Pwn2Own is a computer hacking contest held annually at the CanSecWest security conference, beginning in 2007[1]. Contestants are challenged to exploit widely used software and mobile devices with previously unknown vulnerabilities. Winners of the contest receive the device that they exploited and a cash prize. The name "Pwn2Own" is derived from the fact that contestants must "pwn" or hack the device in order to "own" or win it. The Pwn2Own contest serves to demonstrate the vulnerability of devices and software in widespread use while also providing a checkpoint on the progress made in security since the previous year.
The first contest was conceived and developed by Dragos Ruiu in response to his frustration with Apple's lack of response to the Month of Apple Bugs and the Month of Kernel Bugs[2], as well as Apple's television commercials that trivialized the security built into the competing Windows operating system[3]. At the time, there was a widespread belief that, despite these public displays of vulnerabilities in Apple products, OS X was significantly more secure than any other competitors[4].
On March 20th, roughly three weeks before CanSecWest that year, Ruiu announced the Pwn2Own contest to security researchers on the DailyDave mailing list[1]. The contest was to include two MacBook Pros that he would leave on the conference floor hooked up to their own wireless access point. Any conference attendee that could connect to this wireless access point and exploit one of the devices would be able to leave the conference with that laptop. There was no monetary reward. Ruiu further outlined that there would be progessively loosened restrictions on what hacks were acceptable over the three days of the conference.
On the first day of the conference, Ruiu asked Terri Forslof of the Zero Day Initiative (ZDI) to participate in the contest. ZDI is widely known within the security industry for their program which purchases zeroday vulnerabilities, reports them to the affected vendor and then turns them into signatures for their network intrusion detection system, thereby increasing its effectiveness. The vulnerabilities sold to ZDI are made public only after the affected vendor has issued a patch that fixes it[5]. After a conversation with Ruiu, Forslof agreed to have ZDI offer to purchase any vulnerabilities used in the contest for a flat price of $10,000[6].
The first contest was intended to highlight the insecurity of Apple's Mac OS X operating system since, at the time, there was a widepsread belief that OS X was far more secure than its competitors[4]. The contest took place from Thursday, April 18 to Saturday, April 20th, 2007.
Two MacBook Pro laptops, one 15" and one 17", were left on the conference floor at CanSecWest and joined to a separate wireless network. Only certain attacks were allowed and these restrictions were progressively loosened over the three days of the conference[4].
- Day 1: Remote attacks only. Contestants must join the wireless network and perform their attacks without user interaction.
- Day 2: Browser attacks included. Contestants could send a link to the contest e-mail address, which an organizer would click on from one of the contest laptops.
- Day 3: Local attacks included. Contestants could insert a USB stick or attempt to communicate with the contest laptops over Bluetooth.
In order to win the 17" MacBook Pro, contestants would be required to further escalate their privileges to root after gaining access with their initial exploit.
After the $10,000 prize was announced by ZDI and the laptops were not hacked on the first day, Shane Macaulay called up former co-worker Dino Dai Zovi in New York and urged him to compete in the second day[7]. Starting on Thursday night, Dai Zovi found and exploited a previously unknown vulnerability in a Quicktime library loaded by Safari by 3am that night [8]. The following morning, Dai Zovi packaged up his exploit code and sent it to Macaulay at the conference in Vancouver[9]. Macaulay placed Dai Zovi's exploit code on a website and e-mailed the contest organizers a link to it. When clicked on the contest laptop, Dai Zovi's exploit code allowed Shane to take control of the laptop, winning the contest by proxy for Dai Zovi. As a thank you for helping him win the contest, Dai Zovi let Macaulay keep the 15" MacBook Pro. Dai Zovi separately sold the vulnerability to ZDI for the $10,000 prize[10].
After the successful 2007 contest, the scope of the Pwn2Own contest was expanded to include a wider array of operating systems and browsers in 2008. The contest would demonstrate the widespread insecurity of not only Apple products, but of all software in widespread use by consumers[11]. Dragos refined the contest with the help of a wide panel of industry experts and the contest was administered by ZDI, who would again offer to purchase the vulnerabilities after their demonstration[12]. As with all the vulnerabilities that ZDI purchases, the details of the vulnerabilities used in Pwn2Own would be provided to the affected vendors and public details would be withheld until a patch was made available[5]. Pwn2Own 2008 took place from Thursday, March 26th to Saturday, March 28th, 2008[12].
