Must Read: Apple to Congress: We do not use 'tax gimmicks'

Topic: Windows

Pwn2Own hack topples Firefox on Windows

Summary: A German hacker known simply as "Nils" exploited a previously unknown vulnerability in Mozilla Firefox to take complete control of a 64-bit Windows 7 machine.

Ryan Naraine

By for Zero Day |

VANCOUVER, BC -- The first day of the CanSecWest Pwn2Own hacker challenge wrapped up here today with a familiar face going after a familiar target.

And, for the second year in a row, a German hacker known simply as "Nils" exploited a previously unknown vulnerability in Mozilla Firefox to take complete control of a 64-bit Windows 7 machine.

The successful exploit, which defeated ALSR+DEP on Windows 7, followed hacking attacks against Safari on Mac OS X, Internet Explorer 8 on Windows 7 and Apple's iPhone device.  There were no hacking attempts against Google Chrome.

Nils, a 26-year-old hacker who heads up the security research team at U.K.-based MWR InfoSecurity, also planned to attack Apple's Safari browser but after Charlie Miller's victory against that target, he did not get an opportunity.follow Ryan Naraine on twitter

As per the contest rules, he was not allowed to disclose details about the Firefox vulnerability -- contest sponsor TippingPoint ZDI owns the exclusive rights to that information -- but in a Q&A session with journalists here, Nils said the biggest challenge was navigating the anti-exploit mitigations in Windows 7.

He used several tricks to bypass Address Space Layout Randomization (ALSR) and Data Execution Prevention (DEP) to get his drive-by download to load an executable on the target machine.

ASLR+DEP are held up as significant roadblocks to thwart malware attacks on the newest versions of Windows but, as this contest shows, skilled hackers with enough motivation and resources can bypass those mitigations easily.

Nils said Mozilla can do a better job of opting into ASLR on Windows, a clear hint that implementation errors make it easy to bypass the Windows defenses.

More to come...

Topics: Windows, Browser, Microsoft, Operating Systems, Security, Software

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

313 comments
Log in or register to join the discussion

  • Quick Question...

    "There were no hacking attempts against Google Chrome."

    So the hackers decided not to go after Chrome at all then? Interesting.
    jgpmolloy
    Reply Vote

    • That to me is a vote of confidence towards Google's Chrome.

      I like Chrome 4.1.249.1042 (42199). It's even faster than IE9 preview, albeit without HTML5 or CSS3.
      WinTard
      Reply Vote

      • Be serious, Chrome has already had many public security holes

        Either they chose not to go after it to not publicize that or they had other reasons like wanting to be the first to pwn the iphone. Whatever the case it says nothing about Chrome security...
        Johnny Vegas
        Reply Vote

        • Re:

          For some reason, Chrome was not tested today.
          Let's see how it goes tomorrow.

          "Wrapping up for the day. Chrome remains untested
          and therefore the only browser left standing."

          http://twitter.com/search?q=%23pwn2own
          dvm
          Reply Vote

          • RE: Chrome was not tested today.

            I think Chrome was tested today - nobody came forward to do it.
            jgpmolloy
            Reply Vote

          • Re:

            Exactly. Any specific reason for that?
            dvm
            Reply Vote

          • Chrome patched its flaws just few days before

            Chrome patched its flaws just few days before the Pwn2Own contest. All the hackers doesn?t has enough time to find new exploit, so nobody going after Chrome on first day. It is not that Chrome very secure.
            I think the contest need some new rules so that all hackers can use the browser said 1 month earlier before the event, or else next year all browser vendors can do the same thing like Google to patch their browser just few days before the event.
            sawengchuan
            Reply Vote

          • @sawengchuan Nobody was stopping Microsoft or Mozilla from securing their..

            ..browsers. They either weren't aware of their vulnerabilities, weren't competent enough to fix them, or weren't motivated enough to fix them.


            Good for Google for finding and fixing theirs.
            AzuMao
            Reply Vote

          • Thanks sawengchuan

            So Google released a browser update with too little time for the hackers
            to develop another hack. Thank you for the information.
            jgpmolloy
            Reply Vote

      • Huh? Chrome has had CSS3 support for a long time.

        And if you want HTML5, it's working great in Chrome 5.
        AzuMao
        Reply Vote

      • As long as...

