Slashdot Log In
All Five Smartphones Survive Pwn2Own Contest
Posted by
Soulskill
on Wed Mar 25, 2009 08:41 AM
from the can't-hit-a-mobile-target dept.
from the can't-hit-a-mobile-target dept.
CWmike writes "Although three of the four browsers that were targets in the PWN2OWN hacking contest quickly fell to a pair of researchers, none of the smartphones were successfully exploited. TippingPoint had offered $10,000 for each exploit on any of the phones, which included the iPhone and the BlackBerry, as well as phones running the Windows Mobile, Symbian and Android operating systems. 'With the mobile devices so limited on memory and processing power, a lot of [researchers'] main exploit techniques are not able to work,' said TippingPoint's Terri Forslof. 'Take, for example, [Charlie] Miller's Safari exploit,' referring to Miller's 10-second hack of a MacBook via an unpatched Safari vulnerability that he'd known about for more than a year. 'People wondered why wouldn't it work on the iPhone, why didn't he go for the $10,000?' she said. 'The vulnerability is absolutely there, but it's a lot tougher to exploit on the iPhone.'"
Chrome was the only browser at the contest that was not successfully exploited. We previously discussed day one of the contest, and a summary of day two is available as well.
Related Stories
[+]
IT: Next Pwn2Own Contest Targets IE8, Firefox, iPhone 64 comments
Windows Secrets writes "After two straight years of taking dead aim at Macbooks and Windows-powered machines, hackers at this year's CanSecWest conference will have shiny new targets: Web browsers and mobile phones. According to CanSecWest organisers, there will be two separate Pwn2Own competitions this year — one pitting hackers against IE8, Firefox 3 and Safari and another targeting Google Android, Apple iPhone, Nokia Symbian and Windows Mobile."
[+]
IT: First Pwn2Own 2009 Contest Winners Emerge 98 comments
mellowdonkey writes "Last year's CanSecWest hacking contest winner, Charlie Miller, does it again this year in the 2009 Pwn2Own contest. Charlie was the first to compromise Safari this year to win a brand spankin new Macbook. Nils, the other winner, was able to use three separate zero day exploits to whack IE8, Firefox, and Safari as well. Full detail and pictures are available from the sponsor, TippingPoint, who acquired all of the exploits through their Zero Day Initiative program."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
All 5, eh? (Score:3, Insightful)
Re: (Score:2)
Exactly what I was thinking. I went to the article to see what the 5 were and didn't really glean much more information out of it than what was in the summary.
Re: (Score:3, Informative)
Exactly what I was thinking. I went to the article to see what the 5 were and didn't really glean much more information out of it than what was in the summary.
I had no trouble identifying the five that were tested:
iphone, blackberry, windows, symbian, android.
Re: (Score:2)
"windows, symbian, android" gives no indication of the phones they were running on.
Re: (Score:2)
After much appreciated feedback from the contestants, weâ(TM)ll be sure that such details as version numbers of the OS and exact hardware specs are made available well in advance.
HTH
Re: (Score:2)
I think you are missing the GP's point that they only named two of the five devices...
Oh, I see.
But if that's the case, what were the two -devices- they did name? I only see one.
I mean, techically there are a couple different iphone models, but assuming a current model, the only difference between them is flash capacity, so I'll give you that one.
But what's a "Blackberry"? Bold? Storm? Curve? Pearl...? Blackberry doesn't really tell me anything more specific than 'an Android phone'.
Not any tougher on iPhone according TFA (Score:5, Informative)
"should work on the iPhone but the bug couldn't (be) used twice in the competition."
So the iPhone should be quite vulnerable, but wasn't compromised because it wouldn't have been eligible for the award since it was the same exploit used against OS X in the first day.
Re: (Score:2)
It's quite possible for Mobile Safari in iPhone to be vulnerable without that making the phone pwnable. For example, one reason could be that the iPhone OS kernel is only able to execute signed code - unless the phone has been pwned and the signing restrictions disabled. There are probably ways around this from userland, too, but I guess they are pretty hard to find and even harder to exploit. And also, owning Mobile Safari would only give you a uid 501 process, from there you'd have to find some way to esc
Re: (Score:2)
What
Re:Not any tougher on iPhone according TFA (Score:5, Informative)
Parent
Re: (Score:2)
Chrome is built using WebKit.
Which raises the question, why is Safari less secure than Chrome?
Re: (Score:2, Funny)
Chrome is built using WebKit.