In the 2008 contest, there were three different target laptops each running the default installation of either Windows Vista Ultimate SP1, OS X 10.5.2, and Ubuntu Linux 7.10[11]. As in the previous year's contest, Pwn2Own took place over the course of three days and only certain attacks were allowed on each day [12].
- Day 1: Remote attacks only. Contestants must join the same network as the target laptop and perform their attack without user interaction and without authentication.
- Day 2: Browser and IM attacks included. Contestants could send a link to the contest e-mail address, which an organizer would click on from one of the contest laptops. The organizers would also sign into and receive IMs from the default, vendor-supplied IM client.
- Day 3: Third party client applications included. Contestants could target popular third-party software, such as Adobe Reader and Flash, Sun Java, and Microsoft Silverlight to win the contest.
Mutliple winners per target were allowed, but only the first contestant to exploit each laptop would get to keep it. All contestants who successfully demonstrated exploits at the contest could sell their vulnerabilities to ZDI for prizes of $20,000 on the first day, $10,000 on the second day, and $5,000 on the third day[11].
The laptop running OS X was exploited on the second day on the contest with an exploit for the Safari browser co-written by Charlie Miller, Jake Honoroff and Mark Daniel of Independent Security Evaluators. Their exploit targeted an open-source subcomponent of the Safari browser[13][14]. They won the MacBook Air laptop and submitted the vulnerability they discovered to ZDI for a $10,000 prize.
The laptop running Windows Vista SP1 was exploited on the third day of the contest with an exploit for Adobe Flash co-written by Shane Macaulay, Alexander Sotirov, and Derek Callaway[15][16]. They won the Fujitsu U810 laptop and submitted the vulnerability they discovered to ZDI for a $5,000 prize. After the contest, Adobe disclosed that they had co-discovered the same vulnerability internally and had been working on a patch at the time of Pwn2Own[17].
The laptop running Ubuntu was not exploited.
After having considerably more success targeting web browsers than any other category of software, the third Pwn2Own focused specifically on popular browsers used on consumer desktop operating systems. Additionally, it added another category of mobile device targets which contestants were challenged to hack via many different remote attack vectors including email, SMS messages, and website browsing. Pwn2Own 2009 took place over the three days of CanSecWest from Thursday, March 18 to Saturday, March 20, 2009[18][19].
The browser targets were Internet Explorer 8, Firefox, and Chrome installed on a Sony Vaio running Windows 7 Beta and Safari and Firefox installed on a MacBook running Mac OS X. All browsers were fully patched and in their default configuration as of the first day of the contest. Like in previous years, the contest progressively expanded the attack surface that contestants were allowed to exploit over three days[20].
- Day 1: Contestants must target functionality built into the default browser without access to any plugins. No attacks against browser plugins or other 3rd party software were allowed.
- Day 2: Adobe Flash, Sun Java, Microsoft .NET, and Apple Quicktime were included. Contestants could exploit the indicated third party software.
- Day 3: Other popular third party plugins were included. Contestants could exploit applications like Adobe Reader to win the contest.
Mutliple winners per target were allowed, but only the first contestant to exploit each laptop would get the keep it. All contestants who successfully demonstrated exploits at the contest would be offered $5,000 for the underlying vulnerabilities by ZDI[20].
The mobile device targets included BlackBerry, Android, iPhone, Symbian and Windows Mobile phones in their default configurations. The specific devices included:
As with the browser contest, the attack surface available to contestants was progessively expanded over three days[20].
- Day 1: Device can receive SMS, MMS, and e-mail but messages will not be read. Wifi (if on by default), Bluetooth (if on by default), and radio stack are also in-scope.
- Day 2: SMS, MMS, and e-mail will be opened and read. Wifi turned on. Bluetooth turned on and paired with a nearby headset (additional pairing disallowed).
- Day 3: One level of user interaction with the default applications.
In order to prove that they were able to successfully compromise the device, contestants had to demonstrate they could collect sensitive data from the mobile device or incur some type of financial loss from the mobile device owner [20].
Mutliple winners per device were allowed, but only the first contestant to exploit each mobile device would get the keep it (along with a one year phone contract). All contestants who successfully demonstrated mobile device exploits at the contest would be offered $10,000 for the underlying vulnerabilities by ZDI[20].
Based on the number of people that expressed an interest in competing this year, ZDI arranged for a random selection process to determine which team went first against each target[20].
