【 Hack2Own Game Call for Sponsors 】

This year, HITCON is again holding the Hack2Own game. In the game, challenger/sponsor provides targets and the adversary tries to break it. Participating sponsoring challengers must provide target software or hardware products and corresponding challenges for all participating adversarial contestants, and bounties or prizes must also be provided for those who will have discovered vulnerabilities and for those who have performed excellent work.

HITCON expects that the Hack2Own game will not only give security experts around the world a chance to compete and share ideas with each other, but also offers you challengers an opportunity to prove that you have put sustained efforts to improve security of your products by, willingly and publicly, giving penetration challenges and corresponding patches.

For all Hack2Own challengers, not only will you gain reputation by participating in the event, but also have the chance of further understanding your products, as they will be well penetration/availibility tested by expert hackers. Hack2Own creates a win-win situation for both sponsoring challengers and adversarial contestants.

If you would like to participate as sponsoring challengers of Hack2Own Game, please provide the following information to hack2own@hitcon.org.

Proposal

• Please send your proposal to hack2own@hitcon.org
• Your proposal must include:
1. Name and specification of your product
2. Challenges, including website and firmware system
3. A list of bounties or prizes
4. Information of how the bounties or prizes are delivered, i.e. deliver at HITCON CMT awarding ceremony, remit money within two weeks, etc.
5. Contact Info （Email & Tel)
• Deadline: July 10th, 2015

Game Schedule

The host will announce a list of participating sponsoring challengers along with a list of products and their versions in early July. These products will be challenged by participating adversarial contestants in early August. Successful attacks should be demonstrated by contestants at HITCON CMT, holding at Academia Sinica Humanities & Social Sciences Building on August 28-29th.

Game Information

• Game Structure
• adversarial contestants shall try to find vulnerabilities during the game and report their screenshots with captions or videos, compressed and encrypted with a given key provided by sponsoring challengers, to hack2own@hitcon.org.
• To complete the report, adversarial contestants shall reserve for demonstration capacity at Hack2Own activity area. Judges will thereby classify the vulnerability and offer corresponding prizes.
• Judges
• HITCON and sponsoring challengers will each assign one to two judges to decide whether a vulnerability is zero-day, and then classify it into several levels.
• Prize
• Size of prize is decided by the aforementioned level, and the eligibility is decided by the sponsoring challengers.

Game Rule

• Sponsoring challengers shall set up environment, configure networking, and ready accounts/passwords at the Hack2Own booth on Aug/28. Adversarial contestants shall follow the rules and demonstrate their discoveries in registration order.
• Sponsoring challengers must assign 1 or 2 on-site judges to co-classify vulnerabilities.
• The vulnerabilities reported by contestants must be unknown, unannounced, and must be off the records. Discovered vulnerabilities must not be another one’s extensions, i.e. it is not allowed to report one like uploading a web backdoor after the contestant have already acquired the control of the target website by injecting payloads.
• Remote attacks must be done under regular circumstances without any abnormal setup such as, target device being rebooted, set offline, re-logined, or any other contestant-defined unexpected disturbance.
• If a same vulnerability is demonstrated by different contestants, HITCON will recognize the first revealer as the valid discoverer and offer prizes based on this condition.

Note

• The award winners will earn the recognition for their personal outstanding abilities. However, HITCON do not acknowledge the organizations which contestants belong to possess equivalent techniques, and also deny the final results having any connection with the security level of the sponsor’s products.
• HITCON declare and guarantee that it will be strictly asked to provide explicit reports to the sponsoring challengers in close cooperation with all contestants, and any information will only be unveiled under permission. If the sponsors are absent from the Hack2Own game, HITCON will send the reports by mails.
• HITCON declare and warrant that personal data will not be compromised or used for other commercial activities without authorization. We also warrant that people who are not approved to be Hack2Own judges do not have the right to judge the security level of softwares and devices.

Contact Information

Hack2Own Team <hack2own@hitcon.org>