CanSecWest Pwn2Own contest results

This is one I have been watching. The CanSecWest security conference featured a Pwn2Own contest, in which a set of fully patched laptops, one running OSX Leopard, another running Windows Vista and a third running a patched version of Ubuntu Gutsy Gibbon.

Day 2 saw the takedown of the OSX machine with a Safari bug, which was previously unknown. Today, the final day of the contest, the Vista box was compromised with an unknown Flash exploit. Another term for an unknown exploit is a zero-day.

Zero-day exploits are almost indefensible. This is why I preach the sermon of defense in depth. Always have defenses in place that allow you to detect intrusions, and these defenses be layered. This gives you options to thwart the attack, even if it is only to start by pulling the ethernet cable.

As for the competition, I am somewhat surprised that the OSX box, which is Unix/BSD based fell first. However, it was an application-based attack versus a core OS level compromise…

Does this make Linux invincible? Absolutely not. It does say something about closed-source versus open source  development, but there are also vulnerabilities in open source software, but there are more eyes available to look at it. We should never let our guard down, even running open source.