14 DAY TRIAL // Microsoft Edge and Safari browsers were the preferred targets for white-hat hackers during the first day of Pwn2Own hacking competition, and only the latter remained in the crosshairs of the researchers for the second day of the event.
Richard Zhu (fluorescence) was the one to start the fun with a Windows kernel Elevation of Privilege (EoP) exploit targeting Mozilla Firefox, breaching the browser on his first attempt. His exploit involved an out-of-bounds (OOB) write in the browser and an integer overflow in the Windows kernel, and breaching the browser brought him a $50,000 prize. Overall, Zhu received a $120,000 in this year’s edition of Pwn2Own.
Apple’s Safari was the next target on the list, and this time Markus Gaasedelen (gaasedelen), Nick Burnett (itszn13), and Patrick Biernat of Ret2 Systems, Inc. managed to compromise the browser on the fourth attempt with a macOS kernel EoP.
The competition, however, requires successful exploits to be demonstrated in a maximum of third attempts, so they weren’t eligible for a prize. Instead, the bug was disclosed to Apple and will be fixed soon with a software update.
Browser patches coming soon
Safari, however, was hacked faster with a sandbox escape by Alex Plaskett (AlaxJPlaskett), Georgi Geshev (munmap), and Fabi Beterke (pwnfl4k3s) from MWR labs, who managed to breach the browser with a heap buffer underflow and an uninitialized stack variable in the OS to gain code execution rights. The team earned $55,000 following their successful attack.
Microsoft Edge, Apple Safari, and Mozilla Firefox have all been breached during this year’s Pwn2Own contest, so expect updates for these three browsers in order to fix the flaws shortly.
All vulnerabilities are privately disclosed to the parent companies, who then begin the development of patches for systems worldwide. No ETA is typically offered for these security updates, but in most of the cases, they are included in the next patch cycles for each company.