{"id":3063,"date":"2011-03-10T09:39:01","date_gmt":"2011-03-10T09:39:01","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3063"},"modified":"2015-09-09T19:37:17","modified_gmt":"2015-09-09T11:37:17","slug":"day-one-at-pwn2own-takes-out-microsoft-internet-explorer-and-apple-safari","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2011\/03\/day-one-at-pwn2own-takes-out-microsoft-internet-explorer-and-apple-safari\/","title":{"rendered":"Day One At Pwn2Own Takes Out Microsoft Internet Explorer and Apple Safari"},"content":{"rendered":"<p>Well it&#8217;s March again and well we love March because it&#8217;s <a href=\"https:\/\/www.darknet.org.uk\/tag\/pwn2own\/\">Pwn2Own<\/a> time! Every year around this time we get some goodies to discuss way back since:<\/p>\n<ul>\n<li>2008 &#8211; <a href=\"https:\/\/www.darknet.org.uk\/2008\/03\/mac-owned-on-2nd-day-of-pwn2own-hack-contest\/\">Mac owned on 2nd day of Pwn2Own hack contest<\/a><\/li>\n<li>2009 &#8211; <a href=\"https:\/\/www.darknet.org.uk\/2009\/03\/charlie-miller-does-it-again-at-pwn2own\/\">Charlie Miller Does It Again At PWN2OWN<\/a><\/li>\n<li>2010 &#8211; <a href=\"https:\/\/www.darknet.org.uk\/2010\/04\/mozilla-beats-apple-microsoft-to-pwn2own-patch-for-firefox\/\">Mozilla Beats Apple &#038; Microsoft to Pwn2Own Patch For Firefox<\/a><\/li>\n<\/ul>\n<p>It took Microsoft till June last year to fix the Pwn2Own bug &#8211; <a href=\"https:\/\/www.darknet.org.uk\/2010\/06\/microsoft-patches-at-least-34-bugs-including-pwn2own-vulnerability\/\">Microsoft Patches At Least 34 Bugs Including Pwn2Own Vulnerability<\/a>.<\/p>\n<p>This time both <a href=\"https:\/\/www.darknet.org.uk\/tag\/internet-explorer\/\">Internet Explorer<\/a> and <a href=\"https:\/\/www.darknet.org.uk\/tag\/safari\/\">Safari<\/a> fell on the first day! <\/p>\n<blockquote><p>Contestants in a high-stakes hacking contest had no trouble toppling the Apple Safari and Microsoft Internet Explorer browsers, proving for a fifth year in a row that no software or application is safe from people with the expertise and motivation to exploit them.<\/p>\n<p>The attacks came on Day One of the Pwn2Own contest, which pays more than $15,000 apiece for exploits that successfully give the attacker full remote access of the targeted machine. Wednesday&#8217;s event saw hackers take complete control of a fully patched Sony Vaio and MacBook Air by compromising IE and Safari respectively. Google&#8217;s Chrome browser was also up for grabs, but no one stepped forward to try hacking it.<\/p>\n<p>\u201cEvery browser, every operating system, has its own vulnerabilities,\u201d said Chaouki Bekrar, CEO of Vupen Security and the contestant who successfully hacked Safari. \u201cThis is what we wanted to demonstrate \u2013 that we can create a very reliable exploit for Apple Mac OS and Safari without even crashing the browser.\u201d<\/p>\n<p>Contest rules forbid him from disclosing most technical details behind the vulnerability, but he was permitted to say that it involved what&#8217;s known as a use-after-free flaw in the Apple browser. He said the exploit used a technique known as return-oriented programming to bypass a security protection known as data execution prevention that is built into many Apple programs.<\/p><\/blockquote>\n<p>There have been a barrage of patches recently too with Microsoft patching some very serious bugs in the <a href=\"http:\/\/isc.sans.edu\/diary.html?storyid=10510&#038;rss\">March 2011 Black Tuesday<\/a>, <a href=\"http:\/\/www.networkworld.com\/news\/2011\/030911-apple-patches-critical-mac-bugs.html?source=nww_rss\">Apple patches critical Mac bugs with Java updates<\/a>, <a href=\"http:\/\/lists.apple.com\/archives\/security-announce\/2011\/Mar\/msg00004.html\">Apple patching 62 bugs in Safari<\/a> and Jon Oberheide killing his own <a href=\"https:\/\/www.darknet.org.uk\/tag\/internet-explorer\/\">Android<\/a> bug by <a href=\"http:\/\/www.theregister.co.uk\/2011\/03\/07\/android_pwn2own_bug_killed\/\">reporting it to Google<\/a>.