Safari, Edge and Firefox browsers were the preferred targets for white-hat hackers at the hacking competition, Pwn2Own, which took place in Vancouver, Canada on March 14th & 15th.
Richard Zhu (@fluorescence) emerged as the grand winner of the competition, as he managed to score the highest score by hacking Edge and Firefox browsers. Zhu, pictured below, was awarded $120,000 for his findings.
Hackers participating in the competition were asked to identify vulnerabilities in a number of popular software, including Oracle's VirtualBox, VMware Workstation, Microsoft Hyper-V Client, Chrome, Safari, Edge, Firefox, Adobe Reader, Microsoft Office 365 ProPlus, Microsoft Outlook, NGINX, Apache Web Server, Microsoft Windows SMB, and OpenSSL.
Each contestant had 30 minutes and three attempts to successfully implement an exploit. Contestants earned points based on the type of exploits they used. The table below shows how the final score was determined:
How Firefox & Safari were hacked
Richard Zhu's exploit included an OOB (out-of-bounds write) in the browser and an integer overflow in the Windows kernel, which led to the breach of the popular Firefox browser.
Apple's Safari was the next target on the list, and this time Markus Gaasedelen (@gaasedelen), Nick Burnett (@hiszn13) and Patrick Biernat of Ret2 Systems managed to hack the browser on the fourth attempt via a macOS kernel EoP.
The contest, however, requires successful exploitation within three attempts, so contestants did not win any prizes. However, the bug was disclosed to Apple and is expected to be fixed soon with a software update.
The Safari exploit was achieved most quickly via a sandbox escape, by Alex Plaskett (AlaxJPlaskett), Georgi Geshev (munmap), and Fabi Beterke (pwnfl4k3s) of MWR Labs, who managed to exploit the browser with a heap buffer underflow and an uninitialized operating system stack variable, gaining code execution privileges. The team earned $55,000 after their successful attack.
Samuel Groß also successfully hacked Apple's browser. Groß exploited a JIT optimization bug in Safari, a macOS logic bug, and a kernel overwrite vulnerability to execute code that led to a successful exploitation of the browser. His effort earned the young hacker $65,000 and 6 points, which earned him second place in Pwn2Own.
