iPhone, Safari, IE8, Firefox fall on day one of Pwn2Own

[Kari]

iPhone, Safari, IE8, Firefox all fall on day one of Pwn2Own

'Technically impressive' exploit of IE8 bypasses DEP, ASLR on Windows 7 at hacking contest

Hacker busts IE8 on Microsoft Windows 7 in just two minutes Dragon NaturallySpeaking 10 offers hands-off control of your computer Sprint stops ad claim of 'most dependable 3G network' after Verizon complains VMware, Citrix struggle with 'bare-metal' desktop delays Malware attack uses China World Expo guise Mozilla discloses more Firefox flaws

Computerworld - Hackers took down Apple's iPhone and Safari browser, Microsoft's Internet Explore 8 (IE8) and Mozilla's Firefox within minutes at today's Pwn2Own contest, as expected.

The two-man team of Vincenzo Iozzo and Ralf-Philipp Weinmann exploited the iPhone in under five minutes, said a spokeswoman for 3Com TippingPoint, the security company that sponsored the contest. The pair also walked away with $15,000 in cash, a record prize for the challenge, which is in its fourth year.

iPhone, Safari, IE8, Firefox all fall on day one of Pwn2Own

 

[motc7]

iPhone, Safari, IE8, Firefox all fall on day one of Pwn2Own

'Technically impressive' exploit of IE8 bypasses DEP, ASLR on Windows 7 at hacking contest

Hacker busts IE8 on Microsoft Windows 7 in just two minutes Dragon NaturallySpeaking 10 offers hands-off control of your computer Sprint stops ad claim of 'most dependable 3G network' after Verizon complains VMware, Citrix struggle with 'bare-metal' desktop delays Malware attack uses China World Expo guise Mozilla discloses more Firefox flaws

Computerworld - Hackers took down Apple's iPhone and Safari browser, Microsoft's Internet Explore 8 (IE8) and Mozilla's Firefox within minutes at today's Pwn2Own contest, as expected.

The two-man team of Vincenzo Iozzo and Ralf-Philipp Weinmann exploited the iPhone in under five minutes, said a spokeswoman for 3Com TippingPoint, the security company that sponsored the contest. The pair also walked away with $15,000 in cash, a record prize for the challenge, which is in its fourth year.

iPhone, Safari, IE8, Firefox all fall on day one of Pwn2Own

Hack an iPhone? There's an app for that.

 

[tw33k]

Here's a link to Peter Vreugdenhil's exploits. Not a specific "How to" guide before anyone gets overly excited. It's very interesting none-the-less and it only took him 2 minutes!

 

[Kari]

That was an interesting read! Printing it out now. Thanks, tw33k.

 

[tw33k]

More than welcome my friend

 

[kookster]

Man most of that was like gibberish to me, but it was still cool to read.

 

[Kari]

Man most of that was like gibberish to me, but it was still cool to read.

To put it very simple, he found a way to avoid DEP, thus letting him to execute code where it's normally not possible.

A clear vulnerability. He deserved his price.

Kari

 

[Kari]

Notice that although he can run an app (Calculator), the IE crashes at the same moment the app is launched.

 

[Product FRED]

Woops, I'll just delete my post then. It's because ]YOUTUBE was at the end of the URL.

 

[CarlTR6]

It just goes to show that nothing is really secure.

 

[kookster]

Man most of that was like gibberish to me, but it was still cool to read.

To put it very simple, he found a way to avoid DEP, thus letting him to execute code where it's normally not possible.

A clear vulnerability. He deserved his price.

Kari

Yeah thats about all I got.

It just goes to show that nothing is really secure.

Yep, there will always be mistakes/holes/something that can be infiltrated or abused. Because we can't make anything perfect.

 

[pillainp]

To my mind, the real reason would be complacency. Any time time you think you are secure, if you are big enough, someone will try to take you down.

 

[arkhi]

Question: Does this mean that it will also bypass UAC?

 

[si8mon]

Google chrome was the only main browser not to be successfully hacked during the contest. Its either the hackers don't care about chrome or the browser has excellent security.

 

[Product FRED]

Google chrome was the only main browser not to be successfully hacked during the contest. Its either the hackers don't care about chrome or the browser has excellent security.

That's because it wasn't used in the contest. They do care about Chrome, but because of its modular processes, it's more difficult to exploit than, say, IE, which is by comparison a much bigger target. Plus Google patched up an exploit a few days before the contest.

 

[Ruudfood]

I wonder how Opera got on!