What, no Opera hacking? I'm disappointed...

Not to mention chrome? I also dont like the sound of sitting on bugs for 12 months just for the order of a contest... Oh well, these are man made projects

I heard you can get up to five quid for an Opera exploit on the black market.

So this guy's been sitting on a bug for nigh on a year in order to get his 15 minutes of fame, rather than doing the decent thing and passing it on to the manufacturer?!

He clearly thought that he was the only one smart enough to find this vuln, and not disclosing it for such a ridiculously long amount of time would be perfectly safe.

Technical knowledge, combined with hubris and monumental stupidity. Fantastic mixture.

How much did Opera software pay to not get included in that list?

Shame they didn't include Opera.

I can't help but wonder if it's because it's not open source? How many of these clever hackers spend months looking through the source code of webkit and mozilla looking for flaws, before turning up and seemingly finding a hole within hours? IE is closed sources, but it's from the evil beast and the percesption is that it's the worst browser for security right now, so they can hardly leave that out of the test.

It's not as if Opera doesn't have a few security holes occasionally, but it's surely easier to find them when it's open source.

And there's no mention of Chrome either, with it's fancy architecture that's supposed to stop problems in one tab affecting the rest of the browser.

Perhaps they left out the difficult ones?

Checking the tipping point website shows that no computers using linux are involved.... must be because ubuntu made them cry last time. Before the usual wha, wha, linux is not that popular to be exploited. The via laptop is running Windows 7?!!!!! How many have that. At least microcrud is consistent. You exploites will still be compatible with their new OS.

Wonder if a deal was done to keep linux out of the picture so that there would be no headlines of linux not being exploitable.

I run both Windows and OSX on my PC's so I have no axe to grind, but seriously this is a pointless contest as the "contestants" are using bugs they discovered months or years ago and didn't tell anyone, just so they could show how clever they are, Clever would be telling the OS providers so they could fix the problem before innocent people get hacked, cos these numpties didn't tell anyone about the bug in question.

Any software is hackable, end of story, and particularly if you can get the operator to install the hack!

Operas market share is so insignificant it's not worth their time bothering to try and hack it.

Back when it was attack the os it was as exciting as wathcing the grass grow with 500,000 attempts and no progress at hacking. They had to make it easy and picked the large surface attack vector of browsers. All browsers will fall as they have the most hostile environment and job parsing good and bad html and ecmascript and all sorts of nasties.

The contest is now lame and reeks of easy low hanging fruit discoveries that are kept private soley for the chance to score a free computer and money in as little time as possible.

-1 for the sham the contes has degraded itself to

What about opera? i'm sure it's used by enough people to be considered and exploited in the competition, or is it just too damn good muhahaha...

I'll just get my coat.

...no browsers running on Linux - too tough? Would have been nice to see at least.

"The challenge was enough to motivate him to dust off a separate Safari bug he had been sitting on for more than 12 months for this year's competition"

and thought that this guy was pretty irresponsible for sitting on this for over a year instead of notifying the powers that be?

http://cansecwest.com/ says they have only the following combinations running:

Vaio - Windows 7

- IE8

- Firefox

- Chrome

Macintosh

- Safari

- Firefox

Pity. I would have liked to see how my browser of choice, Opera, would have survived. However, I realise that Chrome has twice Opera's market share.

...which browser has the highest number of exploitable flaws?

Tim R

Paris because she has had all her flaws exploited

The second, and perhaps much more interesting part of this contest, is how quickly the various maintainers get patches out to fix the identified bugs...

Desktop OS hacking like last year. Would have been nice

to watch the penguin shame them all again.

Pervert!

people saying words to the effect of 'shame on nils for sitting on a bug for 12 months' should realize that 'nils' is not a professional security researcher and might have better things to do than give free bug reports to Apple/Moz/MS. If he finds a bug, he is under no obligation to report it -- if he wants to make it his personal plaything, that's up to him.

I usually either work around bugs or use a different program -- I have a job to do and I don't always have the time to file reports. Usually, once I've figured out the workaround, the bug gets forgotten and I go back to my job. However if some contest came up and said "hey, you can make some dough if you further explore and exploit that bug you found a year back," depending on how hard up for cash I was, it might grab my attention.

A contest like this is to give folks like 'nils' incentive to develop a workable exploit (not the same as discovering the bug) and come forward. It also gives these bugs a higher profile than they might otherwise have had (especially when reporting to the 'Queen of Denial' ... not sure if that refers to Apple or MS this week, but either way if my bug report vanishes in to the 'ether' and can't be properly tracked, I'm much less inclined to give them the benefit of my free quality control.)

Mine's the one with the chip on the shoulder.

to be honest, it was better of him to sit on it for a year than sell it to the underworld for $100k - yes, the exploit may have been found by someone else during the year and he should have told Apple but i return to my first point.

my wifes PC has had 2 attempted web hacks in the past week - the 'general internet' is getting filled with dodgy exploit and javascript laden sites, false redirects etc. I'd estimate that 70% of sites out there are infected and dodgy now. This competition highlights my usual 'use firefox rather than IE' is becoming a weaker protection layer too. IE with all security settings 100% on and firefox with noscript etc etc are handy stepping stones but its a sad day when the best browsing platform

to use is a VM session that can be 0wned and then reloaded started from scratch when that happens :-(

What a lot of peeps here use Opera - I might give it a look...

Course here's another way of looking at the competition.

Sell your exploit to a few blackhats.

Given a bit of time the secret will get out and they're using your exploit without paying you.

Develop a new exploit, but the blackhats all have a perfectly good working one and so don't want to pay.

Your nasty old exploit that has long since ceased paying out.

Give your exploit to some grad student as a way to look good and get some cash to fund the studies (likely enough into the next exploit, which he may feel indebted enough to share with you) and let him win the competition. Doesn't really matter if he does or not.

Nasty old exploit becomes public domain and gets closed.

Black hats have to pay top dollar again for the new one.

Repeat next year at a different hacking contest so as not to raise suspicion.

"the mantle of most stupid user ever in addition to that of uber hacker"

Fair point, but I always like to say that social engineering works much better on victims who have social skills...

I found a bug in Opera, reported it twice and had no acknowledgement either time. The bug was still there last time I checked. Not a security issue, but why bother having a bug list in the first place?

Perhaps, I am a bit pessimistic, but I have a feeling that reporting bugs leads to no response at all, or a text saying the bug is well known and very very non critical or the police will search your house and confiscate your computers .

Dan, please. As a security professional Charlie should hide bugs he knows about because he has clients and deadlines to meet? What, like everyone else, you mean?

This is why the black hats manage to get away with remote exploits for so long, because people with Charlie's mentality give them carte blanche to do so. The black hats aren't going to publish the keys to the kingdom. It helps if the supposed white hats do, for the security of all. If they don't give a shit unless they're getting a laptop out of it then we've got a problem ...

Perhaps you don't realise how many security products are based on open source tools and o/s? If everyone involved in open source had that attitude no security products would exist at all.

> To break Lynx? Thought not :)

I bet there was plenty worn there though!!!

"...no browsers running on Linux - too tough? Would have been nice to see at least."

uhh... correct me if I'm wrong, the contest is to exploit security vulnerabilities in the BROWSER not the OS.