Which raises the question, why is Safari less secure than Chrome?
Safari was developed by Apple therefore security was overlooked for style and usability.
A Symbian with a browser? (Score:5, Funny)
Chrome only browser ... (Score:5, Interesting)
Chrome was the only browser in the contest that was not successfully exploited... why didn't they include Opera, or any of the non-webkit open source browsers other than Firefox? (Ok, they may be fairly obscure, but surely Opera is well known enough, right?)
Re:Chrome only browser ... (Score:5, Funny)
They didn't want to give Opera any more ammunition against the other browsers.
Parent
Re:Chrome only browser ... (Score:5, Insightful)
as someone who recently gave Opera another go, i can see why.
i would appear that i've been missing out
Parent
Re: (Score:2, Funny)
Re: (Score:3, Insightful)
I switched to Opera when FF was in version 2, because Opera was considerably faster in most cases. Now that FF is up to speed with Opera, I'm still with it because I'm more familiar with it...and it feels more 'complete' out of the box to me...no need for extensions. For someone who uses it regularly on four different machines (and irregularly on several more), that's important.
Sure, it's not open source, but I'm concerned about free beer more than free speech (not to say that it's unimportant, I just hav
Re: (Score:3, Insightful)
Re: (Score:2)
It's poor reporting, really. Make Chrome look like a hero, when there are other browsers that just weren't tested at all... (and would most likely pass).
[posted from opera]
Re:Chrome only browser ... (Score:4, Insightful)
For the same reason high school sports teams don't play NFL teams; it just would be disheartening to the players.
My guess is that Opera never really got the attention because it never had a big company pushing it (MS, Apple, Google, and Firefox had the whole Mozilla/FOSS thing).
Parent
Hmm (Score:5, Funny)
Miller's 10-second hack of a MacBook via an unpatched Safari vulnerability that he'd known about for more than a year.
Definitely a black hat then, as I'm assuming if he'd reported the vulnerability when he'd found it even Apple would have patched it by now.
Re:Hmm (Score:5, Interesting)
Did you consider reporting the vulnerability to Apple?
I never give up free bugs. I have a new campaign. It's called NO MORE FREE BUGS. Vulnerabilities have a market value so it makes no sense to work hard to find a bug, write an exploit and then give it away. Apple pays people to do the same job so we know there's value to this work. No more free bugs.
Parent
Re:Hmm (Score:5, Interesting)
No, it's because he's not going to do free work for Apple.
That's precisely the attitude of a black hat. A responsible hacker notifies the vendor or author of the issue, giving them a reasonable amount of time to release a fix. If the fix is forthcoming in a timely manner, the hacker should be thanked in the release notes and is then free to post a description of the issue along with a proof of concept exploit if they like. If a fix is not forthcoming in a timely manner, and no reasonable explanation given by the vendor or author, then the hacker releases the description in the knowledge that they've adhered to the widely acknowledged good practice. This is responsible full disclosure.
A black hat doesn't notify the vendor in order to gain some kind of material benefit - be it selling the exploit or using it directly for personal gain. Funnily enough personal gain is what this guy did it for, making him a scumbag black hat hacker.
Parent
Re: (Score:3, Insightful)
You talked earlier about the value of vulnerabilities. Was it a surprise that he (Nils) basically gave up three "high-value" bugs for $5,000 each?
It's clear he's incredibly talented. I was shocked when I saw someone sign up to go after IE 8. You can get paid a lot more than $5,000 for one of those bugs. I've talked to a lot of smart, knowledgeable people and no one knows exactly how he did it. He could easily get $50,000 for that vulnerability. I'd say $50,000 is a low-end price point.
For the amount of time he spent to do what he did on IE and Firefox, he could have found and exploited five or 10 Safari bugs. With the way they're paying $5,000 for every verifiable bug, he could have spent that same time and resources and make $25,000 or $30,000 easily just by going after Safari on Mac.
Re: (Score:2)
BTW Apple pays people to report verifiable bugs to them.
So your original point is moot - he could of been paid by Apple for finding and reporting issues. The fact he didn't makes it even more suspicious that he had something else in mind, perhaps selling to someone prepared to pay more. I wonder who that someone might be? Surely not someone with less than entirely innocent intentions? To be honest though, all this talk of people paying tens of thousands of dollars for an exploit sounds more like a black h
Re: (Score:2)
No, he's just not an idiot. BTW Apple pays people to report verifiable bugs to them.
