Pwnie Award Winners

Pwnie for Best Server-Side Bug

Awarded to the person who discovered the most technically sophisticated
and interesting server-side bug. This includes any software that is
accessible remotely without using user interaction.

• Linux SCTP FWD Chunk Memory Corruption
  (CVE-2009-0065)

  Credit: Wei Yongjun and sgrakkyu

  Remote kernel memory corruption vulnerabilities are rare, remote
  kernel memory corruption vulnerabilities that are reliably
  exploitable are even more rare. This vulnerability was a
  
  memory corruption
  
  in the Linux 2.6 kernel SCTP stack. After a number of the Linux
  distributions released security advisories claiming that the
  impact of this bug was only denial of service, sgrakkyu wrote an
  exploit that actually demonstrated that it was
  
  much more serious. The exploit works against vulnerable
  x86-64 hosts, disabling SELinux if necessary, and popping a
  remote connect-back shell for the attacker. Good show.

Pwnie for Best Privilege Escalation Bug

Award to the person who discovered and/or exploited the most technically
sophisticated and interesting privilege escalation vulnerability.
As more defense-in-depth systems like Mandatory Access Control and
Virtualization are deployed, privilege escalation vulnerabilities
are becoming more important. These vulnerabilities can include
local operating system privilege escalations, operating system
sandbox escapes, and virtual machine guest breakout vulnerabilities.

• Linux udev Netlink Message Privilege Escalation
  (CVE-2009-1185)

  Credit: Sebastian Krahmer

  In the midst of all the Linux kernel security debates about
  exploiting NULL function pointer dereferences, Cheddar Bay,
  transparency regarding known or potential security issues,
  Cheddar Bay, and the protection afforded by LSMs running within
  an insecure kernel, Cheddar Bay, sometimes the very simple yet
  damaging vulnerabilities don’t get nearly the attention they
  deserve. This is one such vulnerability.

  Sebastian Krahmer
  
  identified a vulnerability in udevd
  where it incorrectly assumed that messages arriving on its NETLINK
  socket would always come from the kernel. Any local
  unprivileged user may send a unicast or multicast NETLINK
  message to udevd, which it will treat as a privileged message
  from the kernel. This would allow a user to (for example)
  instruct udevd to create a /dev/random device file with chosen
  minor and major device numbers, giving RWX permissions to any
  device that the attacker chooses. That’s game over, kids.

Pwnie for Best Client-Side Bug

Awarded to the person who discovered the most technically sophisticated
and interesting client-side bug. These days, ‘client’
is pretty much synonymous with ‘web browser’, but don’t forget
about all the media player integer overflows!

• msvidctl.dll MPEG2TuneRequest Stack buffer overflow
  (CVE-2008-0015)

  Credit: Ryan Smith and Alex Wheeler

  At first glance, this bug may appear to just be yet-another
  vulnerability in an ActiveX component. Easily exploited
  vulnerabilities in ActiveX components typically lead to malware
  outbreaks all over the Interwebs and that’s exactly what
  happened with this one. But ActiveX component bugs are hardly
  the stuff that Pwnie Awards are made of. As more people begin
  to
  research this vulnerability, it became clear that the
  vulnerability was not in the ActiveX component’s code, but
  instead in the ATL code (IPersistStreamInit::Load) staticly
  built into it. Oh, snap. It’s a kill-bit bloodbath out there.

  As this vulnerability had begun to be exploited in the wild
  prior to its scheduled patch release, it conveniently
  became eligible for this year’s Pwnie Awards. Don’t let its CVE
  number fool you, this wasn’t one of last year’s bugs. Microsoft was
  sitting on this vulnerability for somewhere around 16 months.

Pwnie for Mass 0wnage

Awarded to the person who discovered the bug that resulted in the most
widespread exploitation or affected the most users. Also known as ‘Pwnie for Breaking the
Internet.’

• Red Hat Networks Backdoored OpenSSH Packages
  (CVE-2008-3844)

  Credit: unknown

  Shortly after Black Hat and Defcon last year, Red Hat noticed that not only had someone backdoored the OpenSSH packages that some of their mirrors were distributing, but managed to sign the packages with Red Hat’s own private key. Instead of revoking the key and releasing all new packages, they instead just updated the backdoored packages with clean copies, still signed by the same key, and released a shell script to scan for the MD5 checksums of the affected packages. What makes this eligible for the “mass0wnage” award is that nobody is quite sure how many systems were compromised or what other keys and packages the attackers were able to access. With very little public information available, the real casuality was the public’s trust in the integrity of Red Hat’s packages.

