The mobile hacking competition, Pwn2Own, ended on Thursday with satisfaction for Windows Phone and Android operating system developers, as the hackers only partially achieved their goal.
The competition was organized by HP's Zero-Day Initiative (ZDI), and focuses on demonstrating zero-day exploits that can be used to gain complete control of the device.
On the last day of the event, Nico Joly, a veteran researcher from French security firm Vupen, tested his skills on a Lumia 1520 Windows Phone, using a web browser exploit to take full control of the device.
However, the sandbox prevented him from achieving his goal and all he managed to do was exfiltrate the cookie database, which is a feat as cookies can be used to access a user's online accounts and make modifications in the same way as they would be made by the owner.
The second competitor was Jüri Aedla, who targeted Android and carried out a WiFi-based attack (the DHCP glitch allows remote code execution) against a Nexus 5 running Android. The attack was also unsuccessful in taking control of the device, but it did demonstrate code execution by remotely executing the web browser.
Pwn2Own , and was held in Tokyo, at the security conference, PacSec.
During Wednesday's session, hackers managed to compromise devices from Samsung (Galaxy S5), LG (Nexus 5), Apple (iPhone 5S) and Amazon (Fire Phone).
The exploits have not been made public, in accordance with the rules of the competition, but ZDI verified and validated them and took immediate action to inform the companies involved in the development of the affected products.
ZDI promised to provide details about the individual exploits in the coming weeks.
