Pwnie Awards
Lua error in package.lua at line 80: module 'strict' not found.
The Pwnie Awards recognize both excellence and incompetence in the field of information security. Winners are selected by a committee of security industry professionals from nominations collected from the information security community.[2] The awards are presented yearly at the Black Hat Security Conference.[3]
Contents
Origins
The name Pwnie Award is based on the word "pwn", which is hacker slang meaning "to compromise" or to "control" based on the previous usage of the word "own" (and it is pronounced similarly).[3] The name "The Pwnie Awards" is meant to sound like The Tony Awards, an awards ceremony for Broadway Theater in New York City.
History
The Pwnie Awards were founded in 2007 by Alexander Sotirov and Dino Dai Zovi[2] following discussions regarding Dino's discovery of a cross-platform QuickTime vulnerability and Alexander's discovery of an ANI file processing vulnerability in Internet Explorer.
Winners
2015
- Pwnie for Most Epic FAIL: OPM - U.S. Office of Personnel Management
2014
The award for best server-side bug went to the security researchers who discovered Heartbleed, and best client-side bug went to George Hotz for finding a bug in Chrome OS.[4] The "most epic fail" award went to Apple for its goto fail bug in iOS and OS X.[4]
2013
- Best Server-Side Bug: Ruby on Rails YAML (CVE-2013-0156) Ben Murphy
- Best Client-Side Bug: Adobe Reader Buffer Overflow and Sandbox Escape (CVE-2013-0641) Unknown
- Best Privilege Escalation Bug: iOS incomplete codesign bypass and kernel vulnerabilities (CVE-2013-0977, CVE-2013-0978, CVE-2013-0981) David Wang aka planetbeing and the evad3rs team
- Most Innovative Research: Identifying and Exploiting Windows Kernel Race Conditions via Memory Access Patterns Mateusz "j00ru" Jurczyk, Gynvael Coldwind
- Best Song: "All the Things" Dual Core
- Most Epic Fail: Nmap: The Internet Considered Harmful - DARPA Inference Checking Kludge Scanning Hakin9
- Epic 0wnage: Joint award to Edward Snowden and the NSA
- Lifetime Achievement: Barnaby Jack
2012
The award for best server-side bug went to Sergey Golubchik for his MySQL authentication bypass flaw.[5][6] Two awards for best client-side bug were given to Sergey Glazunov and Pinkie Pie for their Google Chrome flaws presented as part of Google's Pwnium contest.[7][5]
The award for best privilege escalation bug went to Mateusz Jurczyk ("j00ru") for a vulnerability in the Windows kernel that affected all 32-bit versions of Windows.[5][6] The award for most innovative research went to Travis Goodspeed for a way to send network packets that would inject additional packets.[5][6]
The award for best song went to "Control" by nerdcore rapper Dual Core.[5] A new category of award, the "Tweetie Pwnie Award" for having more Twitter followers than the judges, went to MuscleNerd of the iPhone Dev Team as a representative of the iOS jailbreaking community.[5]
The "most epic fail" award was presented by Metasploit creator HD Moore to F5 Networks for their static root SSH key issue, and the award was accepted by an employee of F5, unusual because the winner of this category usually does not accept the award at the ceremony.[7][5] Other nominees included LinkedIn (for its data breach exposing password hashes) and the antivirus industry (for failing to detect threats such as Stuxnet, Duqu, and Flame).[6]
The award for "epic 0wnage" went to Flame for its MD5 collision attack,[7] recognizing it as a sophisticated and serious piece of malware that weakened trust in the Windows Update system.[6]
2011
- Best Server-Side Bug: ASP.NET Framework Padding Oracle (CVE-2010-3332) Juliano Rizzo, Thai Duong[3]
- Best Client-Side Bug: FreeType vulnerability in iOS (CVE-2011-0226) Comex[8][3]
- Best Privilege Escalation Bug: Windows kernel win32k user-mode callback vulnerabilities (MS11-034) Tarjei Mandt[8]
- Most Innovative Research: Securing the Kernel via Static Binary Rewriting and Program Shepherding Piotr Bania[8]
