All major browsers fall during second day at Pwn2Own hacking contest

Researchers demonstrate remote code execution exploits against Internet Explorer, Chrome, Firefox and Safari

Security researchers demonstrated zero-day exploits against Google Chrome, Microsoft Internet Explorer, Apple Safari, Mozilla Firefox and Adobe Flash Player during the second day of the Pwn2Own hacking competition Thursday, racking up total prizes of US$450,000.

A team from French vulnerability research firm Vupen hacked Google Chrome by exploiting a use-after-free vulnerability that affects both the WebKit and Blink rendering engines. The researchers then successfully bypassed Chrome's sandbox protection to execute arbitrary code on the underlying system.

On Wednesday, the first day of the contest that takes place every year at the CanSecWest security conference in Vancouver, researchers from the same team hacked Internet Explorer 11, Firefox, Flash Player and Adobe Reader.

Another anonymous researcher presented a Chrome remote code execution exploit Thursday, but the contest judges declared it only a partial win because some details of the hack were similar to those of an exploit presented earlier at Pwnium, Google's own hacking contest that runs aside Pwn2Own.

Well known iPhone and PlayStation 3 hacker George Hotz, known online as geohot, demonstrated a remote code execution exploit against Firefox, making it the competition's fourth successful hack against Mozilla's browser. Aside from Team Vupen, security researchers Jüri Aedla and Mariusz Mlynski had also compromised Firefox during the first day of the contest by exploiting different vulnerabilities.

On Thursday, researchers Sebastian Apelt and Andreas Schmidt demonstrated a browser-based exploit against Microsoft Internet Explorer that chained together two use-after-free vulnerabilities and a Windows kernel bug to open the Windows calculator application, proving remote code execution.

Another researcher, Liang Chen of the Chinese Keen Team, combined a heap overflow vulnerability with a sandbox bypass to achieve remote code execution through Apple Safari. He and fellow researcher Zeguang Zhou of team509 then demonstrated a remote code execution exploit for Adobe Flash Player.

All the vulnerabilities exploited during Pwn2Own were shared with the vendors of the affected products.

The prizes won during the second and final day of the competition put the total contest payout to a record $850,000, not including charitable donations or the value of the test laptops won by the researchers after their successful hacks.

During a side challenge dubbed Pwn4Fun, security researchers from Google competed against researchers from Hewlett-Packard's DVLabs Zero Day Initiative (ZDI) who organize the Pwn2Own contest. The Google team hacked Apple Safari and the ZDI team hacked IE11 by combining multiple exploits. The challenge raised $82,500 for the Canadian Red Cross.

Join the CSO newsletter!

Error: Please check your email address.

Tags patchesVupenonline safetysecurityMicrosoftadobeExploits / vulnerabilitiesHewlett-PackardmozillaAppleGoogle

More about Adobe SystemsAppleGoogleHewlett-Packard AustraliaMicrosoftMozilla

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts