iOS 11.1 equipped iPhone 7, Galaxy S8 and Mate 9 Pro were hacked on the first day of Mobile Pwn2Own
Mobile platforms are feeling the pain at the sixh annual Mobile Pwn2Own competition, at the PacSec conference in Tokyo.
Apple’s iPhone 7 fell three times with two different attacks against Safari and one against Wi-Fi. Samsung’s Galaxy S8 fell once via its Internet Browser. And a baseband exploit that could allow an attacker to spoof the device was used against Huawei’s Mate 9 Pro.
Trend Micro’s Zero Day Initiative announced that on day one, contestants successfully pulled off five exploits against Samsung Galaxy S8, Apple iPhone 7 and the Huawei Mate 9 Pro and earned a staggering $350,000 (€301,500) thus far. Although there are four targets in total, none of the teams took on Google Pixel in day one.
All of the phones are running the latest OS with all available patches installed. There are four targeting categories that cover mobile browsers; short distance attacks happening via Bluetooth, NFC or Wi-Fi; attacks on MMS or SMS messages; and baseband attacks in which the target device communicates with a rogue base station. Money prizes exceed $500,000 this year.
Galaxy 8 hack
The first successful hack targeted the Internet Browser of the Samsung Galaxy S8. 360 Security’s mj0011 leveraged a bug in the Samsung Internet Browser to get code execution and then used privilege escalation in an unnamed Samsung app that persisted after a reboot. The hack earned him $70,000 (€60,300).
Confirmed! @mj0011sec demoed a bug on #Galaxy Browser & priv escalation via #Samsung app to persist a reboot. Earn $70K & 11 MoP points.
— Zero Day Initiative (@thezdi) November 1, 2017
iPhone 7 hacks
The next successful attack occurred after Tencent Keen Security Lab targeted the Wi-Fi on an iPhone 7 running iOS 11.1 Keen Lab used four bugs in total, managing to get code execution through a Wi-Fi bug and then escalated privileges for persistence after reboot. Exploiting four bugs earned the team a whopping $110,000 (€94,700)!
Confirmed! @keen_lab used 4 bugs to exploit a WiFi bug on #Apple #iPhone & survive a reboot, earning $110K & 11 Master of Pwn points. #MP2O
— Zero Day Initiative (@thezdi) November 1, 2017
Richard Zhu, aka fluorescence, pulled off the next successful pwnage of Apple’s iPhone 7. He targeted the Safari Browser, leveraging two bugs to exploit Safari and escape the sandbox. Zhu earned $25,000 for the hack.
Look at that. Richard Zhu (fluorescence) successfully demonstrates #Safari exploit on iPhone 7. Off to the disclosure room for confirmation
— Zero Day Initiative (@thezdi) November 1, 2017
3 for 3 on #Apple exploits using iOS 11.1 at #MP2O https://t.co/8dLfXI1cBz
— Trend Micro (@TrendMicro) November 1, 2017
Mate 9 Pro hack
Keen Lab had another go, targeting baseband on the Huawei Mate 9 Pro. The researchers used a stack overflow on the baseband processor to earn $100,000 (€86,100).
Confirmed! @keen_lab used a stack overflow in the #huawei baseband earning themselves $100,000 and 20 Master of Pwn points. #MP2O
— Zero Day Initiative (@thezdi) November 1, 2017
The Master of Pwn points, which “show an extra level of complexity in the exploit used,” as well as the associated cash prize for each are explained here. The add-on bonuses consist of a kernel bonus and a persistence bonus. There are also penalties that remove add-on bonuses.
There will be six more attempts made on day two of Mobile Pwn2Own, including two more targeting Apple and another on baseband.
When this year’s contest was first announced, Mike Gibson, vice president of threat research for Trend Micro, said, “Rewarding responsible disclosure of these bugs promotes our overarching goal of making everyone safer online. Researchers participating in the contest gain notoriety and can win a significant amount of money, and vendors are given the opportunity to patch zero-day vulnerabilities that might have otherwise wreaked havoc on their systems.”
ZDI first verifies that the attack was a true zero-day exploit and then discloses the vulnerability to the vendor. Representatives from Apple, Google and Huawei are at Mobile Pwn2Own. The vendors have 90 days after disclosure to release a fix or to come up with a reasonable explanation for why they did not before ZDI publishes “a limited advisory including mitigation in an effort to enable the defensive community to protect users.”
IDG News Service
Subscribers 0
Fans 0
Followers 0
Followers