- Lifetime Achievement: pipacs/PaX Team[8]
- Lamest Vendor Response: RSA SecurID token compromise RSA[8]
- Best Song: "[The Light It Up Contest]" Geohot[8][3]
- Most Epic Fail: Sony[8][3]
- Pwnie for Epic 0wnage: Stuxnet[8][3]
2010
- Best Server-Side Bug: Apache Struts2 framework remote code execution (CVE-2010-1870) Meder Kydyraliev
- Best Client-Side Bug: Java Trusted Method Chaining (CVE-2010-0840) Sami Koivu
- Best Privilege Escalation Bug: Windows NT #GP Trap Handler (CVE-2010-0232) Tavis Ormandy
- Most Innovative Research: Flash Pointer Inference and JIT Spraying Dionysus Blazakis
- Lamest Vendor Response: LANrev remote code execution Absolute Software
- Best Song: "Pwned - 1337 edition" Dr. Raid and Heavy Pennies
- Most Epic Fail: Microsoft Internet Explorer 8 XSS filter
2009
- Best Server-Side Bug: Linux SCTP FWD Chunk Memory Corruption (CVE-2009-0065) David 'DK2' Kim
- Best Privilege Escalation Bug: Linux udev Netlink Message Privilege Escalation (CVE-2009-1185) Sebastian Krahmer
- Best Client-Side Bug: msvidctl.dll MPEG2TuneRequest Stack buffer overflow (CVE-2008-0015) Ryan Smith and Alex Wheeler
- Mass 0wnage: Red Hat Networks Backdoored OpenSSH Packages (CVE-2008-3844) Anonymous[2]
- Best Research: From 0 to 0day on Symbian Credit: Bernhard Mueller
- Lamest Vendor Response: Linux "Continually assuming that all kernel memory corruption bugs are only Denial-of-Service" Linux Project[9]
- Most Overhyped Bug: MS08-067 Server Service NetpwPathCanonicalize() Stack Overflow (CVE-2008-4250) Anonymous[9]
- Best Song: Nice Report Doctor Raid
- Most Epic Fail: Twitter Gets Hacked and the "Cloud Crisis" Twitter[2]
- Lifetime Achievement Award: Solar Designer[9]
2008
- Best Server-Side Bug: Windows IGMP Kernel Vulnerability (CVE-2007-0069) Alex Wheeler and Ryan Smith
- Best Client-Side Bug: Multiple URL protocol handling flaws Nate McFeters, Rob Carter, and Billy Rios
- Mass 0wnage: An unbelievable number of WordPress vulnerabilities
- Most Innovative Research: Lest We Remember: Cold Boot Attacks on Encryption Keys (honorable mention was awarded to Rolf Rolles for work on virtualization obfuscators) J. Alex Halderman, Seth Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph Calandrino, Ariel Feldman, Rick Astley, Jacob Appelbaum, Edward Felten
- Lamest Vendor Response: McAfee's "Hacker Safe" certification program[10]
- Most Overhyped Bug: Dan Kaminsky's DNS Cache Poisoning Vulnerability (CVE-2008-1447)[10]
- Best Song: Packin' the K! by Kaspersky Labs[10]
- Most Epic Fail: Debian's flawed OpenSSL Implementation (CVE-2008-0166)
- Lifetime Achievement Award: Tim Newsham
2007
- Best Server-Side Bug: Solaris in.telnetd remote root exploit (CVE-2007-0882), Kingcope[11]
- Best Client-Side Bug: Unhandled exception filter chaining vulnerability (CVE-2006-3648) skape & skywing[11]
- Mass 0wnage: WMF SetAbortProc remote code execution (CVE-2005-4560) anonymous[11]
- Most Innovative Research: Temporal Return Addresses, skape[11]
- Lamest Vendor Response: OpenBSD IPv6 mbuf kernel buffer overflow (CVE-2007-1365)[11]
- Most Overhyped Bug: MacBook Wi-Fi Vulnerabilities, David Maynor[11]
- Best Song: Symantec Revolution, Symantec
References
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 2.0 2.1 2.2 2.3 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 3.0 3.1 3.2 3.3 3.4 3.5 3.6 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 4.0 4.1 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 5.0 5.1 5.2 5.3 5.4 5.5 5.6 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 6.0 6.1 6.2 6.3 6.4 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 7.0 7.1 7.2 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 8.0 8.1 8.2 8.3 8.4 8.5 8.6 8.7 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 9.0 9.1 9.2 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 10.0 10.1 10.2 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 11.0 11.1 11.2 11.3 11.4 11.5 Lua error in package.lua at line 80: module 'strict' not found.
