Chinese hacker cracks Safari, wins $40K, praises Apple's security

CNN Tech Fortune ^ | March 14, 2014: 12:07 PM ET | By Philip Elmer-DeWitt

[Swordmaker]

Some of his prize money will go to families of the missing Malaysian airline.

Keen Team's Chen, right, demonstrating an Adobe Flash exploit FORTUNE -- Everybody's Web software got "pwned" at the Pwn2Own hackers conference this week: Apple's (AAPL) Safari, Google's (GOOG) Chrome, Microsoft's (MSFT) Internet Explorer, Mozilla's Firefox and Adobe's (ADBE) Reader and Flash.

Chrome was hacked by a French team from Vupen Security with a use-after-free vulnerability that affects both the WebKit and Blink rendering engines.

Safari was defeated by Liang Chen, one of a pair Chinese Keen Team hackers, using a heap-overflow-and-sandbox-bypass combination that took three months to perfect. . .

. . . "I think the Webkit fix will be relatively easy," Chen told Mimoso. "The system-level vulnerability is related to how they designed the application; it may be more difficult for them."

[Swordmaker]

"For Apple, the OS is regarded as very safe and has a very good security architecture," Chen told ThreatPost's Michael Mimoso. "Even if you have a vulnerability, it's very difficult to exploit. Today we demonstrated that with some advanced technology, the system is still able to be pwned. But in general, the security in OS X is higher than other operating systems."

[Swordmaker]

As usual, Apple fell first at the Pwn2Own Security Hackers Conference last week, because the winner, Liang Chen, spent three months preparing his exploit. However, every other browser and attempt also fell including Firefox, Chrome, Internet Explorer, and even Adobe Reader and Flash. Liang Chen commented ". . . In general, the security in OS X is higher than other operating systems" and "Even if you have a vulnerability, it's very difficult to exploit."—PING!

Apple Ping!

If you want on or off the Mac Ping List, Freepmail me.

[WVKayaker]

. . . In general, the security in OS X is higher than other operating systems" and "Even if you have a vulnerability, it's very difficult to exploit."

I'm still allowing Apple to protect me. I NEVER type that password when I see this type of box pop us unexpectedly. Besides, I have nothing of interest to anybody but (possibly) the NSA. They want to know what I say to Aunt Maude...

[Swordmaker]

Amazing. . . I am in error. Safari did not fall first! Internet Explorer fell first this year, garnering $100,000 for the team that exploited it and Windows 8.1!

[amigatec]

This article is light on information. It doesn’t say much to get me worried.

[Hot Tabasco]

Safari was defeated by Liang Chen

Big deal, so he can hack computers........Can he play infield? Ha, thought so.......

[Starstruck]

I cracked Tic Tac Toe.

[Chgogal]

Thank you for the good news. Is Apple going to hire him to motivate his silence? : )

[Swordmaker]

Thank you for the good news. Is Apple going to hire him to motivate his silence? : )

Apple was at the conference and will close the vulnerability. . .

[Chgogal]

I'm sure Apple will close the vulnerability but one shouldn't let a good talent go to waste. : )

[LaRueLaDue]

“But in general, the security in OS X is higher than other operating systems.”

And what is OS X based on? Unix! Specifically BSD-based Unix. Hah! Eat it Windows!

[roadcat]

But in general, the security in OS X is higher than other operating systems.

The thing that kills me is that people are lax at using security precautions. I helped three different individuals with their computers in the last few weeks. All were using the default administrator ID to log in. A couple had no password at all to log in. And so on. All their data in the desktop window, none in separate folders without sharing privileges etc. Companies put a lot of work into security architecture and people don't put it to use.

[Gene Eric]

Consider this sponsored hacking exercise a good thing.

[SunkenCiv]

Thanks Swordmaker.