eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
On the first day of the Mobile Pwn2Own 2017 hacking competition in Tokyo, security researchers demonstrated new zero-day attacks against fully patched mobile devices.
On Nov. 1, different groups of security researchers made a total of seven exploit attempts, five of which were successful. Among the successful exploit targets were fully patched Apple iPhone 7, Samsung Galaxy S8 and Huawei Mate9 Pro devices.
Researchers who demonstrated the successful exploits were rewarded with a total of $350,000 in prize money from Trend Micro’s Zero Day Initiative (ZDI), which runs the Pwn2Own contest. All of the flaws discovered at the event are privately reported to the impacted vendors and are subject to the ZDI’s disclosure policy, which provides vendors with 90 days to fix the vulnerabilities before they are publicly disclosed.
Three of the five successful exploits were made against Apple devices, including two browser exploits against Safari and one WiFi exploit. Apple just updated iOS to 11.1 on Oct. 31, which is the version the researchers were able to exploit.
“The team updated all devices to the latest OSes prior to the contest kicking off this morning, including iOS 11.1, as late as 5 a.m. this morning, Tokyo time,” Brian Gorenc, director at Trend Micro’s Zero Day Initiative, told eWEEK.
The iOS 11.1 update patches 14 vulnerabilities, including six that were memory corruption issues in Safari’s WebKit browser rending engine. As it turns out, there are apparently still security issues in iOS 11.1 that Apple will need to patch in a future update.
Security researchers from Tencent Keen Security Lab were able to demonstrate multiple exploits against the fully patched iOS 11.1. Among those exploits was an arbitrary code execution, via a WiFi bug, that also provides privilege escalation and can persist through a reboot. The whole exploit chain included four different bugs and resulted in an award of $110,000.
A second exploit attempt by Tencent Keen Security Lab made use of two different bugs, including one in an iOS system service and one in the browser to exploit Safari. That exploit earned an additional $45,000 in awards from ZDI.
Security researcher Richard Zhu, also known by his alias fluorescence, took aim at iOS 11.1 as well and demonstrated two bugs. Zhu’s bugs were able to exploit Safari and escape the iOS system sandbox, enabling him to run arbitrary code. For his efforts, Zhu was awarded $25,000 by ZDI.
Android
Apple wasn’t the only target at Mobile Pwn2Own 2017, with researchers also taking aim at Android devices from multiple vendors.
Researchers from 360 Security were able to demonstrate a chain of flaws on the Samsung Galaxy S8 that led to arbitrary code execution. The exploit chain included a bug in the Samsung internet browser paired with a privilege escalation in a Samsung application that enabled code execution to persist through a reboot. ZDI awarded the 360 Security team $70,000 for its efforts.
Among the most impactful types of mobile device vulnerabilities are cellular baseband flaws. The baseband is the component that manages all the radio functions on a cellular device. Tencent Keen Security Lab was able to successfully demonstrate a baseband exploit using a Huawei Mate9 Pro smartphone that would allow an attacker to spoof the device. ZDI awarded $100,000 to Tencent Keen Security Lab for the baseband exploit.
“The baseband attack was exciting, and we’re looking forward to seeing another attempt in this category tomorrow [Nov. 2],” Gorenc said. “It’s always interesting to see jailbreaks as well, and we saw two today. Also there was persistency demonstrated with three of the attacks, which is impressive.”
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.