Bigger Payouts for Browser Ownage at CanSecWest 2011

The organizers of the Pwn2Own hacking competition taking place at CanSecWest are expecting to see an even greater interest from security researchers this year as the cash prizes have increased.

"[...] We've upped the ante this time around and the total cash pool allotted for prizes has risen to a whopping $125,000 USD," announces Aaron Portnoy, the manager of HP TippingPoint’s security research team.

HP TippingPoint is providing $105,000, while Google has added another $20,000 for the person who manages to crack its Chrome browser first.

The contestants will have three days, March 9, 10 and 11, to try and exploit a vulnerability in the latest release candidates of Internet Explorer, Apple Safari, Mozilla Firefox and Google Chrome, that will allow them to execute code on the system.

The target browsers will be installed on laptops running 64-bit versions of Windows 7 or OS X which the winners will be able to keep.

The laptops are a Sony Vaio running Windows 7, an Alienware m11x running Windows 7 and an Apple MacBook Air 13'' running Mac OS X Snow Leopard.

There is also a Google CR-48 laptop running ChromeOS, but this will only serve as prize for whoever manages to hack the Google Chrome browser.

The prize for hacking IE, Safari or Firefox, in addition to the laptop, includes $15,000, Silver standing in the Zero Day Initiative (ZDI) system with 20,000 reward points, 15% more money and % more reward points for all ZDI vulnerability submissions in 2011 and paid travel and registration expenses for the DEFCON hacker conference in Las Vegas.

A Google Chrome hack will earn the winner $20,000 and the CR-48 laptop and involves escaping the sandbox through a vulnerability in Google-written code.

The contest will also cover smartphone hacking with prizes similar to the ones for the IE, Firefox and Safari hacks. The target/prize devices are Dell Venue Pro running Windows Phone 7, iPhone 4 running iOS, Blackberry Torch 9800 running Blackberry 6 OS and Nexus S running Android.