The 10th annual Pwn2Own hacking competition ended Friday in Vancouver. Some of the highlights: Ars Technica reports one team “compromised Microsoft’s heavily fortified Edge browser in a way that escapes a VMware Workstation virtual machine it runs in… by exploiting a heap overflow bug in Edge, a type confusion flaw in the Windows kernel and an uninitialized buffer vulnerability in VMware.” Digital Trends reports “Samuel Grob and Niklas Baumstark used a number of logic bugs to exploit the Safari browser and eventually take root control of the MacOS on a MacBook Pro, [and] impressed onlookers even more by adding a custom message to the Touch Bar which read: “pwned by niklasb and saelo.”Ubuntu 16.10 Linux was also successfully attacked by exploiting a flaw in the Linux 4.8 kernel, “triggered by a researcher who only had basic user access but was able to elevate privileges with the vulnerability to become the root administrative account user…” reports eWeek. “Chaitin Security Research Lab didn’t stop after successfully exploiting Ubuntu. It was also able to successfully demonstrate a chain of six bugs in Apple Safari, gaining root access on macOS.”Another attacker “leveraged two separate use-after-free bugs in Microsoft Edge and then escalated to SYSTEM using a buffer overflow in the Windows kernel.” None of the attendees registered to attempt an attack on the Apache Web Server on Ubuntu 16.10 Linux, according to eWeek, but the contest’s blog reports that “We saw a record 51 bugs come through the program. We paid contestants $833, 000 USD in addition to the dozen laptops we handed out to winners. And, we awarded a total of 196 Master of Pwn points.” Read more of this story at Slashdot.
Read more here:
Edge, VMWare, Safari, And Ubuntu Linux Hacked at Pwn2Own 2017
