Safari/MacBook first to fall at Pwn2Own 2011

Summary:A team of security researchers from the French pen-testing firm VUPEN successfully exploited a zero-day flaw in Apple's Safari browser to win this year's Pwn2Own hacker challenge.

VANCOUVER -- A team of security researchers from the French pen-testing firm VUPEN successfully exploited a zero-day flaw in Apple's Safari browser to win this year's Pwn2Own hacker challenge.

VUPEN co-founder Chaouki Bekrar (right) lured a target MacBook to a specially rigged website and successfully launched a calculator on the compromised machine.

The hijacked machine was running a fully patched version of Mac OS X (64-bit).

In an interview with ZDNet, Bekrar said the vulnerability exists in WebKit, the open-source browser rendering engine.   A three-man team of researchers spent about two weeks to find the vulnerability (using fuzzers) and writing a reliable exploit.

VUPEN won a $15,000 cash prize and an Apple MacBook Air 13" running Mac OS X Snow Leopard.

Bekrar said the Safari exploit was "somewhat difficult" because of the lack of documentation regarding 64-bit Mac OS X exploitation.  "We had to do everything from scratch. We had to create a debugging tool, create the shellcode and create the ROP (return oriented programming) technique," he explained.

"The main difficulty was doing this on our own, without the help of any documentation," he said.

[ SEE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches ]

He said the creation of a reliable exploit was "much more difficult" than finding the vulnerability.

follow Ryan Naraine on twitter

"There are many WebKit vulnerabilities.  You can run a fuzzer and get lots of good results.  But it's much more difficult to exploit it on x64 and to make your exploit very reliable," he said.

Bekrar's winning exploit did not even crash the browser after exploitation.   Within five seconds of surfing to the rigged site, he successfully launched the calculator app and wrote a file on the disk without crashing the browser.

[ SEE: Pwn2Own 2011: IE8 on Windows 7 hijacked with 3 vulnerabilities ]

The exploit bypassed ASLR (Address Space Layout Randomization) and DEP (Data Execution Prevention), two key anti-exploit mitigations built into Mac OS X.

"The victim visits a web page, he gets owned.  No other interaction is needed."

Bekrar said VUPEN plans to hit Internet Explorer 8 on 64-bit Windows 7 (SP1) later in the contest.

Topics: Operating Systems, Apple, CXO, Hardware, IT Employment, Laptops, Mobility

About

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content managem... Full Bio

zdnet_core.socialButton.googleLabel Contact Disclosure

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.