Inside Pwn2Own: A Firefox Zero-Day and Mozilla’s Response

Summary

A documentary follows Pwn2Own Berlin’s Firefox zero-day contest, showing a successful exploit demonstration and Mozilla’s disclosure and analysis process. Mozilla describes the event as a security-response drill; exploit details are deferred to part two.

Key points

Pwn2Own tests real, updated software with zero-day vulnerabilities in a controlled competition, rather than a real-world attack.
Mozilla says the recurring event serves as a security-response drill and informs its internal security agenda and hardening work.
Edward Bochin and Taoan of Palo Alto Networks, and Manfred Paul, were scheduled to target Firefox.
A Firefox exploit demonstration succeeded. The video clarifies that the researchers had worked on the exploit for weeks, not just the seconds it took to demonstrate.
The competition organizer, ZDI, checks the submitted vulnerability information, including whether the bug is a duplicate; Mozilla is given 90 days to fix it.
The video ends before revealing the exploit details, which it reserves for part two.

Article Details

Topics: [00:52] How Pwn2Own differs from capture-the-flag competitions and targets real software
[01:24] Zero-day exploits and the security significance of Pwn2Own
[03:43] Mozilla’s use of the competition as a security-response drill
[05:36] Firefox competitors and the competition lineup
[10:27] Mozilla’s vulnerability analysis and response process
[11:17] Successful Firefox exploit demonstration and the weeks of preparation behind it
[12:45] ZDI’s vulnerability validation and Mozilla’s 90-day fix period

People

Dustin ChildsIdentified as head of threat awareness at Trend Zero Day Initiative and presented the Pwn2Own Berlin competition lineup.Edward BochinPalo Alto Networks researcher who participated in the successful Firefox exploit demonstration at Pwn2Own.FreddyManages application security for Firefox and describes Mozilla’s preparations for Pwn2Own.Manfred PaulSecurity researcher scheduled to target Firefox at Pwn2Own; the video notes his prior browser-targeting competition wins.TaoanPalo Alto Networks researcher who participated in the successful Firefox exploit demonstration at Pwn2Own.

Vendors

MozillaFirefox’s vendor; its security staff analyzed the disclosed vulnerability and used Pwn2Own to practice response and inform hardening.Palo Alto NetworksThe affiliation of researchers Edward Bochin and Taoan, who demonstrated a Firefox exploit at Pwn2Own.

Products

Mozilla FirefoxMozilla browser targeted by a successful zero-day exploit demonstration at Pwn2Own; the vulnerability was disclosed to Mozilla for analysis and remediation.