HP Will Stop Sponsoring Pwn2Own Mobile Because Of Wassenaar

Computer manufacturer HP has decided the Mobile Pwn2Own competition in Japan not to sponsor this year. If reason be called the export restrictions of the Wassenaar agreement. Mobile Pwn2Own is an annual event which is part of the PacSecWest Conference in Japan.

The event is organized by the Zero Day Initiative (ZDI) of HP and has different categories where researchers feel the test the safety of popular smartphones and tablets. Compromising a mobile phone via Bluetooth, WiFi, USB or Near Field Communication (NFC) last year yielded 75 000 dollars. A successful attack via a mobile web browser HP rewarded with $ 50,000. At the last edition of the Apple iPhone 5S were Samsung Galaxy S5, LG Nexus 5 and Amazon Fire Phone hacked.The vulnerabilities that were used for this purpose had to give researchers at HP. The computer giant then informs the relevant supplier. Only when the problem is patched researchers may share the details of their vulnerability.

Wassenaar agreement

This year, HP will not sponsor the event and organize, let Dragos Ruiu know via Twitter. Ruiu, the organizer of the PacSecWest Conference. The reason is called the Wassenaar agreement. The Wassenaar agreement sets rules on goods, software and information that countries are allowed to export such technologies as "intrusion software" (pdf) are described.These are so-called "dual use" goods that can be used for multiple purposes. So stand surveillance systems on the list, but also weapons like landmines and nuclear materials. It is a voluntary agreement and it is up to countries how they apply the agreement within their own legislation. The way the US government will be implementing the rules could have far-reaching consequences, as warned Google and Microsoft before.

As a solution, said Ruiu which vulnerabilities are found given to Japanese delegates during Pwn2Own Mobile. In this way, the bugs do not need to go back to the United States. Thus Ruiu think to the export restriction bypass. Besides Pwn2Own Mobile will also find the annual Pwn2Own contest in Vancouver instead, which is part of the CanSecWest conference. As far as known HP continues to sponsor this contest and organizing. The PacSecWest Conference takes place on 11 and 12 November in Tokyo.

Chrysler Raises 1.4 Million Cars Back Because Of Vulnerability

Carmaker Chrysler raises some 1.4 million cars and trucks back because of a vulnerability in the software that allow attackers over the internet can access the vehicles. It is then possible to switch on the brakes, to turn off and to turn off the motor at low speeds.

The vulnerability was by researchers Charlie Miller and Chris Valasek discovered . The problem is in Uconnect, a component that gives the cars online capabilities and that the entertainment and navigation are operable. The functionality even offers a wifi hotspot and makes phone calls possible. Uconnect allows anyone with a vehicle connection as long as the IP address of the car is known.

After the connection was made with a car, the researchers succeeded in order to adapt the firmware of the system. This custom firmware can then send instructions via the internal network of the car to the physical components such as the engine and the wheels.

Recall

After Chrysler nine months ago was informed, was the manufacturer on July 16 with a security update . The update must be installed via a USB stick by car owners. The fear was that many owners would not do this. Therefore Chrysler now launched a voluntary recall, let the manufacturer through their own website to know. It is about 1.4 million vehicles. According to Chrysler there are no attacks still in the "wild" that have been observed using the vulnerability.

The problem is present in the MY Dodge Viper and different models of RAM pickup, the Jeep Grand Cherokee and Cherokee SUVs, Dodge Durango SUVs, different My Chrysler and Dodge Charger sedans and Dodge Challenger sports coupe.Customers of an affected vehicle will have received a USB device that they can use to upgrade the car software. The upgrade not only resolves the vulnerability, but also adds additional security measures, according to Chrysler.