<\/p>\n<p>Also sadly one of the Pwn2Own champions <a href=\"https:\/\/www.darknet.org.uk\/tag\/geohot\/\">Geohot<\/a> wasn&#8217;t present most likely to to the <a href=\"https:\/\/www.darknet.org.uk\/2011\/01\/happy-new-year-geohot-court-orders-seizure-of-ps3-hackers-computers\/\">shit storm Sony is throwing at him<\/a>.<\/p>\n<p>It&#8217;ll be interesting to what else comes out of Pwn2Own this year.<\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<blockquote><p>After building the tools from scratch, it took him about two weeks to find the bug and set out to exploit it. The result was an attack that reliably commandeers a Mac when Safari visits a website that hosts the malicious code.<\/p>\n<p>\u201cJust after visiting the webpage with the affected version of Safari, we can, for example, launch the calculator or open a shell or do anything else we want,\u201d he said a minute or two after demonstrating the exploit at the contest, which was attended by members of Apple&#8217;s security team. \u201cWe have the same privileges as the user who visited the webpage.\u201d<\/p>\n<p>He said users would have no way of knowing their machines have been compromised. There is no prompt asking for a password. The only way to thwart the attack is to run Safari from an account that has been configured to have limited privileges.<\/p>\n<p>Under competition rules, contestants drew a lottery to determine who was the first to attempt hacking a particular browser. Once a browser was compromised, it was eliminated from the running. Both IE and Safari were hacked on the first try.<\/p>\n<p>\u201cI have an exploit all ready to go, and now it&#8217;s just sitting in my bag,\u201d said Charlie Miller, a three-time Pwn2Own winner, shortly after Bekrar took this year&#8217;s prize. \u201cYou&#8217;d think Apple would be concerned about it.\u201d<\/p>\n<p>Miller said he&#8217;s had the working attack for more than nine months now. Even after Apple patched a whopping 62 Safari security bugs just hours before the contest started, Miller&#8217;s exploit still worked, he said.<\/p><\/blockquote>\n<p><a href=\"https:\/\/www.darknet.org.uk\/tag\/charlie-miller\/\">Charlie Miller<\/a> has a working exploit sitting in his back too after Bekrar already took the prize. It seems like it&#8217;s really quite worth developing a reliable, working 0-day exploit for $15,000!<\/p>\n<p>The new sandbox in IE got pwned pretty easily too, which shows..slapping on some tonka toy security controls isn&#8217;t ever going to stop a dedicated attacker. There was one contestant who stepped up to the plate to take down <a href=\"https:\/\/www.darknet.org.uk\/tag\/chrome\/\">Google&#8217;s Chrome<\/a>, but perhaps the exploit didn&#8217;t work as there&#8217;s no reports on that.<\/p>\n<p>Day two of Pwn2Own will see attacks on Smart-phone platforms &#8211; Windows 7 Mobile, an iPhone 4, a BlackBerry Torch 9800, and a Nexus S running Google&#8217;s Android. There are multiple contestants signed up for each platform!<\/p>\n<p>Source: <a href=\"http:\/\/www.theregister.co.uk\/2011\/03\/10\/apple_safari_ie_stomped\/\">The Register<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Well it&#8217;s March again and well we love March because it&#8217;s Pwn2Own time! Every year around this time we get some goodies to discuss way back since: 2008 &#8211; Mac owned on 2nd day of Pwn2Own hack contest 2009 &#8211; Charlie Miller Does It Again At PWN2OWN 2010 &#8211; Mozilla Beats Apple &#038; Microsoft to [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[18,10,4],"tags":[61,3831,2506,355,390,2823,2507,106,105,57],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3063"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3063"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3063\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3063"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3063"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3063"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}