RV_ Posted March 17, 2017 Report Share Posted March 17, 2017 PWN2OWN is an annual competition where the leading tech companies provide rewards for Hackers to find vulnerabilities they can then fix after paying the hackers. This year the main OS'/Browsers went down again. Hackers pulled off a VM escape and took down Adobe Flash, Microsoft Windows and Edge, Apple Safari and macOS, and Mozilla Firefox at Pwn2Own 2017. Excerpt: "This is the second year that entrants have been given the opportunity to exploit a VMware Workstation virtual machine. After no one attempted targeting it last year, Pwn2Own upped the ante this year by raising the award for an escape from $75,000 to $100,000. On the second day of Pwn2Own, no product was immune; hackers took down Adobe Flash, Microsoft Windows and Edge, Apple Safari and macOS, and Mozilla Firefox. Apple products were targeted early and often on Thursday as part of the annual competition held alongside the CanSecWest conference in Vancouver. Hackers from two groups were able to elevate privileges on macOS right off the bat. 360 Security used an info leak and a race condition in the kernel to do so, while Chaitin Security’s Research Lab used an info leak and an out of bounds bug in the operating system’s kernel. Chaitin, a newcomer to the competition this year, had chained six Safari bugs together the day prior to achieve root access on macOS. While the macOS exploits earned both groups $10,000 apiece, 360 Security came back and exploited Safari through an integer overflow, then escalated to root through a macOS kernel use-after-free, earning them an additional $35,000. Two other teams were scheduled to exploit bugs in macOS; one decided to withdraw its attempt, the other was disqualified because the bugs they were planning on using had previously been disclosed to Apple. The attacks against Flash came a day after hackers took down another Adobe product, Reader. Hackers with Tencent Security and Qihoo 360 poked holes in the software early Wednesday to earn $75,000 collectively. 360 Security team exploited a use-after-free bug, two Windows kernel info leaks, and an uninitialized Windows kernel buffer to elevate Flash to SYSTEM-level access to start out the day. Tencent meanwhile used a use-after-free bug against Flash, and then escalated to SYSTEM via another use-after-free in the Windows kernel. Both groups earned $40,000 apiece for their work. Like Wednesday, Microsoft’s Edge browser was a popular target on Thursday. Another Tencent Security group, Team Lance, managed to exploit a use-after-free in Chakra core, then elevate their privilege to SYSTEM through another use-after-free in the kernel." Today is the last day and there still may be a few surprises. Read the full details in the article here: https://threatpost.com/vm-escape-earns-hackers-105k-at-pwn2own/124397/ RV/Derekhttp://www.rvroadie.com Email on the bottom of my website page.Retired AF 1971-1998 When you see a worthy man, endeavor to emulate him. When you see an unworthy man, look inside yourself. - Confucius “Those who can make you believe absurdities, can make you commit atrocities.” ... Voltaire Link to comment Share on other sites More sharing options...
TheDuke Posted March 18, 2017 Report Share Posted March 18, 2017 I hadn't seen pwn2own info for a couple of years . Thx for the info. Link to comment Share on other sites More sharing options...
RV_ Posted March 19, 2017 Author Report Share Posted March 19, 2017 YW bud! RV/Derekhttp://www.rvroadie.com Email on the bottom of my website page.Retired AF 1971-1998 When you see a worthy man, endeavor to emulate him. When you see an unworthy man, look inside yourself. - Confucius “Those who can make you believe absurdities, can make you commit atrocities.” ... Voltaire Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.