Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

11/14/2013
02:39 PM
50%
50%

Mobile Pwn2Own Hacking Contest Claims Nexus 4 Among Victims

Security researchers received thousands of dollars in cash prizes at this year's Mobile Pwn2Own contest

When it was over, the Nexus 4, Samsung Galaxy S4, and Apple iPhone could all count themselves as hacking victims.

Fortunately, it happened in the name of research at the Mobile Pwn2Own contest at the PacSec 2013 Conference this week in Tokyo. During the past two days, the contest saw researchers use application vulnerabilities to compromise each of the devices and walk away with thousands of dollars in cash prizes.

The event was sponsored by Hewlett-Packard's Zero Day Initiative (ZDI), as well as BlackBerry and the Google Android and Chrome security teams. Before the competition ended today, a researcher under the alias "Pinkie Pie" compromised Google Chrome on both a Nexus 4 and Samsung Galaxy S4, and was awarded $50,000. The researcher's exploit took advantage of two vulnerabilities -- an integer overflow issue and a full sandbox escape.

"Similar to the exploits we saw on day one of our contest, in order for the user's device to be successfully compromised, they would need to be enticed to visit a malicious site in order to be exposed to the malicious code," blogged Heather Goudley, senior security content developer at HP. "Again the attack depends on first compromising the user to get them to take an action (e.g. clicking a link in an email, or an SMS or on another web page) and then compromising the device by exploiting these vulnerabilities. The final outcome would be the remote execution of code of an attacker's choice."

This vulnerability has been disclosed to Google, one of multiple vendors that will have to deal with patching vulnerabilities uncovered in the contest.

On Wednesday, the Keen Team of Keen Cloud Tech won $27,500 for demonstrating two exploits against Safari on an iPhone 5 that allowed them to steal a photo on iOS version 6.1.4 and capture Facebook credentials on iOS version 7.0.3. Neither of the devices was jailbroken, and both exploit demonstrations took no more than five minutes. For the exploit to work, the user would need to click on a link in an email, SMS, or Web page.

"Both of the Safari exploits leveraged memory corruption vulnerabilities, which allowed them to gain access to Facebook cookies [on iOS 7.0.3] and photos stored on the device [on iOS 6.1.4]," Brian Gorenc, manager of HP's ZDI, told Dark Reading.

Also Wednesday, Japan's Team MBSD of Mitsui Bussan Secure Directions won $40,000 after demonstrating exploits against several applications installed by default on the Samsung Galaxy S4. After exploiting the apps, the researchers were able to install malware on the device and steal confidential data. For the attack to work, the user must be tricked into visiting an attacker-controlled malicious website.

[The biggest security weaknesses in most Android smartphones today are the custom apps and features that come packaged with the devices, new research shows. See Custom Features Incur Security Flaws In Popular Android Smartphones.]

"The implications for this exploit are worrisome," Goudley blogged. "While you may be reticent to click on links (heeding the commonly-given, if somewhat ridiculous advice to 'click carefully') it is unlikely that you assess risk and use caution the same way on your mobile devices as you do on your desktop. The message here, however, is clear -- mobile platforms are vulnerable to the same or very similar methods of malware distribution that plague the desktop and you would be wise to take heed.

"One of the reasons HP's Zero Day Initiative was excited to bring the competition to Tokyo was to get a firsthand look at the security research happening on this side of the globe. We were lucky enough to have teams from both China and Japan compete and win this year."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11107
PUBLISHED: 2020-04-02
An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-contol.ini for all users (including admins) to enable arbitrary command execution.
CVE-2020-11444
PUBLISHED: 2020-04-02
Sonatype Nexus Repository Manager 3.x up to and including 3.21.2 has Incorrect Access Control.
CVE-2020-7617
PUBLISHED: 2020-04-02
ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' payload.
CVE-2020-8835
PUBLISHED: 2020-04-02
In the Linux kernel 5.5.0 and newer, the bpf verifier (kernel/bpf/verifier.c) did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. The vulnerability also affects the Linux 5.4 stable series, starting with v5.4.7, as the intr...
CVE-2020-8423
PUBLISHED: 2020-04-02
A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 (firmware version 3.16.9) devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the configuration of the Wi-Fi network.