THE MOBILE PWN2OWN CONTEST ("CONTEST") IS CONDUCTED SOLELY IN ACCORDANCE WITH AND SHALL BE CONSTRUED AND EVALUATED ACCORDING TO APPLICABLE LAW. THE CONTEST IS VOID IN WHOLE OR PART WHERE PROHIBITED BY LAW. ENTRY IN THIS CONTEST CONSTITUTES ACCEPTANCE OF THESE CONTEST RULES (THE "CONTEST RULES"). TREND MICRO INC. ("TREND MICRO") IS THE SPONSOR OF THIS CONTEST ("SPONSOR").

1. ELIGIBILITY.

Employees of Trend Micro Inc. and their respective affiliates, subsidiaries, related companies, advertising and promotional agencies, and the household members of any of the above are not eligible to participate in the Contest.

Contestants must be 18 years of age or older at the time of registration in order to participate and may not be a resident of any U.S. embargoed or sanctioned country or otherwise be listed on any U.S. denied or barred persons list. Any software or technology that attendees bring or cause to be transferred to Japan for the Contest may be subject to the export controls of attendee's country of residence or travel origin or subject to the import and export requirements in Japan. Attendees are responsible for compliance with any applicable import and export controls as a result of their attendance at the Contest.

Sponsor shall have the right at any time to require proof of identity and/or eligibility to participate in the Contest. Failure to provide such proof may result in disqualification. All personal and other information requested by and supplied to the Sponsor for the purpose of the Contest must be truthful, complete, accurate, and in no way misleading. The Sponsor reserves the right, in its sole discretion, to disqualify any contestant should such contestant at any stage supply untruthful, incomplete, inaccurate, or misleading personal details and/or information.

If you are a public sector employee, it is critical that you verify the ethics code, laws, and/or regulations that govern your ability to accept items of value from companies with whom you conduct business. Please obtain the necessary approval from your organization before participating in the Contest and/or accepting any item of value from Sponsor. In addition, public-sector employees, employees of K-12 public and private education institutions and all libraries, including public, private school, college or university, research, and private libraries can participate in the Contest only if you are doing so outside of your official status and not as part of your employment with those entities.

2. CONTEST PERIOD.

The Contest will be held October 26th – 27th, 2016, during the PacSec 2016 Conference in Tokyo, Japan.

3. HOW TO ENTER.

This Contest is open to all registrants in the PacSec 2016 Conference, subject to the eligibility requirements herein. Contestants must be on-site at the conference to demonstrate their entry. No purchase is required to participate in the Contest.

All contestants must sign up for a Zero Day Initiative ("ZDI") Researcher account in order to participate. Sign up is free and can be completed at https://www.zerodayinitiative.com/portal/register/. Once a contestant is signed up as a ZDI Researcher, the contestant can register for the contest by contacting Sponsor via e-mail at zdi@trendmicro.com and indicating in which category or categories the contestant wishes to participate.

The contestant can only register two entries for a given category (See "Categories" in the "Categories and Prizes" table in Section 4 below). Every entry must be a separate and unique exploit chain. Specific details about the devices (software, versions, configurations, chipsets, etc.) will be communicated to contestants during the registration process.

The Sponsor reserves the right to deny registration to entries that do not comply with the rules during the registration process. Contest registration closes at 5:00 p.m. Japan Standard Time on October 24th, 2016.

4. PRIZES.

Trend Micro is offering cash and prizes during the competition for vulnerabilities and exploitation techniques against the listed devices in the below categories. The first contestant to successfully compromise a device within the selected category will win the prizes for the category. All prizes are in US currency.

Devices:

Sponsor reserves the right, in its sole discretion, to add or modify the device list if a new version of one of the devices is released or recalled between the release of the rules and the contest.

Categories and Prizes:

The contest has three categories consisting of:

All entries must compromise the devices by browsing to web content (using the device's default browser) or by viewing/receiving an MMS/SMS message.

Categories

Device

Prize

Points

Obtain Sensitive Information

Apple iPhone

$50,000 (USD)

10

Google
Nexus

$50,000 (USD)

10

Samsung Galaxy S7

$35,000 (USD)

7

Install Rogue Application

Apple iPhone

$125,000 (USD)

23

Google Nexus

$100,000 (USD)

20

Samsung Galaxy S7

$60,000 (USD)

15

Force Phone Unlock

Apple iPhone

$250,000 (USD)

42

If the contestant's attempt is successful, it is eligible for a series of Style Bonuses. These Style Bonuses result in additional monetary prizes and Master of Pwn points. The criteria for the various Style Bonuses are documented below:

Style Bonus

Criteria

Prize

Points

Sniper Bonus

Successful on the first attempt

$0 (USD)

+2

Strength Bonus

Successful on all three attempts

$0 (USD)

+3

Stealth Bonus

Exploit chain must demonstrate full process continuation on the first attempt

$2,500 (USD)

+4

Supreme Bonus

Executing code with kernel privileges

$10,000 (USD)

+5

The contestant with the highest total points at the end of the contest (the "Master of Pwn") will receive 65,000 ZDI reward points (an estimated value of $25,000 (USD)). Total points are calculated by summing the winning entries and associated style bonuses. If two or more contestants have the same number of points at the end of the contest, each of these contestants will receive 65,000 ZDI reward points.

