iPhone 3GS, a Blackberry Bold 9700
Pwn2Own's other hacking track will feature an iPhone 3GS, a Blackberry Bold 9700, an unspecified Nokia smartphone running the Symbian S60 platform and a Motorola, most likely a Droid, powered by Google's Android. A successful hack must result in code execution with little to no user-interaction.
Portnoy refused to predict which smartphone would fail first, although having spent months organizing the mobile side of the contest, he said he has "a fairly good idea of what will come out of the mobile exploits."
If he had to pick the phone easiest to attack, he would lay his money on Apple's iPhone. Why? "Because it runs Safari, which [is built] on the notoriously buggy WebKit [engine]," Portnoy said.
Miller, who also has a reputation on the mobile side - he was one of the three researchers who discovered the first iPhone security bug and found the first Android vulnerability on his own - was convinced that the smartphones would remain untouched, as they did during 2009's Pwn2Own.
"I predict none of the phones will be successfully attacked," Miller said. "Phones are much harder than browsers to attack, there isn't the well-known knowledge out there for attacking phones as there is for browsers. Attacking phones is still pretty cutting edge."
Portnoy hopes Miller is wrong. "We'll see more competitors on mobile than last year," Portnoy said. "I know some researchers have vulnerabilities ready to go, as they always do."
Part of the problem last year with the mobile part of Pwn2Own was the last-minute nature of that competition, Portnoy argued. This year, he set the stage with an advisory group of about 15 security researchers who worked out the contest's ground rules.
TippingPoint has also boosted the mobile rewards from 2009's $10,000 to $15,000 this year, and added additional enticements to all winners that include enough points in TippingPoint's Zero Day Initiative (ZDI) bug-bounty program to qualify for another one-time payment of $5,000.
Pwn2Own will run March 24-26 at the CanSecWest security conference in Vancouver, British Columbia, and could award as much as $100,000/£64,000 in cash. TippingPoint purchases the rights to the vulnerabilities and exploit code used during the contest, reports the bugs to the vendors and uses the information to bolster the security systems it sells.