Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

By Ryan Naraine | March 9, 2011, 12:42pm PST

Summary: With obvious eyes on this year’s CanSecWest Pwn2Own hacker challenge, Apple today dropped two major security updates for Safari and iOS to fix more than 60 vulnerabilities that could be used to hijack Windows, Mac OS X or iPhone/iPod Touch devices.

VANCOUVER — With obvious eyes on this year’s CanSecWest Pwn2Own hacker challenge, Apple today dropped two major security updates for Safari and iOS to fix more than 60 vulnerabilities that could be used to hijack Windows, Mac OS X or iPhone/iPod Touch devices.

The patches arrive on the same day of the annual contest, which pits vulnerability researchers and exploit writers against the major web browsers and smart phones. Apple has now followed Google and Mozilla in releasing browser updates ahead of Pwn2Own.

The new Apple Safari 5.0.4 fixes a total of 62 documented vulnerabilities, most serious enough to allow code execution attacks if a user simply surfs to a booby-trapped web site. The majority of the vulnerabilities are in WebKit, the open-source browser rendering engine.

Google Chrome gets last-minute bandaid before Pwn2Own

The Safari update also fixes multiple gaping holes in ImageIO and libxml.

Separately, Apple shipped iOS 4.3 to fix a wide range of serious security issues. The most serious of the iOS flaws could be used to take control of Apple’s iPhone devices with maliciously crafted fonts, images or web sites. Full details on the iOS 4.3 update available here.

Questions for Pwn2Own hacker Charlie Miller

Apple’s latest patches are unlikely to be a deterrent to some of the researchers planning to participate in Pwn2Own.

Earlier today, Charlie Miller (of Pwn2Own/Safari fame) showed me an iPhone 4 exploit that steals the victim’s address book via a rigged web site. Miller said the latest batch of patches from Apple does not fix the issue.

In addition to Miller, there are at least two other teams planning iPhone attacks and four different teams planning to hit Safari on Mac OS X.

Also read Dennis Fisher’s essay on the importance of the Pwn2Own challenge.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

Dear ISP, it's time to quarantine your malware-infected customers

Safari/MacBook first to fall at Pwn2Own 2011

Topics

Apple Safari, Patch Management, Apple Inc., Ryan Naraine, Hacker, Patches, Hacking, Security

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Full Bio
Disclosure
Contact

Vendor HotSpot

The 360° Conversation around Cloud Computing

TECH VISUALIZER brings the social conversation to life... powered by Brocade

Learn More »

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?

Ask a Question Start a Discussion

Comments

Add Your Opinion

Join the conversation!

Follow via:: RSS; Email Alert

Just In

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

Jimster480 10th Mar 2011

@Bookmark71 becaues they thought they were slick and they were gonna patch the holes that the hackers were going to use to pwn their vulnerable crap

View in thread

Please Select
Please Select

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

Bookmark71 9th Mar 2011

Why did they wait for there to be 62 vulnerabilities to release patches?

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

coolnerd16 9th Mar 2011

@Bookmark71 I guess noone uses safari as much as IE or Firefox so it might not got much attention from the hackers.
Well if not for iphone i think safari would have never gained any browser market share.

Reply
Flag

0 Votes

+ -

Apple's answer to security

riveroad 9th Mar 2011

@coolnerd16 Apple has lived a long time under the hood of "security by obscurity"
Apple's answer to security has to change
btw... where are all the Apple FanBoys at?

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

Badgered Updated - 9th Mar 2011

@Bookmark71

From what I've seen Apple generally puts quite a few fixes in their patches before releasing them.

I just hope that these companies aren't holding back on critical patches just to try to look good in a contest.

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

desilvav 9th Mar 2011

@Bookmark71

this is bloody news making ...

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

nickdangerthirdi@... 9th Mar 2011

@Bookmark71 apple is on a quarterly update schedule, they dont care about how secure their products are, its just the number that have been found since the last round of udpates, another reason apple will never work its way into the enterprise or my home, even M$ release patches once a month, and I get updates from ubuntu about once a week, but open source software is SOOOOOOO poorly written and never updated...

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

alsobannedfromzdnet Updated - 9th Mar 2011

@nickdangerthirdi@...

Are you using the same antivirus in Ubuntu as I use in OSX?

i.e. None.

0 Votes

+ -

maybe because the prospect of EXPLOITS is low?

doctorSpoc 9th Mar 2011

@Bookmark71 Vulnerabilities are just theoretical.. where are the exploits? Where are the exploits in the wild? Apple seems to have a pretty good record of fixing vulnerabilities before exploits in the wild are hatched for them

Reply
Flag

0 Votes

+ -

I still don't understand...

cornpie 9th Mar 2011

@doctorSpoc ...why they don't just go to a monthly schedule and release a smaller number each month rather than these mega patches. It seems to me the number of updates is so large as to almost constitute a service pack type of release.

