Firefox, Safari, Edge And Tesla Hacked At Pwn2Own
image credit Fossbytes

Firefox, Safari, Edge And Tesla are prey to hacking in Vancouver’s 2019 Pwn2Own hacking contest

Once again, Pwn2Own 2019 has shown that a safe system is nothing but a myth. The competition has claimed many high-profile victims in its two-day running, including Tesla, Firefox, and Safari likes. Pwn2Own is an annual hacking competition that takes place next to the CanSecWest convention in Vancouver.

Hackers are needed in the competition to recognize faults in common software and operating systems such as MacOS and Windows 10’s safety mechanisms. Until now, hackers have downgraded MacOS Safari, Windows Edge and Firefox and run two VMs (virtual machines) native hardware code.

First Day Achievements at Pwn2Own:

On Pwn2Own’s first day, hackers Amat Cama and Richard Zhu working with the Fluoroacetate team found faults in the Apple Safari browser by evading the sandbox using a $55,000 overflow and brute force method. It should be noted that this was the very first of the Fluoroacetate team’s three accomplishments that day.

Later on, Zhu and Cama shifted their focus on Oracle’s VirtualBox, the hypervisor of the open-source x86-class pcs, performing pop calc on it through an integer overflow and race condition for virtual client escalation. Their first attempt was not a success, but they succeeded in aligning everything in the second attempt and executed the code to receive $35,000 effectively.

Their third good achievement endangered the VMware Workstation, which they pulled off by leveraging the race condition. They chained it to an out – of-bound writing and jumped to execute the code on the host operating system from the virtual client and earn $70,000.

Also effective in compromising the Oracle VirtualBox was STAR Labs ‘ Anhdaden team by using an integer underflow to escalate from the virtual client. At medium integrity, they were able to perform the code on the VirtualBox. Their technique was quite distinct from the method used by the Fluoroacetate team to use the integer underflow. For this accomplishment, Anhdaden was given $35,000.

Phoenhex and Qwerty Team hackers who could only be identified from their Twitter IDs i.e. @ niklasb, @qwertyoruiopz, and @bkth also attempted to hack Apple Safari using a kernel elevation and secured a complete system compromise. They visited the website to cause a JIT bug and then escalated through multiple out – of-bound and time-of-check-time-of-use bug from root to kernel. They were, however, partly credited for their attempts since Apple already knew one of the bugs. Nevertheless, they got $45,000 in money.

Video Credit goes to their respective creator and owner.

Second Day Achievements at Pwn2Own:

The second day of Pwn2Own revealed vulnerabilities in the browsers of Microsoft Edge and Mozilla Firefox. Team Fluoroacetate’s Amat Cama and Richard Zhu were also on a roll on Thursday after having a fantastic first day. They succeeded in leveraging a JIT bug in Mozilla Firefox and used a Windows kernel out – of-bound write exploit and could control the system with a one-two punch. They were able to perform code through Firefox at SYSTEM level and earn $50,000.

Using a kernel escalation and VMware escape, the team also managed to target Microsoft Edge. They basically used a confusion intrinsic in the Edge browser, which is a race condition in the kernel and then write to a virtual client from the browser through an out – of-bound VMware to perform software in the host operating system. They were given 13 Master of Pwn points for their accomplishments and gained $130,000.

In addition, Niklas Baumstark managed to target Firefox using a JIT bug and logic bug facilitated sandbox escape, earning 4 Master Pwn points and $40,000. Arthur Gerkis of Exodus Intelligence also assaulted Microsoft Edge using a double free render as well as a logic bug to escape the sandbox, earning $50,000.

Video Credit goes to their respective creator and owner.

Day Three Achievements at Pwn2Own:

Tesla had a hard time on Day 3 at the Pwn2Own as Team KunnaPwn given the VCSEC element of Tesla Model 3. However, their entry was withdrawn by the team later. On the other side, with a JIT bug to win $35,000 and the car, Amat Cama and Richard Zhu managed to compromise the infotainment scheme of the same car.

Video Credit goes to their respective creator and owner.


More on Pwn2Own is 

available here.

2 COMMENTS

  1. I’m extremely impressed with your writing skills and also with the structure for your weblog.
    Is this a paid topic or did you customize it yourself? Either way
    keep up the nice high quality writing, it is uncommon to peer a
    nice weblog like this one nowadays..

LEAVE A REPLY

Please enter your comment!
Please enter your name here