Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Subscribe
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Subscribe
    Home Cybersecurity
    • Cybersecurity

    Pwn2Own 2018 Hackers Earn $162K for Safari, Edge, VirtualBox Exploit

    Written by

    Sean Michael Kerner
    Published March 15, 2018
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      Security researchers were able to successfully exploit Microsoft Edge, Apple Safari and Oracle’s VirtualBox technologies at the first day of the Pwn2Own security contest on March 14 and were awarded a total of $162,000 for their efforts.

      In total, there were four exploit attempts made by security researchers on day one of Pwn2Own 2018, which is being held at the CanSecWest conference in Vancouver, British Columbia. Two of the attempts were considered to be successful, one a partial success and one failed.

      The partial success came from security researcher Niklas Baumstark from the phoenhex team for an exploit against the VirtualBox virtualization technology. Baumstark was awarded $27,000 for his exploit attempt that used an out-of-bound memory read in combination with a time-of-check to time-of-use (toctou) memory bug.

      “It didn’t completely comply with the Pwn2Own rules for this category, so it was considered a partial success,” Brian Gorenc, director at the Trend Micro Zero Day Initiative, which operates Pwn2Own, told eWEEK.

      Among the interesting elements of Baumstark’s VirtualBox attack was the use of the toctou bug. Gorenc noted that the toctou bugs aren’t very common vulnerabilities in the ZDI program overall. 

      Aside from operating the annual Pwn2Own event, ZDI is in the business of acquiring valid software vulnerabilities from security researchers year round. VirtualBox was a new addition to the Pwn2Own target list for the 2018 event, though ZDI has had an interest in the technology for some time.

      “In recent months, we have purchased several VirtualBox vulnerabilities that have been patched in the January 2018 update,” Gorenc said.

      Baumstark’s phoenhex colleague Samuel Grob also participated in the first day of the Pwn2Own 2018 event, taking aim at Apple’s macOS and Safari. Grob was able to chain three bugs together to exploit the Apple system and was awarded $65,000 for his efforts.

      Microsoft

      The biggest win of the day came from security researcher Richard Zhu, who earned $70,000 for exploiting the Microsoft Edge browser. Zhu’s attempt initially failed, but he was able to rework his exploit chain, which included two use-after-free (UAF) memory vulnerabilities in the browser in combination with an integer overflow in the Windows kernel. Gorenc noted that it’s rare to see a researcher rework an exploit in front of a crowd.

      “Luckily for Zhu, he had done enough research beforehand to understand where the issue took place and could fix it on the fly during the attempt,” he said.

      Microsoft is also a sponsor of the 2018 Pwn2Own event and the original plan was to have a specific target called the Windows Insider Preview challenge that was going to take aim at prerelease Microsoft software. 

      “Unfortunately, we didn’t have any contestants take on this particular challenge this year,” Gorenc said. “We hope to continue partnering with Microsoft in future events to hopefully see this happen next time.”

      Chrome

      In addition to the Windows Insider Challenge, there are also multiple other targets that security researchers are not attacking at Pwn2Own 2018, including Chrome, Apache HTTP, Nginx and VMware.

      “We had people originally registered for additional targets, including Chrome, that either were unable to attend the contest or did not successfully complete the contestant registration process,” Gorenc said. “Some of these targets are relatively new to the contest and require additional time for researchers to find vulnerabilities and develop exploitation techniques for those platforms.”

      Pwn2Own 2018 continues on March 15 with researchers set to attack Apple’s Safari and Mozilla’s Firefox web browsers.

      Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.

      Sean Michael Kerner
      Sean Michael Kerner
      Sean Michael Kerner is an Internet consultant, strategist, and writer for several leading IT business web sites.

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×