"Hey Siri" support and possibly wireless charging case alongside AirPower charging mat.
Security Researchers Use Wi-Fi and Safari Exploits to Breach iPhone 7 at Annual Mobile Pwn2Own Contest
Trend Micro's annual Mobile Pwn2Own contest took place in Tokyo, Japan today at the PacSec security conference, and security researchers spent the day attempting to hack into the iPhone 7, the Samsung Galaxy S8, the Google Pixel, and the Huawei Mate 9 Pro in an effort to win prizes totaling more than $500,000.
Apple's iPhone 7, running iOS 11.1, the latest version of the iOS 11 operating system, was successfully breached twice by Tencent Keen Security Lab. The first hack targeted a Wi-Fi bug and won the team $110,000 and 11 Master of Pwn points, while the second hack targeted the Safari Browser and earned Tencent Keen Security Lab $45,000 and 12 Master of Pwn points.
Along with the iPhone 7, researchers were able to find exploits for the Samsung Galaxy S8 and the Huawei Mate 9 Pro, earning a total of $350,000.
Trend Micro hosts Pwn2Own in an effort to promote its Zero Day Initiative, designed to reward security researchers for disclosing major vulnerabilities to tech companies like Apple and Google.
Pwn2Own continues on through tomorrow, so additional exploits may be uncovered. Apple representatives have been known to attend Pwn2Own competitions in past years, and all vulnerabilities discovered are disclosed to Apple. The company then has 90 days to produce patches for all iOS-related bugs before they're publicly disclosed.
Apple's iPhone 7, running iOS 11.1, the latest version of the iOS 11 operating system, was successfully breached twice by Tencent Keen Security Lab. The first hack targeted a Wi-Fi bug and won the team $110,000 and 11 Master of Pwn points, while the second hack targeted the Safari Browser and earned Tencent Keen Security Lab $45,000 and 12 Master of Pwn points.
They used a total of four bugs to gain code execution and escalate privileges to allow their rogue application to persist through a reboot. They earned $60,000 for the WiFi exploit and added $50,000 for the persistence bonus - a total of $110,000 and 11 Master of Pwn points.Security researcher Richard Zhu was also able to leverage two bugs to exploit the Safari browser and escape the sandbox to successfully run code on the iPhone 7, earning him $25,000 and 10 Master of Pwn points.
Tencent Keen Security Lab was on the clock once more as they targeted the Safari Browser on the Apple iPhone 7. It took them just a few seconds to successfully demonstrate their exploit, which needed only two bugs - one in the browser and one in a system service to allow their rogue app to persist through a reboot. As the second finisher in the Browser category, they earned half of the cash award at $45,000, but still earned the full 13 Master of Pwn points.
Along with the iPhone 7, researchers were able to find exploits for the Samsung Galaxy S8 and the Huawei Mate 9 Pro, earning a total of $350,000.
Trend Micro hosts Pwn2Own in an effort to promote its Zero Day Initiative, designed to reward security researchers for disclosing major vulnerabilities to tech companies like Apple and Google.
Pwn2Own continues on through tomorrow, so additional exploits may be uncovered. Apple representatives have been known to attend Pwn2Own competitions in past years, and all vulnerabilities discovered are disclosed to Apple. The company then has 90 days to produce patches for all iOS-related bugs before they're publicly disclosed.
Tag: Pwn2Own
[ 93 comments ]
Top Rated Comments
(View all)
15 months ago
Would these security researches tell Tim cook that getting rid of touch ID was retarded?
This has nothing to do with FaceID or TouchID. Please remain relevant.
15 months ago
Would these security researches tell Tim cook that getting rid of touch ID was retarded?
What an irrelavant and pointless comment.
On a more relevant note. This exploit has been fixed in the new update.
15 months ago
These contests are great. They give good incentives to find security exploits, and they end up getting patched by Apple.
15 months ago
The real question is: Will their exploits they found affect my iPod touch running iOS 6.1.6?
:P
:P
15 months ago
On a more relevant note. This exploit has been fixed in the new update.
Has it? the post says "Apple's iPhone 7, running iOS 11.1, the latest version of the iOS 11 operating system" which came out yesterday.
15 months ago
Good job Google for being unbreachable.
Apple, Google, and Huawei all released last-minute patches in the middle of the night
[..]
Next up, 360 Security (@mj0011sec ('https://twitter.com/mj0011sec')) also attempted to exploit the Samsung Internet Browser on the Samsung Galaxy S8. They succeeded in getting the browser to run their code, then leveraged a privilege escalation in a Samsung application to persist through a reboot. These two bugs earned them $70,000 and 11 points towards Master of Pwn.
15 months ago
Exactly. If it’s that easy then why is the government so hell bent on getting back doors in these platforms?
Well Krupp, if I keep pounding on your door screaming "Let me in, let me in" you tend to think your locks are pretty good. In fact you think your locks are so good you don't even realize I'm pounding on your door from the inside.:eek:/re-orders tinfoil... using cash... in nickels, dimes, and pennies:oops:
15 months ago
Look, it's okay. You don't have to backtrack. You made a mistake.
Samsung got hacked, Apple got hacked. You're replying to a report about Google being unhackable with a post about Samsung. If it makes you feel better, all mobile OSs can be hacked.
Your mental gymnastics are adorable.
15 months ago
Google releasing a "last-minute patches in the middle of the night" isn't Google?
I think Austin is stating Samsung isn't Google. Samsung's internet browser has nothing to do with Google. You're entire quote was about Samsung, not Google.[ Read All Comments ]
For this week's giveaway, we've teamed up with Anki to offer MacRumors readers a chance to win one of the company's adorable little Vector robots, which designed to be a personal robot...
Last year, accessory company Elago launched the W3 Charging Stand for Apple Watch, which turned Apple's modern wearable into a classic Macintosh. This week, Elago announced the latest iteration...
Cellular network operator O2 on Friday said its data networks had been restored after millions of smartphones across the UK and Japan were taken offline yesterday (via BBC).
A statement on its...
Bang & Olufsen over the past week has added AirPlay 2 support to more of its speakers, including the BeoPlay A9 and BeoPlay M5.
BeoPlay M5 speaker in AirPlay Picker via Brad Thomas
This...
Following a demo earlier this year at WWDC, LEGO today launched the LEGO AR Playgrounds app for iPhone and iPad [Direct Link]. The app uses ARKit to place digital LEGO characters and blocks into...
Google this week announced that it is shutting down its messaging app Google Allo [iOS Direct Link], and incorporating many of its features into the Messages app on Android smartphones. Google Allo...
Best Buy today launched a new Apple savings event, marking down iPhones, MacBook Airs, MacBook Pros, iMacs, iPads, iPad Pros, and some HomeKit devices. There are numerous notable discounts in the...
ConnectSense, one of the first companies to introduce a HomeKit-enabled smart plug, today announced the launch of the Smart Outlet 2, its second-generation HomeKit product.
Like the first Smart...