For example, if a contestant has two successful entries (Obtain Sensitive Information on the Apple iPhone with the Sniper Bonus and Install Rogue Application on the Samsung Galaxy S7 with the Sniper and Strength Bonuses) their total points would be 32.

Along with the prize money, the contestant will win the device (estimated value of $500 (USD)). Winners of these prizes are not entitled to the difference, if any, between the actual prize value and the estimated prize value. The estimated prize value is as of the date these Contest Rules are printed.

It is possible that a category may have no winner. If a category has no winner, Sponsor may, in its sole discretion, choose to use the prize money from that category to offer additional prize(s) in another above listed category that may be equal to or less than the initial prize offering for such category. The odds of winning depend on the number of eligible participants in a category and the ability to meet the requirements of this skills-based Contest. Prizes will be distributed within eight (8) weeks after each winner has fulfilled the requirements set out herein.

Prizes must be accepted as awarded and cannot be transferred, assigned, substituted, or redeemed for cash except at the sole discretion of Sponsor. Any unused portion of a prize will be forfeited and have no cash value. Sponsor reserves the right, in its sole discretion, to substitute a prize of equal or greater value if a prize (or any portion thereof) cannot be awarded for any reason. Taxes on prizes, if any, are the sole responsibility of the winner.

The Sponsor shall not assume any liability for any lost or misdirected prizes.

5. WINNER SELECTION.

If more than one contestant registers for a given category, the order of the contestants will be drawn at random. Based on the contestant order, the first contestant will be given an opportunity to attempt to compromise the selected target. If unsuccessful, the next randomly drawn contestant will be given an opportunity. This will continue until a contestant successfully compromises the target. The first contestant to successfully compromise a selected target will win the prize money for that category. After a target has been compromised, the contest for that category is over and no other contestants will participate in the contest for that category (unless Sponsor has offered an additional winner option, which would be announced at the conference if applicable).

A successful entry must leverage a vulnerability to modify the standard execution path of a program or process in order to allow the execution of arbitrary instructions. All entries must compromise the devices by browsing to web content (using the device's default browser) or by viewing an MMS/SMS message. The entry is required to defeat the target's techniques designed to ensure the safe execution of code, such as, but not limited to, Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR) and/or application sandboxing. If a sandbox is present, a full sandbox escape is required.

In the "Obtain Sensitive Information" category, the sensitive information refers to information normally inaccessible from the application's sandbox. The exact details of the information to retrieve in the attempt will be communicated to the contestant prior to the contest. In the "Install Rogue Application" category, the contestant's entry must install an application that bypasses all required code signing requirements for the device and must persist over a reboot. In the "Force Phone Unlock" category, the contestant will be given the opportunity to run their entry. Once complete, the phone will be locked and the contestant can either physically unlock the phone using confidential material extracted as part of their exploit or bypass the locking functionality using some other means.

A contestant has up to three (3) attempts to succeed. Each of the 3 attempts will be individually limited to a time period of five (5) minutes.  For an attempt to be deemed successful, all elements of the attempt must complete within the 5-minute window. All three (3) attempts must be completed within 20 minutes, excluding network configuration or device prerequisite time. An attempt must be launched from the target under test by either browsing to the malicious content in the default browser or by viewing/receiving a malicious MMS/SMS message.

A successful remote attack against these targets must require no user interaction beyond the action required to browse to the malicious content or view the malicious message. The attempt must occur within the user's session with no reboots, or logoff/logons. For example, having to interact with a dialog in order to successfully complete the exploit is not allowed.

The targets will be running on the latest, fully patched version of the operating system available on the selected target (Apple iOS or Google Android). All targets will be installed in their default configurations. The vulnerabilities utilized in the attack must be unknown, unpublished, and not previously reported to the vendor. A given vulnerability may only be used once across all categories.

To avoid interfering with licensed carrier networks, all RF attacks must occur within the provided RF isolation enclosure. The contestant is responsible for ensuring that the actions required to deliver the malicious MMS/SMS messages do not utilize public carrier networks.

Sponsor reserves the right to solely determine what constitutes a successful attack. The Sponsor may, in its sole discretion, choose to accept the entry(ies) and offer the prize(s) at a value less than the initial prize offering for a given category if the Sponsor deems that part of the exploit chain fails to meet the above rules.

Upon successful demonstration of the exploit, the contestant will provide Sponsor with a fully functioning exploit plus a whitepaper explaining the vulnerabilities and exploitation techniques used in the attack. In the case that multiple vulnerabilities were exploited to gain code execution, details about all of the vulnerabilities (memory corruption, infoleaks, escalations, etc.) leveraged and the sequence in which they are used must be provided to receive the prizes. Vulnerabilities and exploit techniques revealed by contest winners will be disclosed to the affected vendors and the exploits and whitepapers will become the property of the Sponsor in accordance with the ZDI researcher agreement.

