Past winner: Safari will fall first at hacker contest
Researcher cites Safari's vast functionality and Mac OS X's lack of workable defenses as factors in the browser's vulnerability
Follow @infoworldApple Inc.'s Safari is the juiciest target in the upcoming PWN2OWN hacking contest, last year's winner predicted Tuesday.
"It's an easy target," said Charlie Miller, the vulnerability researcher who last year walked off with a $10,000 cash prize for breaking into an Apple laptop within minutes of the contest. PWNOWN is slated for its third appearance at the CanSecWest security conference later this month in Vancouver, British Columbia.
[ How safe is your browser? Find out in InfoWorld Test Center's guide to browser security, including reviews of Chrome, Firefox, IE, Opera, and Safari | Keep up on the latest tech news headlines at InfoWorld News, or subscribe to the Today's Headlines newsletter. ]
"It might be because I'm biased about the things I'm good at, but it's the easiest browser [to hack]," Miller said.
PWN2OWN's sponsor, 3Com Inc.'s TippingPoint, will pay $5,000 for each new bug successfully exploited in Safari, Microsoft Corp.'s Internet Explorer 8 (IE8), Mozilla Corp.'s Firefox, or Google Inc.'s Chrome. IE8, Firefox, and Chrome will be running on a Sony notebook powered by Windows 7, Microsoft's still-under-construction operating system, while Safari and Firefox will be available on a MacBook.
"Apple's products are really friendly to users, and Safari is designed to handle anything, including all kinds of file formats," said Miller. "With a lot of functionality comes the increased chance of bugs. The more complex software is, the less secure it is."
Another factor contributing to Safari's easy pickings, said Miller, is Apple's Mac OS X, which lacks workable defenses found in Windows Vista and Windows 7, including address space randomization. Microsoft calls it "address space layout randomization," or ASLR.
Put Safari atop Mac OS X, and the target's too good to pass up, said Miller.
IE8 and Firefox will escape unscathed, Miller predicted, adding that a quick cost-benefit analysis tells him they'll be safe. "They make it so hard that, for me, $5,000 isn't motivation enough to try to break one of those guys," he said. As for Chrome, he pleaded ignorance, saying that he didn't know enough about the browser to even provide a prediction. His gut instinct, however, is that Google's browser will also survive.
