Pwnie Awards

Last updated
Pwnie Awards
StatusActive
GenreAwards Ceremony
FrequencyAnnual
Venue Summercon, Black Hat
Years active18
Inaugurated2007 (2007)
Founder Alexander Sotirov, Dino Dai Zovi
Website pwnies.com

The Pwnie Awards recognize both excellence and incompetence in the field of information security.[ citation needed ] Winners are selected by a committee of security industry professionals from nominations collected from the information security community. [1] Nominees are announced yearly at Summercon, and the awards themselves are presented at the Black Hat Security Conference. [2]

Contents

Origins

The name Pwnie Award is based on the word "pwn", which is hacker slang meaning to "compromise" or "control" based on the previous usage of the word "own" (and it is pronounced similarly). The name "The Pwnie Awards," pronounced as "Pony," [2] is meant to sound like the Tony Awards, an awards ceremony for Broadway theater in New York City.

History

The Pwnie Awards were founded in 2007 by Alexander Sotirov and Dino Dai Zovi [1] following discussions regarding Dino's discovery of a cross-platform QuickTime vulnerability (CVE - 2007-2175) and Alexander's discovery of an ANI file processing vulnerability (CVE - 2007-0038) in Internet Explorer.

Winners

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

Winner list from. [36]

2014

2013

2012

The award for best server-side bug went to Sergey Golubchik for his MySQL authentication bypass flaw. [42] [43] Two awards for best client-side bug were given to Sergey Glazunov and Pinkie Pie for their Google Chrome flaws presented as part of Google's Pwnium contest. [42] [44]

The award for best privilege escalation bug went to Mateusz Jurczyk ("j00ru") for a vulnerability in the Windows kernel that affected all 32-bit versions of Windows. [42] [43] The award for most innovative research went to Travis Goodspeed for a way to send network packets that would inject additional packets. [42] [43]

The award for best song went to "Control" by nerdcore rapper Dual Core. [42] A new category of award, the "Tweetie Pwnie Award" for having more Twitter followers than the judges, went to MuscleNerd of the iPhone Dev Team as a representative of the iOS jailbreaking community. [42]

The "most epic fail" award was presented by Metasploit creator HD Moore to F5 Networks for their static root SSH key issue, and the award was accepted by an employee of F5, unusual because the winner of this category usually does not accept the award at the ceremony. [42] [44] Other nominees included LinkedIn (for its data breach exposing password hashes) and the antivirus industry (for failing to detect threats such as Stuxnet, Duqu, and Flame). [43]

The award for "epic 0wnage" went to Flame for its MD5 collision attack, [44] recognizing it as a sophisticated and serious piece of malware that weakened trust in the Windows Update system. [43]