Pwnie for Best Research

Awarded to the person who published the most interesting and
innovative research in the form of a paper, presentation, tool or
even a mailing list post.

• 
  From 0 to 0day on Symbian

  Bernhard Mueller

  This comprehensive and well presented guide to Symbian vulnerability research
  covers the entire process from analyzing Symbian OS, to
  reversing, debugging, and fuzzing bugs out of it. And just for
  good measure, he shook out 14 crashes from the Symbian Media
  Player. Overall, an excellent documentation of vulnerability
  discovery on Symbian.

Lamest Vendor Response

Awarded to the vendor who mishandled a security vulnerability most
spectacularly.

• Linux

  Continually assuming that all kernel memory
  corruption bugs are only Denial-of-Service

  The Linux kernel development team was nominated several times over
  for their ongoing lack of handling of bugs of “unknown
  impact” and generally assuming that all
  
  kernel memory corruption
  issues are only Denial-of-Service issues. Here’s a hint: Just
  because you can only get a DoS from a bug, doesn’t mean that
  skilled
  hackers
  can’t get a
  
  root shell out of it.
  

Pwnie for Most Overhyped Bug

Awarded to the person who discovered a bug resulting in the most hype on
the Internets and in the mainstream media. Bonus points for bugs that turn
out to be impossible to exploit in practice. Also known as ‘Pwnie for
Pwning the Media.’

• MS08-067 Server Service NetpwPathCanonicalize() Stack Overflow
  (CVE-2008-4250)

  Discovered by: Anonymous

  Notice the intention cross-nomination of this vulnerability.
  The worm taking advantage of this vulnerability, Conficker, had
  been a mainstay in the trade press for at least half of the
  year. Also known as the InfoSec Press Full Employment Act of
  2009.

Pwnie for Best Song

What kind of awards ceremony does not have an award for best
song? There is strangely enough a long tradition of
hacker-written songs and raps (parodies and originals). And in Pwnies
past, we somehow coerced HD and Halvar to rap some of these. And
rather then let it become anyone else’s turn, we have a new rule.
Nominations for ‘Best Song’ must actually have audio. For your
listening pleasure, the nominees are:

• Nice Report

  Doctor Raid

  This is your career on life support (whaaat?)
  
  and we’re not white hats tryin to write reports
  
  any box can be popped with the right resource
  
  so your threat model’s worthless, NICE REPORT
  

Pwnie for Most Epic FAIL

Sometimes giving 110% just makes your FAIL that much more epic. And
what use would the Internet be if it wasn’t there to document this FAIL for
all time?

This award is to honor a person or company’s spectacularly epic
FAIL.

• Twitter Gets Hacked and the “Cloud Crisis”

  Twitter

  If you live by Web 2.0, you die by Web 2.0. Storing documents in the
  “cloud” gets you ease of access, it’s cheap, it’s easy, and as long as
  you care nothing about security, it’s a no brainer. Twitter was rife
  with XSS and CSRF worms this year, which annoyed many a “securitytwit”,
  but were sideshows to its rapidly growing user-base.

  But this year Twitter learned the hard way that when your entire
  security rests in the cloud, it only takes
  
  one unused hotmail account and a bored teenager
  to get your entire business plan, all your
  employee’s personal information, and administrative access to your 55
  million dollar web application.

  According to Twitter’s top secret internal documents (now published on
  Techcrunch) “Are we building a new Internet?!?”
  Well if they are, it’s one that needs more security.

Lifetime Achievement Award

Most hackers have the personality of a supermodel who does discrete
mathematics for fun. Like mathematicians, hackers get off on solving
very obscure and difficult to even explain problems. Like models,
hackers wear a lot of black, think they are more famous than they
are, and their career effectively ends at age 30. Either way, upon
entering one’s fourth decade, it is time to put down the
disassembler and consider a relaxing job in management.

This award is to honor the previous achievements of those who have
moved on to bigger and better things such as management or owning
(in the traditional sense) a coffee shop.

• Solar Designer

  He’s credited with inventing
  
  return-into-libc,
  
  privilege separation for Unix daemons,
  and I’m just quoting his
  
  Wikipedia page. He also first
  
  demonstrated heap buffer overflow exploitation. His password
  cracker,
  
  John the Ripper, has awesome embedded into its every
  fiber, from being the first cracker to use bitslice DES
  implementations to doing brute forcing based on statistical
  frequency of characters.