Interesting. Since I (and perhaps others) have never heard of this, perhaps you could corroborate your story with a link to Apple's policy on this?
Re: (Score:2)
You've got to be careful though, it could also be blackmail.
You are under obligation to inform the vendor (Score:3, Insightful)
The static point is that if you find an exploit, you are under no obligation to inform the vendor. You are not evil if you do not inform the vendor.
I couldn't disagree more. If I walk by a house and see that the door is standing wide open, and then I see the owner on the street a couple minutes later, the ethics are clear. I should tell the guy he left his door open. I'm under no legal obligation but I should because it is the right thing to do. If he gets robbed later I should feel bad because I could have helped prevent it.
Well maybe you say, no, they're a business. Doesn't matter. If I'm in a jewelry store and see that a clerk forgot to put away a d
Re: (Score:2)
Emphasis mine. The very quote you mentioned clearly states he uses exploits for profit. The GP is completely right- this guy is a black hat.
Re: (Score:2, Interesting)
Emphasis mine.
There is no emphasis...
The very quote you mentioned clearly states he uses exploits for profit.
No it doesn't. He said he's not going to go through the trouble of finding and bugs and writing an exploit and then giving it away to Apple for free when they pay others money to do the exact same thing.
The GP is completely right- this guy is a black hat.
Sorry, the GP is wrong unless you have some information of him actually using any exploits for malicious use which I doubt you have.
Re: (Score:2)
There's this subtle difference (well it must be too subtle for you) between where you get your payment from. Apart from the vendor, Apple in this case, I struggle to think of any other source of payment for an exploit that isn't, well, dodgy. Although I seem to recall from my days on the security mailing lists that there were plenty of people for whom the kudos of their peers was payment enough.
Re: (Score:2)
Because everyone wants to hire a security firm that employs morally bankrupt people. I'm sure his employers are so proud.
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Why Safari? Why didn't you go after IE or Safari?
It's really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don't do. Hacking into Macs is so much easier. You don't have to jump through hoops and deal with all the anti-exploit mitigations you'd find in Windows.
It's more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesn't have anti-exploit stuff built into it.
With my Safari exploit, I put the code into a process and I know exactly where it's going to be. There's no randomization. I know when I jump there, the code is there and I can execute it there. On Windows, the code might show up but I don't know where it is. Even if I get to the code, it's not executable. Those are two hurdles that Macs don't have.
It's clear that all three browsers (Safari, IE and Firefox) have bugs. Code execution holes everywhere. But that's only half the equation. The other half is exploiting it. There's almost no hurdle to jump through on Mac OS X.
Looks like all that supposed security you hear about in Mac OS X is really just a huge joke.
Re: (Score:2)
Re: (Score:2)
Looks like all that supposed security you hear about in Mac OS X is really just a huge joke.
Not really. The ASLR can be bypassed, and the NX support is indeed quite incomplete in Leopard (it's heap only IIRC), but the real strength of OS X's security comes from the Unix permissions model. It's still very tricky to write malware that, say, turns a Mac into a zombied warez server. It's still difficult to get root, which would be necessary to do most of the useful things you can do with a compromised box.
On Windows, once you've got access to a user account you've got root, since 9 times out of 10
Re:Hmm (Score:4, Funny)
Looks like all that supposed security you hear about in Mac OS X is really just a huge joke.
A lot of it is, yes. And, some of that supposed security in Windows Vista... really is improved security, not a joke.
From the average user's perspective, Macs are more secure right now, because they're not targeted. I don't run any antivirus software on my Mac, because I'm confident that I won't encounter a Mac virus. In general, the people writing viruses don't know how to write for Macs, and the people writing for Macs don't want to write viruses. There used to be a handful of Mac viruses back in the 90s, but those have all gone away. Every once in awhile we hear about a new proof of concept, but nothing ever really comes of it.
But there's nothing inherent about the way Mac OS X works that guarantees this situation to remain true. As Macs gain marketshare, they'll gain mindshare among malware authors. As buying a Mac becomes a more attractive option to regular people, it will become a more attractive option to malware authors, and once they have a Mac to play with, they'll start writing malware for it.
Meanwhile, everybody says Vista is a joke; they'll upgrade when you pry XP from their cold dead fingers. People who have never even tried Vista bitch about "Cancel / Allow" dialogs. They say Microsoft completely dropped the ball by breaking compatibility with older software. While I'll be the first to agree that UAC's UI leaves much to be desired, I do leave it turned on*, and I generally know when to expect a prompt. For the thing in the system tray that needs Administrator privileges, I went to the trouble of working around UAC by adding it as a scheduled task that runs on login - this is far too complicated for normal users, and obviously either the software that needs this needs to be updated, or UAC needs an "always allow" option.
