When you think of those evil genius types who can hack into internet applications or just about anything with an electronic brain, you envision dark shadowy creatures. But at a security conference in Vancouver called CanSecWest, a brilliant technique for taking all that pent up genius for hacking and putting it to work to help technology rather than exploit it has been found. The conference lured the shadowy hackers out of the shadows to put their skills on display with a simple trick – a contest.
The contest is called Pwn2Own and it is sponsored each year by 3Com TippingPoint. The concept is so simple, it is ingenious. Hackers will compete on who can break into targets that are either smart phones or internet browsers and the ones who are successful win big bucks! Even hackers have a soft spot in their hearts for big bucks and the thrill of showing off their skills with a challenge appeals to those evil genius egos that drive hackers to hack.
This year’s Pwn2Own put the best of the best in hacking skills up against some of the cutting edge technology in the smart phone world including the Nokia, the Droid and the Blackberry smart phones. If the creators of these high profile technologies are a little nervous, they have a right to be. Past contests have seen hackers crack open allegedly "impervious" technologies like Internet Explorer and Apple’s Mac OS X. In fact, last year a hacker "owned" the Mac OS in less than 5 minutes and took home a $5000 prize for his efforts.
When a hacker can break open your application and leap past your security without even breaking a sweat, that reveals some serious holes in your security work. But not all technologies give up as easily. Last year, five smart phones that were assaulted by the best hackers in the business fought them off and frustrated their efforts to crack their security walls. Just letting these evil genius hackers try to crack your system is a gamble. But when your security wins the battle, that has to make a technology developer feel pretty good.
This is a smart type of gamble to take. While a participating technology developer might be out a few thousand dollars if they lose, the agreement with the hackers is that they would turn over all of their secret knowledge so the technology can be made safer and less open to hacking in the future. The cost of that prize money is a small investment compared to the lost sales and extra costs that would hit a company if a very public hack made a product that was already in the hands of the public unsafe to use. The stampede away from your product because of that kind of hack can hurt a company badly.
On top of the value of getting expert help with finding security holes, this kind of contest gives bragging rights to the technologies that stand up to the hackers and refuse to be hacked. Just think what great commercials for a smart phone or an internet product could be made if they were proven in a wide open challenge like Pwn2Own that their security could not be beat.
This is a brilliant way to use the devious minds of hackers to make products safer and harder to overpower once they hit the market. Way to go Pwn2Own for turning all of that evil genius from the dark side to the good side of The Force.


#1 by dave on March 10, 2010 - 8:33 am
Maybe we should encourage our developers to follow the same approach. When they write some code, ask them to try and break it and pay them a salary to do so.
Oh. We do