
VANCOUVER, B.C.–Researchers on Wednesday demonstrated that they could hack a non-jailbroken iPhone, Safari running on Snow Leopard and Internet Explorer 8 and Firefox on Windows 7 as part of the annual Pwn2Own contest at the CanSecWest security show here.
Charlie Miller, principal security analyst at Independent Security Evaluators, won $10,000 after hacking Safari on a MacBook Pro without having physical access to the machine. Miller won $5,000 last year by exploiting a hole in Safari, and in 2008 nabbed $10,000 hacking a MacBook Air, all on the same computer.
Peter Vreugdenhil, an independent security researcher from the Netherlands, will receive $10,000 for using his exploit to bypass security features in IE 8.
Also winning $10,000 was Nils, head of research at UK-based MWR InfoSecurity, who targeted Firefox on 64-bit Windows 7. He declined to provide his last name. As a computer science student at the University of Oldenburg in Germany last year he won $15,000 for exploits he demonstrated in IE 8, Safari, and Firefox.
And finally, Ralf Philipp Weinmann, of the University of Luxembourg, and Vincenzo Iozzo, of German company Zynamics, hacked the iPhone and will share the $15,000 prize. Because Iozzo was delayed en route to the contest, his Zynamics colleague Thomas Dullien, better known as Halvar Flake in the security community, served as his proxy, organizers of the contest sponsored by TippingPoint’s Zero Day Initiative said.
Miller declined to provide details on his exploit, but said the target computer was compromised after visiting a Web site hosting the malicious code.
“I got an interactive shell (interface) on his box so I could run any commands I want,” he said. “He had no idea and his machine was totally patched.”
Miller wrote the exploit in less than a week. “It was very reliable,” he said. “Some researchers say it’s ‘weaponized,’ which means it always works.”
To hack IE 8, Vreugdenhil said he exploited two vulnerabilities in a four-part attack that involved bypassing ASLR (Address Space Layout Randomization) and evading DEP (Data Execution Prevention), which are designed to help stop attacks on the browser. As in the other attacks, the system was compromised when the browser visited a Web site hosting the attack code.
Read More
Source: http://news.cnet.com
please wait...
Rating: 0.0/10 (0 votes cast)