Microsoft broke compatibility because they had to in order to improve security. Every once in awhile an argument breaks out on Slashdot that goes something like this:
1) Windows sucks, because normal user accounts have Administrator privileges, which is just like running as root on Linux, which nobody ever does.
2) That's because if you don't have Administrator privileges, half your applications won't run.
3) Windows sucks, because Linux apps run just fine without needing root privileges.
4) It's not Microsoft's fault, it's the application developers' fault for designing their app with the expectation that it will always have Administrator privileges.
5) It is Microsoft's fault, because those app devs designed their app to work on Win98, which had no concept of per-user security, so apps could reliably expect to have unfettered write access to C:\Program Files. Microsoft shouldn't have allowed this.
6) Macs are awesome!
7) It's the year of Linux on the desktop!
8) Shut up, both of you.
Microsoft knew the status quo was broken, and that brokenness isn't sustainable. Their only long-term choice was to break compatibility by forcing applications to conform to new security standards. They've done that, and everyone bitched, but the apps have been fixed. Nobody realizes the apps have been fixed, because everybody switched back to (or stayed with) XP, but Windows 7 will be hugely popular (Microsoft is also fixing some of the real problems with Vista).
Parent
Re: (Score:2)
I don't think anyone claimed that OS X was or would be going forward perfect. That doesn't mean that it is not well ahead of Windows in terms of a secure design.
The quote makes it clear that in fact, OSX is well behind Windows in terms of secure design. It doesn't have NX (or similar) support, and it doesn't have address randomization, and that's fucking pathetic because both technologies predate OSX considerably*, but neither predates Windows XP.
* I don't think literal NX bit support predates OSX, but the idea is older and does not require hardware support to implement, although hardware support improves things considerably. You can still have support for non-exec
Re: (Score:2)
Re: (Score:2)
Apple tends to sweep security problems under the rug as much as possible.
Their track record has been a bit variable, but by his own admission this guy didn't contact Apple. He sat on the exploit, in the knowledge that it could be used for no good by others, making him little better than the really bad guys. He then used the exploit for personal gain. Classy.
Re: (Score:2)
Unless he was worried that the exploit would be discovered by malicious crackers, sitting on the exploit was no risk.
How does he know that others haven't discovered the exploit (unless he believes he's more l33t than anyone else).
How dare he use his technical skills for personal gain.
As others have pointed out, Apple pay for verified bugs. By sitting on it he simply made it more likely someone else would get paid for it, unless he thought there was a more profitable use for the bug. And I wonder what th
Grammar Nazi alert (Score:3, Funny)
"none....was..." puhleeze!
Phones (Score:2, Informative)
A quick Google Pulled up the Phones as:
Phones (and associated test platform)
* Blackberry(TBA)
* Android(Dev G1)
* iPhone(locked 2.0)
* Nokia/Symbian(N95-1)
* Windows Mobile (HTC Touch)
Re:Phones (Score:4, Informative)
A quick Google Pulled up the Phones as:
Phones (and associated test platform)
* Blackberry(TBA)
* Android(Dev G1)
* iPhone(locked 2.0)
* Nokia/Symbian(N95-1)
* Windows Mobile (HTC Touch)
The Blackberry was apparently a "Bold", at least, that's what one of the related blog posts refers to.
Parent
Final Score (From DVLabs blog) (Score:5, Informative)
Browsers
Chrome: 0***
IE8: 1**
Firefox: 1(1)*
Safari: 2(1)*
Mobile Browsers
Android: 0
iPhone: 0
Nokia/Symbian: 0
Windows Mobile: 0
Blackberry: 0****
*Numbers in parenthesis indicate Successful exploits that fell outside the contest criteria and therefore could not be rewarded.
**Exploit Confirmed by MS
***Chrome was impacted by one of the flaws, although exploit was not possible using any current known techniques.
****The Blackberry was attempted and resulted in "Something Interesting", but not an exploit.
Re:Apple security (Score:4, Funny)
[citation needed]
Parent
Re: (Score:2)
no.
Not likely... (Score:2)
After all... As TSA states - there is a world market for maybe five smartphones.
Re:DIE HACKER DIE (Score:4, Funny)
DIE HACKER DIE
Your German is unintelligible to me.
Parent