At Vancouver this year,the best hackers flocked to show off their skills CanSecWest conference. Pwn2own 2010 as its called exemplified a platform for beating the best security protections of industry giants and like wise it turned out that it became another grim day for internet security at the annual Pwn2Own hacker contest Wednesday, with Microsoft's Internet Explorer, Mozilla's Firefox and Apple's Safari and iPhone succumbing to exploits that allowed for remote administration.
The rules were simple..use previously unknown exploits and undocumented vulnerabilities to to expose sensitive system data or allow the remote execution of malicious code. In its 4th year of organizing,Pwn2Own has come to highlight the alarming insecurity of most internet-facing software. The exploits were impressive as they bypassed state of art security protocols and mitigations designed by software giants with no sweat. Microsoft’s DEP or data execution prevention, ASLR, or address space layout randomization and the code signing by Apple were thrashed at Pwn2Own.
Halvar Flake, a security researcher for Germany-based Zynamics commented "Code signing by Apple is tough, though I'm not sure if they do it for security or just to lock people into their platform," . Flake compromised the iPhone using an exploit written by his colleague Vincenzo Iozzo. The iPhone's code signing mechanism requires code loaded into memory to carry a valid digital signature before it can be executed. To get around it, the researchers used a technique known as return-oriented programming, which takes pieces of valid code and rearranges them to form the malicious payload.
As a result, hackers were able to create a malicious website that when visited by iPhone allowed to compromise the sms database revealing the list of contacts as well as complete copies of messages that have been sent and received and even deleted ones (unless a user has deleted them manually ).
DEP and ASLR, which Microsoft began implementing with the release of Service Pack 3 for Windows XP, didn't fare much better as Peter Vreugdenhil, a Netherlands-based researcher hijacked a laptop running IE 8 running on Windows 7 using an information disclosure exploit, a combination widely considered by white hat hackers as among the hardest to compromise.
Firefox running on Windows 7 and Safari were also smitten at Pwn2own.The iPhone hack fetched $15,000 and the browser exploits were awarded $10,000 each.
The genius of a contest like Pwn2Own is that it exposes the insecurity of software that rarely gets exploited by criminals. Plenty of Linux and Mac fans cite the absence of real-world exploits on those platforms as proof positive that they are inherently safer than the prevailing Microsoft operating system. It's an argument that carried little weight in Vancouver.
"The problem Microsoft has is they have a big market share, said Vreugdenhil, the hacker who attacked IE. "I use Opera, but that's basically because it has a tiny market share and as far as I know, nobody is really interested in creating a drive-by download for opera. The web at the moment is pretty scary, actually."
The Register
PS : Like this article ? You can always support me by buying me a coffee or You can always try some of the cool merchandize from PROHACK.
POSTED BY XERO ALL RIGHTS RESERVED.
0 comments:
Need to say something ? Spell it out :)