        Chrome does not offer a no-script like facility, I'm staying far from it...
        Ceridan
        Reply Vote

  • Won't happen with Ubuntu Linux, AppArmor LSM and profiled Firefox

    Nothing.

    Too hard?

    AppArmor stops exploits of any kind cold in their tracks.

    That's why TippingPoint chose not to include Linux in their competition.

    Fuzzing doesn't work against AA.

    I stake my reputation on it.

    Dietrich T. Schmitz
    GNU/Linux Advocate
    Dietrich T. Schmitz GNU/Linux Advocate
    Reply Vote

    • Duh, they could have opted for Linux without AppArmor.

      Ubuntu Linux with AppArmor isn't the only one of the what 2600+ variants of Linux?

      Ubuntu isn't Linux. It is a mere flavor of Linux.

      http://www.livecdlist.com/
      WinTard
      Reply Vote

      • Well, a buffer overrun might reach userland

        The point of AppArmor is that it mitigates any privilege escalation attempt.

        They simply won't get past AA.

        Do we need to review 'Linux is the kernel'...blah?
        (cough)

        OK WinTard commence with the copy/paste!
        Dietrich T. Schmitz GNU/Linux Advocate
        Reply Vote

        • Userland

          Even if it reaches userland in Linux, do we consider that being owned, or do you have to break in as root?
          davidr69
          Reply Vote

          • 0wned

            http://en.wikipedia.org/wiki/Owned
            Dietrich T. Schmitz GNU/Linux Advocate
            Reply Vote

          • Did ya read your link?

            "The term's original usage was close to that of the traditional meaning of the word "own" - for instance, "I owned the network at MIT" indicated that the speaker had cracked the servers and had the same root-level privileges that the legitimate owner of the servers had. "Owned", a later variant, became more common in the late 1990s, as did the more abstract usage referring to any compromised security mechanism. By 1997, "owned" was regularly used in website defacements,[5][6] and it subsequently spread to gaming circles, where it was used to refer to defeat in a game. For example, if a player makes a particularly impressive kill shot or wins a match by an appreciable margin in a multiplayer video game, it is not uncommon for he/she to say "owned" to the loser(s), as a manifestation of victory, a taunt, or provocation. "Ownage" has become a modern equivalent to a ?Turkey Shoot,? such as an experienced faction verses a beginner or disadvantaged faction."
            rtk
            Reply Vote

      • And they could have opted for Windows without ASLR/DEP/UAC..

        ..what is your point?

        Ubuntu is the most well known Linux distro for desktops.

        So it would make sense to compare desktop OSs to it.


        Other distros aren't generally as geared towards the main-stream crowd, and thus tend to require more technical skills to use.

        For example, the Linux distro Gentoo, and pretty much all of the *BSDs (which are the most secure, albeit not Linux).
        AzuMao
        Reply Vote

    • Or you could switch to Chrome

      like I did. I use the best browser (Chrome) on the
      best desktop OS (Windows 7 64 bit) on the best
      laptop (MacBook Pro). That makes me better than
      you. :)
      NonZealot
      Reply Vote

      • Same underlying security model issues. Read their 'caveats'

        Sandbox caveats:

        http://dev.chromium.org/developers/design-documents/sandbox#TOC-Other-caveats

        [b]"The operating system might have bugs. Of interest are bugs in the Windows API that allow the bypass of the regular security checks. If such a bug exists, malware will be able to bypass the sandbox restrictions and broker policy and possibly compromise the computer. Under Windows, there is no practical way to prevent code in the sandbox from calling a system service.

        In addition, third party software, particularly anti-malware solutions, can create new attack vectors. The most troublesome are applications that inject dlls in order to enable some (usually unwanted) capability. These dlls will also get injected in the sandbox process. In the best case they will malfunction, and in the worst case can create backdoors to other processes or to the file system itself, enabling specially crafted malware to escape the sandbox."[/b]

        And this is *why* Linux AppArmor LSM runs in its own external (to the system kernel!) protected memory space.

        Thank youz.

        Dietrich T. Schmitiz
        GNU/Linux Advocate
        Dietrich T. Schmitz GNU/Linux Advocate
        Reply Vote
CNET Join | Log In | Privacy | Cookies Close