HP is to launch a hacking contest where participants will be awarded for compromising mobile devices.
Based on the Pwn2Own contest, which is held at the CanSecWest conference in Vancouver, this will be held at EUSecWest in Amsterdam in September. HP said that this will be specifically geared at the mobile device industry, with prizes of up to $200,000 (£128,000) offered to the first researcher (in each category) to successfully compromise a device via a mobile web browser, Near Field Communication (NFC), SMS cellular baseband.
HP said that the primary goal is to demonstrate the current security posture of the most prevalent mobile technologies in use today, and competitors will be able to use a radio frequency (RF) enclosure to conduct the ‘attacks' without violating local laws.
To enter, contestants can pre-register by email at firstname.lastname@example.org. On-site registration will still be available if the targets have not been compromised and if the required hardware and software prerequisites are available. Each contestant will have a 30-minute time slot in which to complete their attempt (not including time to set up the network or device prerequisites).
If more than one researcher registers for a given category, the order of the contestants will be drawn at random. The schedule will be announced a week before the contest and each contestant will be allowed to select the device they wish to compromise during the pre-registration process. The only requirement is that it be a current device and running the latest operating system.
A successful attack against these devices must require little or no user interaction and must compromise or exfiltrate useful data from the phone. Any attack that can incur cost upon the owner of the device (such as silently calling long-distance numbers, eavesdropping on conversations and so forth) is within scope.
To avoid interfering with licensed carrier networks, all RF attacks must be completed within the provided RF isolation enclosure and the vulnerabilities utilised in the attack must be a zero-day.
ZDI (Zero Day Initiative) reserves the right to determine what constitutes a successful attack and all vulnerabilities revealed by contest winners will be disclosed to affected vendors through HP's Zero Day Initiative.
Winners will receive the device itself, a BlackBerry PlayBook courtesy of RIM and the prize money is $100,000 (£63,000) for the cellular baseband compromise; $40,000 (£25,000) each for the SMS and NFC compromises and $20,000 (£13,000) for the mobile web browser attack.
Also awarded is 20,000 ZDI reward points, automatically qualifying the winner for silver standing, to include a one-time $5,000 (£3,000) cash payment, 15 per cent monetary bonus on all ZDI submissions over the next calendar year, a 25 per cent reward point bonus on all ZDI submissions over the next calendar year and paid travel and registration to attend the 2013 DefCon in Las Vegas.