The next scheduled Pwn2Own hacking competition has lost Hewlett-Packard as its longstanding sponsor amid legal concerns that the company could run afoul of recent changes to an international treaty that governs software exploits.
Dragos Ruiu, organizer of both Pwn2Own and the PacSec West security conference in Japan, said HP lawyers spent more than $1 million researching the recent changes to the so-called Wassenaar Arrangement. He said they ultimately concluded that the legal uncertainty and compliance hurdles were too high for them to move forward.
"I am left being kind of grumpy now that HP is not involved," Ruiu told Ars. He said that he plans to organize a scaled-down hacking competition to fill the void at this year's conference, which is scheduled for November 11 and 12.
Pwn2Own has become one of the more closely followed events among security professionals. The hacking competition offers hundreds of thousands of dollars for exploits that target software vulnerabilities found in Windows, OS X, iOS, and Android. Besides highlighting the relative ease of exploiting bugs, the contest allows HP's Tipping Point division to update its intrusion prevention software with definitions that detect and block such attacks.
Ruiu said HP pulled out this year following changes made earlier this year to the Wassenaar arrangement. It added specific curbs around the exports of "intrusion malware" and "intrusion exploits." Ruiu said Japan's implementation of Wassenaar is so vague and cumbersome that they expose researchers and organizers to a high amount of legal uncertainty. What, for instance, is the status of thumbdrives containing exploit software that was debugged at the last minute in Japan and is then brought back to the US, where Tipping Point is headquartered?
By contrast, Ruiu said Canada's implementation of Wassenaar was much more clear and simpler to comply with. That likely explains why HP sponsored the Pwn2Own competition in March at the CanSecWest conference in Vancouver, British Columbia.
HP released a statement that read:
Due to the complexity of obtaining real-time import/export licenses in countries that participate in the Wassenaar Arrangement, the ZDI has notified conference organizer, Dragos Ruiu, that it will not be holding the Pwn2Own contest at PacSecWest in November.
The withdrawal seems unfortunate, since Pwn2Own helps make mainstream computing more secure. The changes to Wassenaar have generated howls of protest from researchers who have warned that whitehats would be hamstrung while blackhats would be allowed to operate unencumbered.
"That million dollars HP spent on lawyers should have been spent on researchers and bugs," Ruiu complained.
Update: Several people have taken to Twitter to speculate that legal concerns over Wassenaar have less to do with Tipping Point pulling out of Pwn2Own than HP's desire to sell Tipping Point.
Post updated to correct spelling of Ruiu's name.
reader comments
34