0 Votes

+ -

Timed for the Pwn2Own challenge

Richard Flude 9th Mar 2011

Clearly the release was timed for the challenge, not because of a magic 62 vulnerabilities.

Whilst it might block a few for the less qualified hackers, there will be enough bugs remaining for the others to work with.

It won't just be Apple going down.

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

facebook@... 9th Mar 2011

@Bookmark71 Because Apple and Google are not mature enterprise companies with regularly, predictable scheduled releases that allows enterprises to plan for these events like Microsoft. Apple and Google are more interested in the market and the brand.

Reply
Flag

0 Votes

+ -

Because if they did it earlier hackers would have time

Will Farrell 9th Mar 2011

@Bookmark71
to find other hacks after these are fixed. Wait till the last second and they stop weeks worth of work and hackers don't have time to find others the contest is over by the time the other hols are found.

Then apple can say "look - we can't be hacked"

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

A.Sinic 10th Mar 2011

@Will Farrell
Didn't work though did it. Safari still got pwned easily.

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

Jimster480 10th Mar 2011

@Bookmark71 becaues they thought they were slick and they were gonna patch the holes that the hackers were going to use to pwn their vulnerable crap

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

alex@... 9th Mar 2011

@riveroad - is it security through obscurity? I actually see it as low risk due to relative infrequency of actual compromise.

Reply
Flag

0 Votes

+ -

Yes, it is.

ye 9th Mar 2011

@alex@...: is it security through obscurity?

That's about all it is.

Reply
Flag

0 Votes

+ -

That's the simplistic approach...

cat o nine tails 9th Mar 2011

...Micro$oft fanboys use to belittle Apple & Linux security.

Once they spread enough FUD about that, they hope they can lure people back to using windoze since security will no longer be a trump card for those using non-M$ systems.

It's the only thing windoze fanboys have since they have nothing but swiss cheese security to hang on to.

0 Votes

+ -

Another Monster, Mega or Massive patch drop from Apple.

xuniL_z 9th Mar 2011

I love how Apple drops massive patch downloads several times a year, but this site will highlight ONE Microsoft patch as headline news, even though it requires the user to be coerced into doing something to make it work.
These are far more serious and dangerous but blogged only as a side to the Cansecwest, as though Apple was in control and knew just what they were doing and when they needed to do it.
WebKit sounds like a real piece of garbage. I am staying with IE all the way at this point. I loaded Chrome but I don't see where it's at all noticably faster than any other browser. I found it slower than IE on my Windows 7 machine.
I would never touch Safari, like any other Apple software, it's not fit for use in the real world.

Someday when hackers decide it's time to go after Apple the headline is going to still read Massive, mega or Monster, but it will be talking about the scope of the hacked machines. If nation backed or other independently funded hackers put even 1/2 as much effort as they currently put into trying to disprupt things via Windows the Apple world would come to a halt.
Thank God Apple is not running anything important but rather just another consumer electronics player.

Reply
Flag

0 Votes

+ -

You understand that chrome uses webkit as well right? Lol

doctorSpoc 9th Mar 2011

@xuniL_z ...

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

Turd Furgeson 9th Mar 2011

@doctorSpoc
I read the 2 statements about Webkit and Chrome to be together. Anyway, I have always seen Chrome as faster than IE But IE is more compatable with corporate apps.

0 Votes

+ -

Hey Doc, Turd Ferguson is correct, and I was not just talking about....

xuniL_z 10th Mar 2011

@doctorSpoc

...the rendering engine when I explain my feelings about Safari. You do realize that Chrome != Safari, right? LOL.

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

Rick_K 9th Mar 2011

@xuniL_z
No matter what Apple does, you?ll try and put the most negative spin on it. Are you one of the regular speakers at the monthly I Hate Apple Club meetings? Maybe you?re the local Chapter president. For someone that doesn?t use the product, you seem to complain about it a lot.

Reply
Flag

0 Votes

+ -

You mean in the same way as the ABMers do to Microsoft?

ye Updated - 9th Mar 2011

@Rick_K: No matter what Apple does, youll try and put the most negative spin on it.

xuniL_z isn't faulting Apple, he's addressing their fanboys.

0 Votes

+ -

Well look at his backwards name

cat o nine tails 9th Mar 2011

xuniL_z = z_Linux

That says it all.

He feels very threatened by the 1% that's out there.

