Jump to content

Pwnie Awards

Edit links
From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Notwist (talk | contribs) at 05:44, 6 October 2018 (→2017). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

File:Pwnie Award flickr RobotSkirts.jpg
Pwnie Award, resembling a My Little Pony toy.[1]

The Pwnie Awards recognize both excellence and incompetence in the field of information security. Winners are selected by a committee of security industry professionals from nominations collected from the information security community.[2] The awards are presented yearly at the Black Hat Security Conference.[3]

Origins

The name Pwnie Award is based on the word "pwn", which is hacker slang meaning "to compromise" or to "control" based on the previous usage of the word "own" (and it is pronounced similarly). The name "The Pwnie Awards," pronounced as "Pony,"[3] is meant to sound like The Tony Awards, an awards ceremony for Broadway Theater in New York City.

History

The Pwnie Awards were founded in 2007 by Alexander Sotirov and Dino Dai Zovi[2] following discussions regarding Dino's discovery of a cross-platform QuickTime vulnerability and Alexander's discovery of an ANI file processing vulnerability in Internet Explorer.

Winners

2018

  • Most Innovative Research: Spectre[4]/Meltdown[5] Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz, Yval Yarom
  • Lifetime Achievement: Michał Zalewski
  • Best Cryptographic Attack: Return Of Bleichenbacher’s Oracle Threat [6] Hanno Böck, Juraj Somorovsky, Craig Young

2017

  • Epic Achievement: Finally getting TIOCSTI ioctl attack fixed Federico Bento
  • Most Innovative Research: ASLR on the line [7] Ben Gras, Kaveh Razavi, Erik Bosman, Herbert Bos, Cristiano Giuffrida
  • Best Privilege Escalation Bug: DRAMMER [8] Victor van der Veen, Yanick Fratantonio, Martina Lindorfer, Daniel Gruss, Clementine Maurice, Giovanni Vigna, Herbert Bos, Kaveh Razavi, Cristiano Giuffrida
  • Lamest Vendor Response: for mis-handling security vulnerabilities most spectacularly. For multiple critical Systemd bugs[9] Lennart Poettering

2016

  • Most Innovative Research: Dedup Est Machina: Memory Deduplication as an Advanced Exploitation Vector [10] Erik Bosman, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida
  • Lifetime Achievement: Peiter Zatko aka Mudge
  • Best Cryptographic Attack: DROWN attack [11] Nimrod Aviram et al.

2015

  • Pwnie for Most Epic FAIL: OPM - U.S. Office of Personnel Management
  • Lifetime Achievement: Thomas Dullien aka Halvar Flake
  • Most Innovative Research: Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice [12] Adrian David et al.

2014

The award for best server-side bug went to the security researchers who discovered Heartbleed, and best client-side bug went to George Hotz for finding a bug in Chrome OS.[13] The "most epic fail" award went to Apple for its goto fail bug in iOS and OS X.[13]

2013

2012

The award for best server-side bug went to Sergey Golubchik for his MySQL authentication bypass flaw.[14][15] Two awards for best client-side bug were given to Sergey Glazunov and Pinkie Pie for their Google Chrome flaws presented as part of Google's Pwnium contest.[14][16]

The award for best privilege escalation bug went to Mateusz Jurczyk ("j00ru") for a vulnerability in the Windows kernel that affected all 32-bit versions of Windows.[14][15] The award for most innovative research went to Travis Goodspeed for a way to send network packets that would inject additional packets.[14][15]

The award for best song went to "Control" by nerdcore rapper Dual Core.[14] A new category of award, the "Tweetie Pwnie Award" for having more Twitter followers than the judges, went to MuscleNerd of the iPhone Dev Team as a representative of the iOS jailbreaking community.[14]

The "most epic fail" award was presented by Metasploit creator HD Moore to F5 Networks for their static root SSH key issue, and the award was accepted by an employee of F5, unusual because the winner of this category usually does not accept the award at the ceremony.[14][16] Other nominees included LinkedIn (for its data breach exposing password hashes) and the antivirus industry (for failing to detect threats such as Stuxnet, Duqu, and Flame).[15]

The award for "epic 0wnage" went to Flame for its MD5 collision attack,[16] recognizing it as a sophisticated and serious piece of malware that weakened trust in the Windows Update system.[15]