On the first day of the contest, the first contestant to be selected was Charlie Miller. He exploited Safari on OS X without the aid of any browser plugins[21]. In interviews after winning the contest, Miller stressed that while it only took him minutes to run his exploit against Safari it took him many days to research and develop the exploit he used[22]. Miller won the MacBook Air as well as $5,000 for reporting his vulnerability to ZDI[23].
Continuing the random drawing on the first day of the contest, a researcher identified only by Nils was selected to go after Miller. Nils successfully ran an exploit against Internet Explorer 8 on Windows 7 Beta without the aid of any browser plugins, winning the Sony Vaio laptop and promising his vulnerability to ZDI for $5,000. In writing this exploit, Nils had to bypass an array of new anti-exploitation mitigations that Microsoft had implemented in Internet Explorer 8 and Windows 7, including Data Execution Protection (DEP) and Address Space Layout Randomization (ASLR) [23][24].
After exploiting Internet Explorer, Nils elected to continue trying his luck with the other browsers before giving up his time slot. Although Miller had already exploited Safari on OS X, Nils exploited this platform again and claimed an additional $5,000 prize from ZDI[23][25].
After exploiting Safari, Nils moved on to Firefox and again exploited this platform without the aid of any browser plugins. This final exploit by Nils brought his total one-day take to $15,000 and one laptop[23][26].
Near the end of the first day, Julien Tinnes also had successfully exploited Firefox and Safari, though his efforts fell outside the rules of the contest for unspecified reasons and he did not collect any prizes for his efforts[23].
The second and third days of the contest did not attract any additional contestants. Chrome, as well as all of the mobile devices, went unexploited in Pwn2Own 2009 [27].
The Competition started at March 24, 2010 and had a total cash prize pool of US$100,000.[28] On March 15—nine days before the contest was to begin—Apple released sixteen patches for WebKit and Safari.[29]
$40,000 of the $100,000 are reserved for web browsers, where each target is worth $10,000.[28]
- Microsoft Internet Explorer 8 on Windows Vista
- Mozilla Firefox 3 on Windows Vista
- Google Chrome 4 on Windows Vista
- Apple Safari 4 on Mac OS X Snow Leopard
- Microsoft Internet Explorer 8 on Windows XP
- Mozilla Firefox 3 on Windows XP
- Google Chrome 4 on Windows XP
- Apple Safari 4 on Mac OS X Snow Leopard
$60,000 of the total $100,000 cash prize pool is allotted to the mobile phone portion of the contest, each target is worth $15,000.[28]
- Charlie Miller successfully hacked Safari 4 on Mac OS X.[30]
- Peter Vreugdenhil exploited Internet Explorer 8 on Windows 7[30] by using two vulnerabilities that involved bypassing ASLR and evading DEP.
- Nils hacked Firefox 3.6 on Windows 7 64-bit[30] by using a memory corruption vulnerability and bypass ASLR and DEP. Mozilla patched the security flaw in Firefox 3.6.3.[31]
- Ralf-Philipp Weinmann and Vincenzo Iozzo hacked the iPhone 3GS[30] by bypassing the digital code signatures used on the iPhone to verify that the code in memory is from Apple.
The Opera web browser was left out of the contests as a target: The ZDI team argues that Opera has a low market share and that Chrome and Safari are only included "due to their default presence on various mobile platforms". However, Opera's rendering engine, Presto, is present on millions of mobile platforms.[32][33][34][35]
The 2011 contest took place between March 9 until 11th during the CanSecWest conference in Vancouver, Canada.[36]
The web browser targets for the 2011 contest included Microsoft Internet Explorer, Apple Safari, Mozilla Firefox, and Google Chrome. New to the Pwn2Own contest was the fact that a new attack surface was allowed for penetrating mobile phones, specifically over cellphone basebands. The mobile phone targets were Dell Venue Pro running Windows Phone 7, iPhone 4 running iOS, BlackBerry Torch 9800 running BlackBerry OS 6.0, and Nexus S running Android 2.3.