0 Votes

+ -

Rick_K. I'll say it again, but you'll accuse me of lying again.....

xuniL_z 10th Mar 2011

My first machine was a used Apple II in the mid to later 80s.
Being young and w/o a lot of money, I got it for basically free.
My closest living relative has used Mac for years. He was a teacher in a school district that used Apple when he was still teaching and he's stayed with them...and here is the irony....only due to his familiarity from the years as a teacher. He's not exactly tech savvy and he's had a couple DOA macs over the years that had to be sent back.
I have been at his home a lot in my life and I know the Mac well enough, and the itouch and ipad he also now owns.
It is good hardware, seemingly put together with good fit, I won't dispute the architecture. But when it comes to the software, I've never been impressed and have witnessed many software issues.
I started using Windows machines in the mid 90s, my first was a Gateway DX-386. I've used Windows since, both in my private and career life.

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

anogee 9th Mar 2011

Here is the fact of the matter. There is always going to be exploits and hacks, and attempting to fix them seems like a game of Wack-A-Mole. If you only go to web sites you trust, and only being very careful of e-mail, chances are you have very little to worry about. All these fixes will do nothing more than make everything slower and slower and slower, forcing everyone to upgrade to new hardware where the process will repeat itself again.

Reply
Flag

0 Votes

+ -

Timing is everything.

dave@... 9th Mar 2011

Coincidence. I think not. Whatever it takes to force them back to reality. Hopefully they will still fall quickly. lol

Reply
Flag

0 Votes

+ -

Not a problem.

james347 9th Mar 2011

Issue is fixed.

Reply
Flag

0 Votes

+ -

Do the contestants NEED to hack for Android devices? why don't they just ..

Davewrite Updated - 9th Mar 2011

... upload a malware app into the Google app market?

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

hngquan@... 9th Mar 2011

haha, unbeatable got 62 bandaid ??? not suprise

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

alsobannedfromzdnet 9th Mar 2011

Too bad all these updates only patch security flaws.

I was looking forward to using my iPhone 4 as a wifi hotspot among other stuff like faster javascript rendering in Safari.

Hang on.

Why the inherent bias on ZDNet every time Apple rolls out software updates?

Was the Windows 7 release described as "Microsoft drops massive security patches for Vista!!!"?

Reply
Flag

0 Votes

+ -

Ummm...

LiquidLearner Updated - 9th Mar 2011

@alsobannedfromzdnet

Windows 7 and Vista get the same security updates, so I'm not sure what you're referring to. Oh that's right, you just had to find some way to make the fact that Apple knows about so many vulnerabilities and still only fixes them in one big patch into something about Microsoft. Bravo!

We get a story like this, actually several from different bloggers, every month just before patch Tuesday. So where is this bias you speak of?

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

alsobannedfromzdnet 9th Mar 2011

@LiquidLearner

Apple doesn't do updates, solely for the purpose of applying security updates.

ZDNet's headlines and articles seem to ignore what is being updated.

eg I can now stream wirelessly from my iTunes library to iOS devices and iTunes is ready to sync with an iPad 2, so how do you do all that without updating all the software involved, Safari is also faster at rendering JavaScript.

Yet all ZDNet reports is "security patches".

0 Votes

+ -

Perhaps it's because the blog is "Zero Day" which focuses on...

ye 9th Mar 2011

@alsobannedfromzdnet: Yet all ZDNet reports is "security patches".

...security related issues. ZDNet has already discussed the new features in iOS 4.3.

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

DDiGK 9th Mar 2011

I am not a technician, developer, geek etc. I am a Apple user, i appreciate competition, I am open to anything wich encourage any company to bring the best for me as a consumer, but nothing in this competion brings nothing extra to me than irrelevant information on privacy matters or safety issues when using Explorer, Chrome, Safari etc. Same ******** every year, X,Y,Z hacked first etc. At the end we use what we like best.

Reply
Flag

0 Votes

+ -

I can only say one thing.

NoAxToGrind 9th Mar 2011

ROTFLMAO...

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

trm1945 9th Mar 2011

Both Microsoft and Apple release software that needs a lot of patches. My question to them both is "What's the &^%& rush to get C R A P out the door? Take a little time and get it right. Our infected, invaded and compromised computers will thank you for it.

Reply
Flag

0 Votes

+ -

RE: Simplistic Approach...

compnstuff 10th Mar 2011

Windoze --- is it they appear to be sleeping on the job. I think not with the patch schedule, and never fool yourself that you can produce foolproof software.

I use Windows, I use Linux, I use MacOSX. I use the right tool for the job. An auto mechanic does not simply use a crescent wrench to fix a car.

And the $...come on folks, grow up, put your money down for the right tool, and let supply and demand do your talking.

Reply
Flag

0 Votes

+ -

RE: Pwn2Own 2011: On cue, Apple drops massive Safari, iOS patches

flood78 10th Mar 2011

I can't even imagine this thing happening for Android phones...
It's so (impossible) to update this kind of phone, it's terrible!
I have a Motorola Milestone and I'm stuck with Android 2.1
Because I bought the phone in Hong Kong and currently based in Shanghai, there are no easy way to upgrade!
And even after... if Motorola doesn't want to update to future version, these phones will be just good for garbage sad