Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

11/14/2013
02:39 PM
50%
50%

Mobile Pwn2Own Hacking Contest Claims Nexus 4 Among Victims

Security researchers received thousands of dollars in cash prizes at this year's Mobile Pwn2Own contest

When it was over, the Nexus 4, Samsung Galaxy S4, and Apple iPhone could all count themselves as hacking victims.

Fortunately, it happened in the name of research at the Mobile Pwn2Own contest at the PacSec 2013 Conference this week in Tokyo. During the past two days, the contest saw researchers use application vulnerabilities to compromise each of the devices and walk away with thousands of dollars in cash prizes.

The event was sponsored by Hewlett-Packard's Zero Day Initiative (ZDI), as well as BlackBerry and the Google Android and Chrome security teams. Before the competition ended today, a researcher under the alias "Pinkie Pie" compromised Google Chrome on both a Nexus 4 and Samsung Galaxy S4, and was awarded $50,000. The researcher's exploit took advantage of two vulnerabilities -- an integer overflow issue and a full sandbox escape.

"Similar to the exploits we saw on day one of our contest, in order for the user's device to be successfully compromised, they would need to be enticed to visit a malicious site in order to be exposed to the malicious code," blogged Heather Goudley, senior security content developer at HP. "Again the attack depends on first compromising the user to get them to take an action (e.g. clicking a link in an email, or an SMS or on another web page) and then compromising the device by exploiting these vulnerabilities. The final outcome would be the remote execution of code of an attacker's choice."

This vulnerability has been disclosed to Google, one of multiple vendors that will have to deal with patching vulnerabilities uncovered in the contest.

On Wednesday, the Keen Team of Keen Cloud Tech won $27,500 for demonstrating two exploits against Safari on an iPhone 5 that allowed them to steal a photo on iOS version 6.1.4 and capture Facebook credentials on iOS version 7.0.3. Neither of the devices was jailbroken, and both exploit demonstrations took no more than five minutes. For the exploit to work, the user would need to click on a link in an email, SMS, or Web page.

"Both of the Safari exploits leveraged memory corruption vulnerabilities, which allowed them to gain access to Facebook cookies [on iOS 7.0.3] and photos stored on the device [on iOS 6.1.4]," Brian Gorenc, manager of HP's ZDI, told Dark Reading.

Also Wednesday, Japan's Team MBSD of Mitsui Bussan Secure Directions won $40,000 after demonstrating exploits against several applications installed by default on the Samsung Galaxy S4. After exploiting the apps, the researchers were able to install malware on the device and steal confidential data. For the attack to work, the user must be tricked into visiting an attacker-controlled malicious website.

[The biggest security weaknesses in most Android smartphones today are the custom apps and features that come packaged with the devices, new research shows. See Custom Features Incur Security Flaws In Popular Android Smartphones.]

"The implications for this exploit are worrisome," Goudley blogged. "While you may be reticent to click on links (heeding the commonly-given, if somewhat ridiculous advice to 'click carefully') it is unlikely that you assess risk and use caution the same way on your mobile devices as you do on your desktop. The message here, however, is clear -- mobile platforms are vulnerable to the same or very similar methods of malware distribution that plague the desktop and you would be wise to take heed.

"One of the reasons HP's Zero Day Initiative was excited to bring the competition to Tokyo was to get a firsthand look at the security research happening on this side of the globe. We were lucky enough to have teams from both China and Japan compete and win this year."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31458
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...