The following teams registered for the desktop browser contest:
- Apple Safari: VUPEN, Anon_07, Team Anon, Charlie Miller
- Mozilla Firefox: Sam Thomas, Anonymous_1
- Microsoft Internet Explorer: Stephen Fewer, VUPEN, Sam Thomas, Ahmed M Sleet
- Google Chrome: Moatz Khader, Team Anon, Ahmed M Sleet
For the mobile browser category, the following teams registered:
- Apple iPhone: Anon_07, Dion Blazakis and Charlie Miller, Team Anon, Anonymous_1, Ahmed M Sleet
- RIM Blackberry: Anonymous_1, Team Anon, Ahmed M Sleet
- Samsung Nexus S: Jon Oberheide, Anonymous_1, Anon_07, Team Anonymous
- Dell Venue Pro: George Hotz, Team Anonymous, Anonymous_1, Ahmed M Sleet
During the first day of the competition Safari and Internet Explorer were defeated by researchers. Safari was version 5.0.3 installed on a fully patched Mac OS X 10.6.6.[37] French security firm VUPEN was first to attack the browser, and five seconds after the browser visited its specially crafted malicious web page, it had both launched the platform calculator application (a standard harmless payload to demonstrate that arbitrary code has been executed) and written a file to the hard disk (to demonstrate that the sandbox had been bypassed).
The second and last browser to fall for the day was a 32-bit Internet Explorer 8 installed on 64-bit Windows 7 Service Pack 1.[37] Security researcher Stephen Fewer of Harmony Security was successful in exploiting IE. Just as with Safari, this was demonstrated by running Windows' calculator program and writing a file to the hard disk.
In day 2 the iPhone 4 and Blackberry Torch 9800 were both exploited. Security researchers Charlie Miller and Dion Blazakis were able to gain access to the iPhone's address book through a vulnerability in Mobile Safari by visiting their exploit ridden webpage. The iPhone was running iOS 4.2.1, however the flaw exists in version 4.3 of the iOS.[38]
Vincenzo Iozzo, Willem Pinckaers, and Ralf Philipp Weinmann were successful in exploiting the Blackberry Torch 9800. The team took advantage of a vulnerability in the Blackberry's WebKit based web browser by visiting their previously prepared webpage. The phone was running BlackBerry OS 6.0.0.246.[38]
Firefox, Android, and Windows Phone 7 were scheduled to be tested during day 2, but the security researchers that had been chosen for these platforms did not attempt any exploits. Sam Thomas had been selected to test Firefox, but he withdrew stating that his exploit was not stable. The researchers that had been chosen to test Android and Windows Phone 7 did not show up.[38]
No teams showed up for day three. Chrome and Firefox were not hacked.
For 2012 the rules were changed to a capture-the-flag style competition with a point system.[39] The new format caused Charlie Miller, successful at the event in past years, to not attend.[40]
At Pwn2Own, Chrome was successfully exploited for the first time. VUPEN declined to reveal how they escaped the sandbox, saying they would sell the information.[41] Internet Explorer 9 on Windows 7 was successfully exploited next.[42] Firefox was the third browser to be hacked using a zero day exploit.[43]
Google withdrew from sponsorship of the event because the 2012 rules did not require full disclosure of exploits from winners, specifically exploits to break out of a sandboxed environment and demonstrated exploits that didn't "win."[40] Pwn2Own defended the decision, saying that it believed that no hackers would attempt to exploit Chrome if their methods had to be disclosed.[40] Google offered a separate "Pwnium" contest that offered up to $60,000 for Chrome specific exploits. Non-Chrome vulnerabilities used were guaranteed to be immediately reported to the appropriate vendor.[40] Sergey Glazunov and a teenager identified as "PinkiePie" each earned $60,000 for exploits that bypassed the security sandbox.[44][45] Google issued a fix to Chrome users in less than 24 hours after the Pwnium exploits were demonstrated.[46]
- ^ a b Ruiu, Dragos (March 20, 2007). "PWN to OWN (was Re: How Apple orchestrated web attack on researchers)". http://seclists.org/dailydave/2007/q1/289. Retrieved April 1, 2012.
- ^ Naraine, Ryan (February 1, 2007). "Mac Developer mulling OS X equivalent of ZERT". https://www.zdnet.com/blog/security/apple-bumper-patch-vindicates-moab-mokb-hackers/124. Retrieved April 1, 2012.
- ^ Orchant, Marc (February 6, 2007). "Cancel or Allow? Good poke at Vista UAC". https://www.zdnet.com/blog/orchant/cancel-or-allow-good-poke-at-vista-uac/343. Retrieved April 1, 2012.
- ^ a b c Naraine, Ryan (March 26, 2007). "How long can a Mac survive the hacker jungle?". https://www.zdnet.com/blog/security/how-long-can-a-mac-survive-the-hacker-jungle/137. Retrieved April 1, 2012.
