Pwnie Names Award Winners

BLACK HAT USA 2011 -- Las Vegas -- Presenting to a raucous crowd mixed equally with blue Oxford shirts and blue hair, the judges of the fifth annual Pwnie Awards took the lid off of their decisions for the good, bad, and ugly in security research and epic ownage during the past year.

The ceremony offered the offbeat echo of a typical industry show awards routine. People wandered the ballroom chair aisles, beer in hand, and shouted jokes at the presenters, as officiants gave away gold-colored My Little Ponies to the winners -- many of whom wouldn't possibly accept these toy trophies if their lives depended on it.

For example, presenter Dino Dai Zovi gleefully took the hatchet to Sony when he presented the company with the award for Most Epic Fail. It was all but a foregone conclusion for this category, considering that Sony was up for all five nominations -- a fact that had the crowd roaring with laughter when Dai Zovi flashed the presentation slide with nominees for this category.

"I know we all have our favorites in this list, but there were a few wildcards in there," he joked, going on to list a number of Sony's failures, including its harassment of researcher GeoHot for his release of the PS3 jailbreak, the loss of millions of credit-card holder details in its massive data breach, and the layoff of many within its network security team just before finding out about the breach.

RSA was also on the hit list, lambasted for its handling of the SecurID breach incident. For that it won the award for Lamest Vendor Response.

Of course, it wouldn't be a complete night without a little Microsoft bashing: The award panel took it to task over Tarjei Mandt's discovery of 40-odd Windows kernel win32k user-mode callback vulnerabilities, winning the company the Best Privilege Escalation Bug award. And presenter Mark Dowd made a sideways joke at the American government's rumored involvement in the development of the Stuxnet malware when he granted the Trojan the Epic 0wnage award.

"The best way to describe it is as a nonviolent protest against the Iranian nuke program, allegedly done by a government with some pretty advanced intelligence capabilities," he said. "We suspect Belgium."

In spite of all the embarrassments, there were some winners who would be proud to count a Pwnie among their career accomplishments. Besides Mandt, other winners of favorable awards included Juliano Rizzo and Thai Duong, whose ASP.NET Framework Padding Oracle vulnerability discovery won Best Server-Side Bug; Piotr Bania, for his presentation on Securing the Kernel via Static Binary Rewriting and Program Shepherding, which won for Best Innovative Research; and Comex, whose jailbreakme.com exploit for iOS won Best Client-Side Vulnerability.

Additionally pipacs/PaX Team also won a Lifetime Achievement award for numerous contributions to the security research community, including introducing the fundamentals of improving security within operating systems and the invention of address space layout randomization (ASLR).

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.