iPhone, Safari, Internet Explorer 8, Firefox all vanquished at Pwn2Own

Stephen Withers
Friday, 26 March 2010 08:47

Opinion and Analysis

The first day of the Pwn2Own 2010 saw all the major platforms defeated.

As I predicted, the iPhone and Safari were the first products to be beaten in the Pwn2Own contest at the CanSecWest conference.

It didn't take psychic abilities or a brain the size of a planet to predict that would happen, as the random draw assigned the first two time slots to attacks on those platforms.

Indeed, looking at the results so far, each each platform in the competition has been defeated by the first person to attack it. As I previously wrote, "You don't enter this sort of contest unless you already have an exploit".

So Vincenzo Iozzo and Ralf Philipp Weinmann exploited the iPhone, Charlie Miller exploited Safari (for the third year running), Peter Vreugdenhil defeated Internet Explorer 8 on 64-bit Windows 7 (with an exploit described as "quite impressive from a technical impressive, bypassing all the anti-exploitation features", ie ALSR and DEP), and Nils exploited Firefox on Windows 7 (which also required him to work around ALSR and DEP).

This year, only one prize was available per platform. As soon as it had been won, that part of the content was deemed complete and no further attempts were allowed.

How did Miller and Vreugdenhil find the vulnerabilities? Please read on.