2011

2010

2009

  • Best Server-Side Bug: Linux SCTP FWD Chunk Memory Corruption (CVE-2009-0065) David 'DK2' Kim
  • Best Privilege Escalation Bug: Linux udev Netlink Message Privilege Escalation (CVE-2009-1185) Sebastian Krahmer
  • Best Client-Side Bug: msvidctl.dll MPEG2TuneRequest Stack buffer overflow (CVE-2008-0015) Ryan Smith and Alex Wheeler
  • Mass 0wnage: Red Hat Networks Backdoored OpenSSH Packages (CVE-2008-3844) Anonymous[2]
  • Best Research: From 0 to 0day on Symbian Credit: Bernhard Mueller
  • Lamest Vendor Response: Linux "Continually assuming that all kernel memory corruption bugs are only Denial-of-Service" Linux Project[18]
  • Most Overhyped Bug: MS08-067 Server Service NetpwPathCanonicalize() Stack Overflow (CVE-2008-4250) Anonymous[18]
  • Best Song: Nice Report Doctor Raid
  • Most Epic Fail: Twitter Gets Hacked and the "Cloud Crisis" Twitter[2]
  • Lifetime Achievement Award: Solar Designer[18]

2008

2007

References

  1. ^ Rashid, Fahmida Y. (August 2, 2011). "Pwnie Awards Nominees in 2011 Include Sony, Anonymous, LulzSec, WikiLeaks". eWeek. Retrieved January 3, 2013.
  2. ^ a b c d Buley, Taylor (July 30, 2009). "Twitter Gets 'Pwned' Again". Forbes. Archived from the original on February 16, 2013. Retrieved January 3, 2013. {{cite web}}: Unknown parameter |deadurl= ignored (|url-status= suggested) (help)
  3. ^ a b c d e f g Sutter, John D. (August 4, 2011). "Sony gets 'epic fail' award from hackers". CNN. Retrieved January 3, 2013.
  4. ^ "Spectre Attacks: Exploiting Speculative Execution", Spectre
  5. ^ "Meltdown", Meltdown
  6. ^ "Return Of Bleichenbacher’s Oracle Threat (ROBOT)"
  7. ^ "Pwnie for Most Innovative Research", Pwnie Awards
  8. ^ "Pwnie for Best Privilege Escalation Bug", Pwnie Awards
  9. ^ "2017: Pwnie for Lamest Vendor Response", Pwnie Awards
  10. ^ "Dedup Est Machina: Memory Deduplication as an Advanced Exploitation Vector", Erik Bosman et al.
  11. ^ "DROWN: Breaking TLS using SSLv2" Nimrod Aviram et al.
  12. ^ "Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice", Adrian David et al.
  13. ^ a b Scharr, Jill (August 7, 2014). "Pwnie Awards Celebrate Security Wins and Epic Fails". Tom's Guide. Retrieved August 6, 2015.
  14. ^ a b c d e f g Yin, Sara (July 26, 2012). "And Your 2012 Pwnie Award Winners Are..." SecurityWatch. PCMag. Retrieved January 8, 2013.
  15. ^ a b c d e Constantin, Lucian (July 26, 2012). "Flame's Windows Update Hack Wins Pwnie Award for Epic Ownage at Black Hat". IDG-News-Service. PCWorld. Retrieved January 8, 2013.
  16. ^ a b c Sean Michael Kerner (July 25, 2012). "Black Hat: Pwnie Awards Go to Flame for Epic pwnage and F5 for epic fail". InternetNews.com. Retrieved January 8, 2013.
  17. ^ a b c d e f g h Schwartz, Mathew J. (August 4, 2011). "Pwnie Award Highlights: Sony Epic Fail And More". InformationWeek. Retrieved January 3, 2013.
  18. ^ a b c Brown, Bob (July 31, 2009). "Twitter, Linux, Red Hat, Microsoft "honored" with Pwnie Awards". NetworkWorld. Retrieved January 3, 2013.
  19. ^ a b c Naone, Erica (August 7, 2008). "Black Hat's Pwnie Awards". MIT Technology Review. Retrieved January 3, 2013.
  20. ^ a b c d e f Naraine, Ryan (August 2, 2007). "OpenBSD team mocked at first ever 'Pwnie' awards". ZDNet. Retrieved January 3, 2013.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Pwnie_Awards&oldid=862712602"