6. INDEMNIFICATION BY CONTESTANT.

By entering the Contest, contestant releases and holds Sponsor harmless from any and all liability for any injuries, loss, or damage of any kind to the contestant or any other person, including personal injury, death, or property damage, resulting in whole or in part, directly or indirectly, from acceptance, possession, use, or misuse of any prize, participation in the Contest, any breach of the Contest Rules, or in any prize-related activity. The contestant agrees to fully indemnify Sponsor from any and all claims by third parties relating to the Contest, without limitation.

7. LIMITATION OF LIABILITY.

Contestant acknowledges and agrees that Sponsor assumes no responsibility or liability for any computer, online, software, telephone, hardware, or technical malfunctions that may occur. The Sponsor is not responsible for any incorrect or inaccurate information, whether caused by website users or by any of the equipment or programming associated with or utilized in the Contest or by any technical or human error which may occur in the administration of the Contest. The Sponsor is not responsible for any problems, failures, or technical malfunctions of any telephone network or lines, computer online systems, servers, providers, computer equipment, software, e-mail, players, or browsers, on account of technical problems or traffic congestion on the Internet, at any website, or on account of any combination of the foregoing. The Sponsor is not responsible for any injury or damage to contestant or to any computer related to or resulting from participating or downloading materials in this Contest. Contestant assumes liability for injuries caused or claimed to be caused by participating in the Contest, or by the acceptance, possession, use of, or failure to receive any prize. The Sponsor assumes no responsibility or liability in the event that the Contest cannot be conducted as planned for any reason, including those reasons beyond the control of the Sponsor, such as infection by computer virus, bugs, tampering, unauthorized intervention, fraud, technical failures, or corruption of the administration, security, fairness, integrity, natural disaster, or proper conduct of this Contest.

8. CONDUCT.

As a condition of participating in the Contest, each contestant agrees to be bound by these Contest Rules and indicates consent as part of the registration process. Contestant further agrees to be bound by the decisions of the Sponsor, which shall be final and binding in all respects. The Sponsor reserves the right, in its sole discretion, to disqualify any contestant found to be: (a) violating the Contest Rules; (b) tampering or attempting to tamper with the Contest or any of the equipment, the Contest website or Contest programming; (c) acting in an unsportsmanlike or disruptive manner, or with intent to annoy, abuse, threaten, or harass any other person. CAUTION: ANY ATTEMPT TO DELIBERATELY UNDERMINE THE LEGITIMATE OPERATION OF THE CONTEST MAY BE A VIOLATION OF CRIMINAL AND CIVIL LAWS. SHOULD SUCH AN ATTEMPT BE MADE, THE SPONSOR RESERVES THE RIGHT TO SEEK REMEDIES AND DAMAGES TO THE FULLEST EXTENT PERMITTED BY LAW, INCLUDING BUT NOT LIMITED TO CRIMINAL PROSECUTION.

9. PRIVACY / USE OF PERSONAL INFORMATION.

By participating in the Contest, contestant: (i) grants to the Sponsor the right to use his/her name, likeness, mailing address, telephone number, and e-mail address ("Personal Information") for the purpose of administering the Contest, including but not limited to contacting and announcing the winners; and (ii) acknowledges that the Sponsor may disclose his/her Personal Information to third-party agents and service providers of the Sponsor in connection with any of the activities listed in (i) above.

Sponsor will use the contestant's Personal Information only for identified purposes, and protect the contestant's Personal Information in a manner that is consistent with Sponsor's Privacy Policy at: http://www.trendmicro.com/us/about-us/legal-policies/privacy-statement/

10. INTELLECTUAL PROPERTY.

All intellectual property, including but not limited to trade-marks, trade names, logos, designs, promotional materials, web pages, source code, drawings, illustrations, slogans, and representations are owned by Sponsor and/or its affiliates. All rights are reserved. Unauthorized copying or use of any copyrighted material or intellectual property without the express written consent of its owner is strictly prohibited.

11. TERMINATION.

Sponsor reserves the right, in its sole discretion, to terminate the Contest, in whole or in part, and/or modify, amend, or suspend the Contest, and/or the Contest Rules in any way, at any time, for any reason without prior notice.

12. LAW.

These are the official Contest Rules. The Contest is subject to applicable laws and regulations. The Contest Rules are subject to change without notice in order to comply with any applicable laws or the policy of any other entity having jurisdiction over the Sponsor and/or the Contest. All issues and questions concerning the construction, validity, interpretation, and enforceability of the Contest Rules or the rights and obligations as between the contestant and the Sponsor in connection with the Contest shall be governed by and construed in accordance with the laws of Japan including procedural provisions without giving effect to any choice of law or conflict of law rules or provisions that would cause the application of any other jurisdiction's laws.

13. PRECEDENCE.

In the event of any discrepancy or inconsistency between the terms and conditions of the Contest Rules and disclosures or other statements contained in any Contest-related materials, the terms and conditions of the Contest Rules shall prevail, govern, and control.