Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Management & Strategy

Windows, macOS Hacked at Pwn2Own 2017

Researchers hacked Windows, macOS, Firefox, Edge, Safari and Flash Player on the second day of the Pwn2Own 2017 competition taking place these days alongside the CanSecWest conference in Vancouver, Canada.

Researchers hacked Windows, macOS, Firefox, Edge, Safari and Flash Player on the second day of the Pwn2Own 2017 competition taking place these days alongside the CanSecWest conference in Vancouver, Canada.

On the first day, participants successfully demonstrated exploits against Edge, Safari, Ubuntu and Adobe Reader, taking home over $230,000 of the $1 million prize pool. On the second day, white hat hackers earned $340,000 for their exploits.

Adobe Flash Player was successfully targeted by both Qihoo360’s 360 Security team and Tencent’s Team Sniper, each earning $40,000 for their exploits. 360 Security used four bugs, while Team Sniper leveraged two use-after-free vulnerabilities.

The Qihoo360 team also managed to break Apple’s macOS operating system, earning $10,000 for a privilege escalation that involved an information disclosure flaw and a race condition in the kernel. The same amount was earned by the Chaitin Security Research Lab team, which elevated privileges on macOS via an information disclosure bug and an out-of-bounds in the kernel.

360 Security also earned $35,000 for hacking Apple’s Safari browser and escalating privileges to root on macOS. Team Sniper was paid the same amount for an exploit chain that achieved the same goal.

The Windows operating system was hacked by both 360 Security and Team Sniper, each taking home $15,000 for exploits that involved out-of-bounds and integer overflow vulnerabilities in the kernel.

Microsoft’s Edge browser was successfully targeted on the second day of Pwn2Own 2017 by two groups from Tencent: Team Sniper and Sword Team. They each received $55,000 for disclosing their exploits.

Mozilla Firefox was hacked by the Chaitin Security team via an integer overflow in the browser and an uninitialized buffer weakness in the Windows kernel for privilege escalation. Moritz Jodeit of Blue Frost Security also targeted Firefox, but failed to complete the exploit chain in the allocated timeframe.

Advertisement. Scroll to continue reading.

Some of the Tencent teams – the Chinese firm had four teams in the competition – withdrew their entries or were disqualified for not using zero-day vulnerabilities.

Due to the unprecedented number of contestants and entries, some of the exploits will be demonstrated on the third day of the event, when participants will take a crack at Edge, including with a VM escape, and VMware Workstation. Depending on the results, the total amount paid out this year could exceed $800,000, nearly double compared to Pwn2Own 2016

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Discover strategies for vendor selection, integration to minimize redundancies, and maximizing ROI from your cybersecurity investments. Gain actionable insights to ensure your stack is ready for tomorrow’s challenges.

Register

Dive into critical topics such as incident response, threat intelligence, and attack surface management. Learn how to align cyber resilience plans with business objectives to reduce potential impacts and secure your organization in an ever-evolving threat landscape.

Register

People on the Move

Dan Pagel has been named the new CEO of risk management and remediation firm Brinqa.

The City of Phoenix has promoted Mitch Kohlbecker to the role of Chief Information Security Officer.

Gigamon has promoted Tony Jarjoura to CFO and Ram Bhide has been hired as Senior VP of engineering.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.