Got a tip for us? Share it...

Chinese Security Team Exploits Safari Security Flaw at PWN2OWN

safariicon.jpgEvery year for the past seven years, hackers have gathered at the annual PWN2OWN event to hack high-profile software and mobile devices using previously unknown vulnerabilities. Apple's Safari browser and iOS platform are often included in the annual contest, which also targets Internet Explorer, Chrome, Firefox, and Adobe's Flash and Reader applications. This year, Safari was taken down on day two by a team of vulnerability researchers and exploit developers from China, reports ThreatPost.

China's Keen team exploited two vulnerabilities that allowed the team to execute arbitrary code using a Safari WebKit flaw and circumvent Apple's sandbox via an OS X system-level vulnerability. Speaking about the vulnerabilities they found, the Keen team stated that Apple's OS X is difficult to exploit and the operating system overall is very secure.
"For Apple, the OS is regarded as very safe and has a very good security architecture," Keen team member Liang Chen said. "Even if you have a vulnerability, it’s very difficult to exploit. Today we demonstrated that with some advanced technology, the system is still able to be pwned. But in general, the security in OS X is higher than other operating systems."
Apple representatives attended the contest and were made aware of the security exploits used in the contest. This isn't the first time Safari has been exploited during the contest. In 2011, a team of French security researchers compromised a MacBook by remotely running code within five seconds of contacting the machine.

Top Rated Comments

(View all)

27 weeks ago
Public awareness of security flaws is the best way to ensure the security of our devices. Thank you Chinese security team.
Rating: 18 Votes
27 weeks ago

The most secure OS maybe FreeBSD or Linux.


Which one of thousand existing Linux distributives are you talking about? Linux is not an OS, its a kernel - and this is the reason why Linux is not even considered at PWN2OWN. The kernel is usually quite secure, its the software stack on its top that has vulnerabilities.
Rating: 9 Votes
27 weeks ago

I wonder if the hacker praise is real or just polite words. Hopefully, we will see a Safari update soon.


I'm sure there is professional praise. Plus it's essentially free debug testing for the companies participating.
Rating: 7 Votes
27 weeks ago

[...]if I understood correctly you would have to use both to really get control.


I would guess that if the second vulnerability circumvents sandboxing, that it should be the first fix. Webkit vulnerabilities are almost inevitable; that's why sandboxing exists. If sandboxing doesn't catch the threat or is bypassed, that's a greater weakness.
Rating: 5 Votes
27 weeks ago
The article also said the team felt that Safari was more secure than other platforms. I am no expert but it does look like at least one is simple to fix and if I understood correctly you would have to use both to really get control. So if they fix either it would solve the problem.

Having said all that, if this is the most secure, the others have some really big problems.
Rating: 4 Votes
27 weeks ago

Which one of thousand existing Linux distributives are you talking about? Linux is not an OS, its a kernel - and this is the reason why Linux is not even considered at PWN2OWN. The kernel is usually quite secure, its the software stack on its top that has vulnerabilities.


Indeed. And with the average GUI linux install being anywhere between 3~10 GB on disk, with the kernel only making up ~100MB of that, there is a lot of software stack to go around.

Karl P
Rating: 3 Votes
27 weeks ago
I wonder if the hacker praise is real or just polite words. Hopefully, we will see a Safari update soon.
Rating: 3 Votes
27 weeks ago
I'm sure the NSA has ways.
Rating: 3 Votes
27 weeks ago

The most secure OS maybe FreeBSD or Linux. MAC OS X evolved from FreeBSD or Unix. OS X contains indecent number of vulnerabilities, but, still can be considered relatively safe.


I think you mean OpenBSD, which has a greater focus on security. Mac OS X is based on FreeBSD.
Rating: 2 Votes
27 weeks ago

Most major distributions of linux should be pretty secure. Like Ubuntu, Linux mint (based on Ubuntu) , Fedora. openSUSE. Yes, wrong configuration of any OS will make it vulnerable to attack.


What do you base this on? There have been three exploits of Firefox presented at this PWN2OWN - why do you think Firefox would be more secure under Linux than under Windows?
Rating: 2 Votes

[ Read All Comments ]