- ^ a b "About the Zero Day Initiative". http://www.zerodayinitiative.com/about/. Retrieved April 1, 2012.
- ^ Forslof, Terri (May 3, 2007). "Apple issues patch for QuickTime flaw". http://dvlabs.tippingpoint.com/blog/2007/05/03/apple-issues-patch-for-quicktime-flaw. Retrieved April 1, 2012.
- ^ Goodin, Dan (20 April 2007). "Safari zero-day exploit nets $10,000 prize". Vancouver: The Register. http://www.theregister.co.uk/2007/04/20/pwn-2-own_winner/. Retrieved 10 April 2010.
- ^ "Apple QTJava toQTPointer() Pointer Arithmetic Memory Overwrite Vulnerability". http://www.zerodayinitiative.com/advisories/ZDI-07-023/. Retrieved 31 March 2012.
- ^ Naraine, Ryan (April 23, 2007). "10 questions for MacBook hacker Dino Dai Zovi". ZDNet. http://www.zdnet.com/blog/security/10-questions-for-macbook-hacker-dino-dai-zovi/176. Retrieved 16 November 2010.
- ^ Vaas, Lisa (April 20, 2007). "Mac Hacked Via Safari Browser in Pwn-2-Own Contest". eWeek. http://securitywatch.eweek.com/apple/mac_hacked_via_safari_browser_in_pwn2own_contest.html. Retrieved March 10, 2011.
- ^ a b c Forslof, Terri (March 19,2008). "CanSecWest PWN to OWN 2008 (updated)". http://dvlabs.tippingpoint.com/blog/2008/03/19/cansecwest-pwn-to-own-2008. Retrieved April 1, 2012.
- ^ a b c Ruiu, Dragos (March 20, 2008). "CanSecWest 2008 PWN2OWN - Mar 26-28". http://seclists.org/dailydave/2008/q1/138. Retrieved April 1, 2012.
- ^ "Apple Safari WebKit PCRE Handling Integer Overflow Vulnerability". April 16,2008. http://www.zerodayinitiative.com/advisories/ZDI-08-022/. Retrieved April 1, 2012.
- ^ "PWN to OWN Day Two: First Winner Emerges! (updated)". March 27, 2008. http://dvlabs.tippingpoint.com/blog/2008/03/27/day-two-of-cansecwest-pwn-to-own---we-have-our-first-official-winner-with-picture. Retrieved April 1, 2012.
- ^ "Adobe Flash Player DeclareFunction2 Invalid Object Use Vulnerability". April 8, 2008. http://www.zerodayinitiative.com/advisories/ZDI-08-021/. Retrieved April 1, 2012.
- ^ "PWN to OWN: Final Day (and another winner!)". March 28, 2008. http://dvlabs.tippingpoint.com/blog/2008/03/28/pwn-to-own-final-day-and-wrap-up. Retrieved April 1, 2012.
- ^ Kebbel-Wyen, John (April 4, 2008). "Adobe Product Security Incident Response Team (PSIRT) Blog / CanSecWest 2008 Pwn2Own Contest". http://blogs.adobe.com/psirt/2008/04/cansecwest_2008_pwn2own_contes_1.html. Retrieved April 1, 2012.
- ^ Forslof, Terri (25 Feb 2009). "Pwn2Own 2009". Digital Vaccine Laboratories. TippingPoint. http://dvlabs.tippingpoint.com/blog/2009/02/25/pwn2own-2009. Retrieved 11 April 2010.
- ^ Ruiu, Dragos (February 15, 2009). "CanSecWest 2009 Speakers and Dojo courses (Mar 14-20)". http://seclists.org/dailydave/2009/q1/54. Retrieved April 1, 2012.
- ^ a b c d e f Ruiu, Dragos (March 18, 2009). "PWN2OWN Final Rules". http://web.archive.org/web/20091102212354/http://cansecwest.com/. Retrieved April 1, 2012.
- ^ "Apple OS X ATSServer Compact Font Format Parsing Memory Corruption Vulnerability". May 13, 2009. http://www.zerodayinitiative.com/advisories/ZDI-09-023/. Retrieved April 1, 2012.
- ^ Foresman, Chris (March 27, 2009). "Pwn2Own winner says Macs are more safe, though less secure". Ars Technica. http://arstechnica.com/apple/news/2009/03/pwn2own-winner-says-macs-are-more-safe-though-less-secure.ars. Retrieved 11 April 2010.
