Pwn2Own contest puts US$75,000 bounty on VMware Workstation bypass

Bad timing for users after VMware laid off Workstation developers in January

The Pwn2Own hacking contest will return in March, pitting researchers against the most popular browsers and operating systems. The novelty: Contestants can win a US$75,00 prize for escaping a VMware virtual machine.

Contestants will be able to exploit Microsoft Edge or Google Chrome on fully patched versions of 64-bit Windows 10 and Apple Safari on OS X El Capitan. System or root-level privilege escalation pays extra, as does escaping from the virtual machine.

Every year, Pwn2Own, at the CanSecWest security conference, has slightly modified rules, and 2016 is no different. Adobe Reader, Mozilla Firefox and Internet Explorer are no longer on the contest's target list. Adobe Flash remains, but only the version that comes bundled with Microsoft Edge.

Exploiting Google Chrome or Microsoft Edge will earn hackers $65,000, while exploiting Apple Safari on Mac only $40,000. Achieving system-level access on Windows or root access on Mac OS X would add another $20,000 to the final payout.

The significant prize differences between Chrome, Edge and Safari exploits might stem from protections on Windows offered by the Microsoft Enhanced Mitigation Experience Toolkit (EMET).

EMET is a tool, primarily aimed at businesses, that applies various exploit mitigation technologies to applications that otherwise lack them. This adds additional complexity and significant hurdles for exploit developers.

On top of that, the Windows environment will run as a guest OS in a virtual machine created with VMware Workstation. Breaking out of the virtual machine is not mandatory, but those who do so will earn an additional $75,000.

Potential vulnerabilities in Workstation would not be good news for VMware, which laid off most of its developers working on the product in January. The company said at the time that its computing virtualization products like Workstation and Fusion have reached maturity and will play a decreasing role in its business.

Pwn2Own has been historically organized by security appliance maker TippingPoint, a division of Hewlett Packard that also runs the Zero Day Initiative, a vulnerability acquisition program. However, because Trend Micro entered into an agreement to acquire TippingPoint in October, this year's Pwn2Own will be sponsored by both Hewlett Packard Enterprise and Trend Micro.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Father’s Day Gift Guide

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?