THE CHALLENGE:

Can your malware escape from Bromium isolation and capture the prize?

For a full year, Bromium has had an open invitation at several security industry events for anyone to run their malware on our demo machines. We also ran a bug bounty program with BugCrowd. Yet, nobody’s malware has so far successfully broken out of our hardware-enforced isolation.

We are now upping the ante and taking the challenge online as a Capture the Flag contest. If your malware can break out from our micro-VM-based hardware protection and capture the flag* you will be eligible to receive a cash prize of $30,000.

*Your malware must successfully escape from a micro-VM hosted by Bromium, access the flag file, and append your email address to the text file.

CHALLENGE DETAILS

What you need to know

This challenge allows participants to submit their malware samples by uploading them online.

Bromium will host Windows 7 and Windows 10 machines (see FAQs for operating system patch levels and software configuration details) where malware will be executed to attempt to capture the flag.

The Bromium BYOM Challenge only accepts malware that is a disguised or weaponized Microsoft Office or PDF file — to replicate how most attacks penetrate the corporate endpoints today. We are not accepting .exe malware at this time because we want to focus on the most common attack vector — 92% of organizations are breached through malicious email attachments.

In order to be eligible for the challenge and the cash award, participants must provide their name, company name, and a valid business email address.

ENTER THE CHALLENGE:

How to submit your unique malware sample

First, complete the form to indicate that you want to participate. Be sure to provide your correct information and your business email address so we can contact you if your malware breaks out of Bromium.

Second, after completing the form, you’ll receive instructions on how to submit your malware sample to Bromium. Once we receive your malware, Bromium Labs analysts will go to work running it on a Bromium-protected Windows machine to see what happens after it executes.

Should your malware sample break out of the Bromium micro-VM and win the challenge, you will be contacted using the information you provided.

I WANT TO ENTER THE BROMIUM BYOM CHALLENGE

Thank you! The information has been submitted successfully.

FAQs

In order to win, malware detonated on the lab machines needs to successfully escape out of the VM resulting in breaching the host system, access the flag file C:\Flags.txt stored on the host, and append an email address to the text file. Bromium monitors the file C:\Flags.txt for any changes on the host. When changes to the file are detected, the winner will be announced.

Bromium technology enables hardware-enforced isolation for all key attack vectors, but the initial challenge will focus on downloadable Office and PDF files. Participants are requested to send their Office and PDF file samples only. No other forms of attack vectors (e.g. .exe files, Bluetooth, USB, etc.), will be considered at this time.

Participants are welcome to bring all forms of malware that they’ve encountered, but they must appear in a Microsoft Office or PDF document. Malware could be ransomware, Trojans, Microsoft Word-based poisoned macro documents, or other forms of typical drive-by downloads.

Custom exploits/payloads are allowed as long as they are hosted on a web server.

The Bromium Lab uses tools to trace activities on the host in order to identify a successful compromise and gather evidence (host C:\Flags.txt file includes an appended email address) to confirm the breach. Results will be announced on an ongoing basis, as we continue to receive additional malware samples.

There are two hosts to choose from – break out of containment and capture the flag on either of them, and you will win.

Host 1:
Operating System: Windows 10 Version 10.0.17134.285 (Redstone 4)
Architecture: x64
Languages: en-GB, en-US
Installed Software:
Adobe Flash: 18.0.0.203
Adobe Reader: 18.11.20058.33888
Internet Explorer: 11.0.17134.1
Microsoft Lync: 16.0.9126.2282
Microsoft Office Outlook: 16.0.9126.2282
Office: 16.0.9126.2282 (Office 2016)
Windows Media Player: 12.0.10011.16384
Windows Photo Viewer: 10.0.17134.1
Windows PowerShell: 5.1.17134.1

Host 2:
Operating System: Windows 7 Version 6.1.7601.24241 (SP1)
Architecture: x64
Languages: en-US
Installed Software
Internet Explorer: 11.0.9600.19130
Microsoft Lync: 16.0.9126.2275
Microsoft Office Outlook: 16.0.9126.2275
Office: 16.0.9126.2275 (Office 2016)
Windows Media Player: 12.0.7601.23930
Windows Photo Viewer: 6.1.7601.17514

Given that Bromium micro-VMs typically allow the malware to “detonate” without affecting the host, this could mean that the attack appears to be successful, albeit only inside the micro-VMs. This scenario does not mean a real compromise of the host. Bromium analysts will carefully evaluate each scenario and determine the final status.

There can be certain rare cases when the malware doesn’t run inside the micro-VM. If so, your malware sample will be removed from the challenge. All malware must detonate inside the micro-VM to be considered for the BYOM challenge.

A Denial of Service attack on the system does not mean a successful compromise of the host operating system.

Legal Stuff

Boring but necessary

Void where prohibited. Not available to residents of Italy.

By submitting an entry form, participant is agreeing that personal information will be governed by the terms of the Bromium, Inc. Privacy Policy and agrees to be contacted by phone and email by Bromium in connection with this contest.

The contest will continue until terminated by Bromium or the funding cap is reached. Bromium may end the contest at any time at its sole discretion.

Contest participants must be at least 18 years of age.

There is no fee to participate in the contest.

Payments will be made by check or wire transfer.

Once malware is submitted, Bromium will be entitled to use, modify, disclose, and distribute submission without attribution or contribution of any kind.

By entering this contest, participants agree that Bromium will not be liable for personal injuries, death, damages, expenses or costs or losses of any kind resulting from participation or inability to participate in this contest or acceptance of or use of or inability to use the prize, including, without limitation, claims, suits, injuries, losses and damages related to personal injuries, death, damage to or destruction of property, rights of publicity or privacy, defamation or portrayal in a false light (whether intentional or unintentional), whether under a theory of contract, tort (including negligence), warranty or other theory. Winner releases Sponsor from any and all liability and responsibility with respect to the prize (including any property loss, damage, personal injury or death). Winners of the contest acknowledge that Bromium has neither made nor is in any manner responsible for any warranty, representation or guarantee, expressed or implied, in fact or in law, related to the prize.