- ^ a b c d e Forslof, Terri (March 18, 2009). "Pwn2Own 2009 Day 1 - Safari, Internet Explorer, and Firefox Taken Down by Four Zero-Day Exploits". http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits. Retrieved April 1, 2009.
- ^ "Microsoft Internet Explorer 8 Rows Property Dangling Pointer Code Execution Vulnerability". June 10, 2009. http://www.zerodayinitiative.com/advisories/ZDI-09-041/. Retrieved April 1, 2012.
- ^ "Apple Safari Malformed SVGList Parsing Code Execution Vulnerability". May 13, 2009. http://www.zerodayinitiative.com/advisories/ZDI-09-022/. Retrieved April 1, 2012.
- ^ "Mozilla Firefox XUL _moveToEdgeShift() Memory Corruption Vulnerability". March 30, 2009. http://www.zerodayinitiative.com/advisories/ZDI-09-015/. Retrieved April 1, 2012.
- ^ Forslof, Terri (March 21, 2009). "Pwn2Own Wrap Up". http://dvlabs.tippingpoint.com/blog/2009/03/21/pwn2own-wrap-up. Retrieved April 1, 2012.
- ^ a b c Portnoy, Aaron (15 Feb 2010). "Pwn2Own 2010". TippingPoint. http://dvlabs.tippingpoint.com/blog/2010/02/15/pwn2own-2010. Retrieved 10 April 2010.
- ^ "About the security content of Safari 4.0.5". Apple Inc. 15 March 2010. http://support.apple.com/kb/HT4070. Retrieved 4 May 2010.
- ^ a b c d Mills, Elinor (March 24, 2010). "iPhone, Safari, IE 8, Firefox hacked in CanSecWest contest" (in Vancouver). CNet. http://news.cnet.com/8301-27080_3-20001126-245.htmlno. Retrieved 10 April 2010.
- ^ "Mozilla Foundation Security Advisory 2010-25 - Re-use of freed object due to scope confusion". Mozilla. April 1, 2010. http://www.mozilla.org/security/announce/2010/mfsa2010-25.html. Retrieved 10 April 2010.
- ^ "Opera Mini reaches important milestone — Crosses 50 million active users". Opera Software ASA. February 12, 2010. http://www.opera.com/press/releases/2010/02/12_2/. Retrieved 23 July 2011.
- ^ "One browser. 3000 phones.". Opera Software ASA. July 8, 2010. http://www.opera.com/press/releases/2010/07/08/. Retrieved 23 July 2011.
- ^ "One hundred million". Opera Software ASA. February 10, 2011. http://www.opera.com/press/releases/2011/02/10/. Retrieved 23 July 2011.
- ^ "Opera reaches (another) 100 million users". Opera Software ASA. April 7, 2011. http://www.opera.com/press/releases/2011/04/07/. Retrieved 23 July 2011.
- ^ Announcing Pwn2Own 2011, TippingPoint Digital Vaccine Laboratories Blog
- ^ a b http://arstechnica.com/security/news/2011/03/pwn2own-day-one-safari-ie8-fall-chrome-unchallenged.ars
- ^ a b c http://arstechnica.com/security/news/2011/03/pwn2own-day-2-iphone-blackberry-beaten-chrome-firefox-no-shows.ars
- ^ Pwn2Own 2012 Rules
- ^ a b c d Ryan Naraine, Charlie Miller skipping Pwn2Own as new rules change hacking game, ZDnet, March 7, 2012
- ^ Pwn2Own 2012: Google Chrome browser sandbox first to fall, ZDnet, March 7, 2012
- ^ IE 9, on most secure Windows yet, next browser to fall at hacker contest, Ars Technica, March 8, 2012
- ^ Researchers hack into newest Firefox with zero-day flaw, ZDnet, March 9, 2012
- ^ Ryan Naraine, CanSecWest Pwnium: Google Chrome hacked with sandbox bypass, ZDnet, March 7, 2012
- ^ At hacking contest, Google Chrome falls to third zero-day attack
- ^ After the pwnage: Critical Google Chrome hole plugged in 24 hours, Ars Technica
|
|
|
|
|
|
|
Features
|
|
|
|
Web standards
|
|
|
|
Related topics
|
|
|
|
|
|
|
|
|
|
|
|
|
- Software no longer in development shown in italics
|
|
