On the failings of Pwn2Own 2012

http://scarybeastsecurity.blogspot.com/2012/03/on-failings-of-pwn2own-2012.html

 

Isn't that how those things go? I can't remember where but it seems like I've heard this same story before. A bunch of people try to crack something, some vulnerabilities are disclosed & patched. Then the really good exploits are sold on the black-hat market (as it were) for gobs of money.

 

http://www.darkreading.com/vulnerab...son-from-pwn2own-focus-on-exploitability.html

More reading on pwn2own.

Talented programmers can create attack code quickly, suggesting that firms need to focus on patching easily exploitable -- not just exploited -- flaws

 

It's a bit same-old same-old, yes. The idea behind pwn2own is that whitehats get some higher rewards and so more vulnerabilities will be disclosed - the reality is that
1) people simply hold on to the exploits for the competitions
2) the really worthwhile exploits aren't actually made use of