Switchfast Blog: The Future of IT
Hungry Hungry Hackers Conquer IE8 on Windows 7 (Among Other Feats)
Thursday, March 25, 2010 by Bryan Anderson
Day one of CanSecWest Pwn2Own hacking contest has already
produced 'technically impressive' results, from iPhone hacking, SMS
database hijacking, and Firefox and Safari exploits.
Two researchers yesterday - both taking $10,000 for their
mastery - were able to bypass critical security measures of Windows
7 and IE 8. Both Peter Vreugdenhil of the Netherlands and an
individual by the first name of Nils from Germany displayed how to
disable DEP (data execution prevention) and ASLR (address space
layout randomization), then successfully exploit the fully-patched
64-bit version of Windows 7 through IE8 and Mozilla's Firefox 3.6,
respectively.
According to an article at computerworld.com, "every exploit has been top
notch" and "the one on IE8 was particularly impressive," quoted
from Aaron Portnoy, a lead at 3Com's TippingPoint security unit,
the sponsor of the contest.
3Com Tipping point also shelled out $15,000 to the team of
Vincenzo Iozzo and Ralf-Philipp Weinmann who together exploited the
iPhone in less than five minutes. The pair lured the target iPhone
to a rigged website where they were able to exfiltrate the SMS
database in about 20 seconds, according to zdnet.com. Basically, they accessed text
messages via an iPhone exploit, both present AND deleted text
messages.
For the third straight year, Charlie Miller took home
top prize for hacking a MacBook by exploiting a Safari browser
vulnerability. Using fuzzers to find security vulnerabilities, he
is preparing a presentation on his techniques against popular
software products.
With all these vulnerability issues, should you be worried? Not
at all.
The purpose of this contest is for the best of the best to
demonstrate top notch security threats that aren't as commonly
discovered, well before any malicious group of cybercriminals get a
hold of them. These hacks were not just impressive but critical in
identifying future software security issues.
In fact, according to an article on networkworld.com, each year vendors have
pushed patches for these vulnerabilities quicker and quicker. In
2008, Apple took three weeks to patch a noted Safari bug, while
Mozilla updated their browser a week after an exploit discover last
year.
These companies are fully aware that security is the most
important aspect of online software and they are determined to fill
all the holes.
Until next time -
Matthew Hymel
Switchfast Technologies
Chicago IT Support &
Consulting
Rochester
IT Support & Consulting
Leave comment: