Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

11/14/2013
02:39 PM
50%
50%

Mobile Pwn2Own Hacking Contest Claims Nexus 4 Among Victims

Security researchers received thousands of dollars in cash prizes at this year's Mobile Pwn2Own contest

When it was over, the Nexus 4, Samsung Galaxy S4, and Apple iPhone could all count themselves as hacking victims.

Fortunately, it happened in the name of research at the Mobile Pwn2Own contest at the PacSec 2013 Conference this week in Tokyo. During the past two days, the contest saw researchers use application vulnerabilities to compromise each of the devices and walk away with thousands of dollars in cash prizes.

The event was sponsored by Hewlett-Packard's Zero Day Initiative (ZDI), as well as BlackBerry and the Google Android and Chrome security teams. Before the competition ended today, a researcher under the alias "Pinkie Pie" compromised Google Chrome on both a Nexus 4 and Samsung Galaxy S4, and was awarded $50,000. The researcher's exploit took advantage of two vulnerabilities -- an integer overflow issue and a full sandbox escape.

"Similar to the exploits we saw on day one of our contest, in order for the user's device to be successfully compromised, they would need to be enticed to visit a malicious site in order to be exposed to the malicious code," blogged Heather Goudley, senior security content developer at HP. "Again the attack depends on first compromising the user to get them to take an action (e.g. clicking a link in an email, or an SMS or on another web page) and then compromising the device by exploiting these vulnerabilities. The final outcome would be the remote execution of code of an attacker's choice."

This vulnerability has been disclosed to Google, one of multiple vendors that will have to deal with patching vulnerabilities uncovered in the contest.

On Wednesday, the Keen Team of Keen Cloud Tech won $27,500 for demonstrating two exploits against Safari on an iPhone 5 that allowed them to steal a photo on iOS version 6.1.4 and capture Facebook credentials on iOS version 7.0.3. Neither of the devices was jailbroken, and both exploit demonstrations took no more than five minutes. For the exploit to work, the user would need to click on a link in an email, SMS, or Web page.

"Both of the Safari exploits leveraged memory corruption vulnerabilities, which allowed them to gain access to Facebook cookies [on iOS 7.0.3] and photos stored on the device [on iOS 6.1.4]," Brian Gorenc, manager of HP's ZDI, told Dark Reading.

Also Wednesday, Japan's Team MBSD of Mitsui Bussan Secure Directions won $40,000 after demonstrating exploits against several applications installed by default on the Samsung Galaxy S4. After exploiting the apps, the researchers were able to install malware on the device and steal confidential data. For the attack to work, the user must be tricked into visiting an attacker-controlled malicious website.

[The biggest security weaknesses in most Android smartphones today are the custom apps and features that come packaged with the devices, new research shows. See Custom Features Incur Security Flaws In Popular Android Smartphones.]

"The implications for this exploit are worrisome," Goudley blogged. "While you may be reticent to click on links (heeding the commonly-given, if somewhat ridiculous advice to 'click carefully') it is unlikely that you assess risk and use caution the same way on your mobile devices as you do on your desktop. The message here, however, is clear -- mobile platforms are vulnerable to the same or very similar methods of malware distribution that plague the desktop and you would be wise to take heed.

"One of the reasons HP's Zero Day Initiative was excited to bring the competition to Tokyo was to get a firsthand look at the security research happening on this side of the globe. We were lucky enough to have teams from both China and Japan compete and win this year."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...