation is open to any registered attendee of CanSecWest 2008.

Once you extract your claim ticket file from a laptop (note that doing

so will involve executing code on the box, simple directory traversal

style bugs are inadequate), you get to keep it. You also get to

participate in 3com / Tipping Point’s Zero Day Initiative, with the top

award for remote, pre-auth, vulnerabilities being $25k. More fine print

and details on the cash prizes are available from TippingPoint’s DVLabs

blog (http://dvlabs.tippingpoint.com/). More fine print and rules for

the contest will be found at the http://cansecwest.com/ site.

Quick Overview:

-Limit one laptop per contestant.

-You can’t use the same vulnerability to claim more than one box, if it

is a cross-platform issue.

-Thirty minute attack slots given to contestants at each box.

-Attack slots will be scheduled at the contest start by the methods

selected by the judges.

-Attacks are done via crossover cable. (attacker controls default route)

-RF attacks are done offsite by special arrangement…

-No physical access to the machines.

-Major web browsers (IE, Safari, Konqueror, Firefox), widely used and

deployed plugin frameworks (AIR, Silverlight), IM clients (MSN, Adium,

Skype, Pigdin, AOL, Yahoo), Mail readers (Outlook, Mail.app, Thunderbird,

kmail, mutt) are all in scope.

Fine Print:

These computers are REAL and FULLY patched. All third party software is

widely used. There are no imitation vulnerabilities. Any exploit

successfully used in this contest would also compromise a significant

percentage of Internet connected hosts.  Instead, players choose to use

their exploits here, at CanSecWest PWN2OWN 2008.  All successful exploits

will be turned over to the appropriate vendor and patched before details

are made public.

Rules

1. Attacks remain confidential until prize is claimed

Players will connect to the targets with a crossover cable and we will

not record the network traffic or log anything other than what is done

by default.

Successful exploits can be delivered directly to Tipping Point after the

we verify that you control the target.

In the event that internet connectivity is required (eg. IM clients)

we will put the target online behind a firewall. We won’t sniff at the

firewall, but we can make no guarantees for upstream networks. (so be

careful what you send over the Internet!)

2. No wireless attacks in the conference area

Players with intent to use wireless attacks must inform us in advance.

We will relocate to a secluded, undisclosed location to test.

3. One attacker per target at a time

As is obvious from rule #1 and rule #2, one player gets exclusive access

to any target at one time.

4. Players take turns, no hogging the targets

Players are limited to 30 minutes per attempt. We will mercilessly

disconnect your cable at the end of each attack slot. Be fast!

We will reboot the targets before each session begins.

5. First come, first served access to targets.

Players get in line for their turns and may take an unlimited number

of turns. If a player runs out of time and no one else is waiting for

access to the target he may continue for another turn. Players may not

have more than 1 turn in any 30 minute period. (That means we won’t

reboot a target any time you feel like it)

6. Remote, pre-authentication attacks are required to win

Players may not physically touch the targets or look at the target’s

display. Players are required to demonstrate to our satisfaction that

arbitrary code runs on the target.

7. Attackers control the default route for the target.

Players may become the target’s default gateway in order to perform man

in the middle attacks.

8. Contest officials visit attacker web servers

Players may direct us to visit a web server running on the player’s

computer. Players may specify which browser to use.

Keep the URL reasonable. We’re not going to type weird addresses in.

Once we hit enter that’s it. We will not click on any links.

9. Contest officials read email from attackers

Auto-preview (Preview panes, etc) is enabled on mail readers, but we will

not click on links contained therein or open attachments.

10. Contest officials will add attackers on IM and read their messages.

They will not click on links or open file transfers.

11. Client Application list:

The fully patched client-side applications that qualify for a prize includes:

.     Adobe PDF

.     Adobe Flash

.     Microsoft Silverlight

.     Microsoft Internet Explorer

.     Microsoft Outlook/Outlook Express

.     Firefox

.     Safari

.     iChat

.     Apple Mail

.     Skype

.     Adium

.     Pigdin

.     Kmail

.     Thunderbird

.     Evolution

.     mutt

.     AOL, Yahoo!, and MSN official IM clients

.     Java/JRE

Other software may be added to this list at our discretion of if we

deem it represents a significant attack target on normal internet

clients at large.

12. Winning exploits must be true 0day.

They may not have already been submitted to the affected vendor or

to third parties.

13. Each machine will be secured to common industry best practices.

We’ll get Andrea Barisani from our Hardening Linux Dojo (which still

has seats available 🙂 to look over the Ubuntu machine, and the

Microsoft/iSec/Core DTF folks to secure the Windows boxes, and Josh

Ryder our local Mac zealot to look at the OSX wafer.

Special Thanks:

-LTC Ron Dodge, USMA, for agreeing to be in the hot seat as the judge.

-The folks at 3com Tipping Point ZDI for helping out.

-The folks at White Wolf Security for assistance in the design, prep,

 and running the challenge.

–Robert McMillan