2011

2010

2009

2008

2007

References

  1. 1 2 3 4 Buley, Taylor (July 30, 2009). "Twitter Gets 'Pwned' Again". Forbes. Archived from the original on February 16, 2013. Retrieved January 3, 2013.
  2. 1 2 3 4 5 6 7 Sutter, John D. (August 4, 2011). "Sony gets 'epic fail' award from hackers". CNN. Retrieved January 3, 2013.
  3. ↑ Some of you may already be aware but due to extenuating circumstances we've made an early award!
  4. ↑ https://securityintelligence.com/x-force/little-bug-that-could/
  5. ↑ "Let the Cache Cache and Let the WebAssembly Assemble: Knocking’ on Chrome’s Shell"
  6. ↑ See No Eval: Runtime Dynamic Code Execution in Objective-C
  7. ↑ Video-Based Cryptanalysis: Extracting Cryptographic Keys from Video Footage of a Device’s Power LED
  8. ↑ @PwnieAwards (10 August 2022). "Our final nomination for Lamest Vendor Response goes to:Google TAG for "unilaterally shutting down a counterterrorism operation"" (Tweet) – via Twitter.
  9. ↑ "Google's top security teams unilaterally shut down a counterterrorism operation".
  10. ↑ "Google's Project Zero shuts down Western counter-terrorist hacker team". 29 March 2021.
  11. ↑ Goodin, Dan (2021-04-21). "In epic hack, Signal developer turns the tables on forensics firm Cellebrite". Archived from the original on 2023-05-23.
  12. ↑ Cox, Joseph; Franceschi-Bicchierai, Lorenzo (2021-04-27). "Cellebrite Pushes Update After Signal Owner Hacks Device". Archived from the original on 2023-05-11.
  13. ↑ Brazeal, Forrest (11 June 2021). "The Ransomware Song". YouTube. Archived from the original on 2021-12-21. Retrieved 9 August 2021.
  14. ↑ Tsai, Orange. "ProxyLogon is Just the Tip of the Iceberg: A New Attack Surface on Microsoft Exchange Server!". www.blackhat.com. Retrieved 9 August 2021.
  15. ↑ "U/OO/104201-20 PP-19-0031 01/14/2020 National Security Agency | Cybersecurity Advisory 1 Patch Critical Cryptographic Vulnerability in Microsoft Windows Clients and Servers" (PDF). Defense.gov. Retrieved 9 August 2021.
  16. ↑ Göktaş, Enes; Razavi, Kaveh; Portokalidis, Georgios; Bos, Herbert; Giuffrida, Cristiano. "Speculative Probing: Hacking Blind in the Spectre Era" (PDF).
  17. ↑ Kolsek, Mitja. "Free Micropatches for PrintNightmare Vulnerability (CVE-2021-34527)". 0Patch Blog. Retrieved 9 August 2021.
  18. ↑ Alendal, Gunnar. "Chip Chop - Smashing the Mobile Phone Secure Chip for Fun and Digital Forensics". www.blackhat.com. Black Hat.
  19. ↑ "21Nails: Multiple vulnerabilities in Exim". qualys.com. Qualys. Retrieved 9 August 2021.
  20. ↑ "E-Soft MX survey". securityspace.com. E-Soft Inc. 1 March 2021. Retrieved 21 March 2021.
  21. ↑ "Qualys CVE-2005-1513 Remote Code Execution Qmail". Qualys. 19 May 2020. Retrieved 21 Jan 2025.
  22. ↑ Tsai, Orange. "Infiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs!". www.blackhat.com. Retrieved 7 August 2019.
  23. ↑ "Vectorized Emulation: Hardware accelerated taint tracking at 2 trillion instructions per second", Vectorized Emulation
  24. ↑ "Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd"
  25. 1 2 "Spectre Attacks: Exploiting Speculative Execution", Spectre
  26. 1 2 "Meltdown", Meltdown
  27. ↑ "Return Of Bleichenbacher’s Oracle Threat (ROBOT)"
  28. ↑ https://www.theregister.com/2018/08/31/bitfi_reluctantly_drops_unhackable_claim/ [ bare URL ]
  29. ↑ "Pwnie for Most Innovative Research", Pwnie Awards
  30. ↑ "Pwnie for Best Privilege Escalation Bug", Pwnie Awards
  31. ↑ "The 2017 Pwnie Award For Lamest Vendor Response", Pwnie Awards
  32. ↑ Hello (From the Other Side) Manuel Weber, Michael Schwarz, Daniel Gruss, Moritz Lipp, Rebekka Aigner
  33. ↑ "Dedup Est Machina: Memory Deduplication as an Advanced Exploitation Vector", Erik Bosman et al.
  34. ↑ "DROWN: Breaking TLS using SSLv2" Nimrod Aviram et al.
  35. ↑ Cyberlier Katie Moussouris
  36. ↑ "'Will it Blend?' Earns Pwnie for Best Client Bug; OPM for Most Epic Fail".
  37. ↑ https://j00ru.vexillium.org/slides/2015/recon.pdf [ bare URL PDF ]
  38. ↑ "CERT/CC Vulnerability Note VU#552286".
  39. ↑ "Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice", Adrian David et al.
  40. ↑ "Identifying and Exploiting Windows Kernel RaceConditions via Memory Access Patterns"
  41. ↑ at 09:31, John Leyden 5 Oct 2012. "Experts troll 'biggest security mag in the world' with DICKish submission". www.theregister.co.uk. Retrieved 2019-10-03.{{cite web}}: CS1 maint: numeric names: authors list (link)
  42. 1 2 3 4 5 6 7 Yin, Sara (July 26, 2012). "And Your 2012 Pwnie Award Winners Are..." SecurityWatch. PCMag. Retrieved January 8, 2013.
  43. 1 2 3 4 5 Constantin, Lucian (July 26, 2012). "Flame's Windows Update Hack Wins Pwnie Award for Epic Ownage at Black Hat". IDG-News-Service. PCWorld. Retrieved January 8, 2013.
  44. 1 2 3 Sean Michael Kerner (July 25, 2012). "Black Hat: Pwnie Awards Go to Flame for Epic pwnage and F5 for epic fail". InternetNews.com. Retrieved January 8, 2013.
  45. 1 2 3 4 5 6 7 8 Schwartz, Mathew J. (August 4, 2011). "Pwnie Award Highlights: Sony Epic Fail And More". InformationWeek. Retrieved January 3, 2013.
  46. ↑ "Kernel Attacks through User-Mode Callbacks"
  47. ↑ "Securing the Kernel via Static Binary Rewriting and Program Shepherding"
  48. ↑ "Interpreter Exploitation Pointer Inference and JIT Spraying"
  49. 1 2 3 Brown, Bob (July 31, 2009). "Twitter, Linux, Red Hat, Microsoft "honored" with Pwnie Awards". NetworkWorld. Archived from the original on August 5, 2009. Retrieved January 3, 2013.
  50. 1 2 3 Naone, Erica (August 7, 2008). "Black Hat's Pwnie Awards". MIT Technology Review. Retrieved January 3, 2013.
  51. 1 2 3 4 5 6 Naraine, Ryan (August 2, 2007). "OpenBSD team mocked at first ever 'Pwnie' awards". ZDNet. Archived from the original on February 17, 2013. Retrieved January 3, 2013.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.