Hackers Win $60,000 for Finding iPhone Safari Exploit at Tokyo Pwn2Own Contest

by

Richard Zhu and Amat Cama, two white hat hackers, recently teamed up at the Mobile Pwn2Own contest in Tokyo and ended up earning a $60,000 prize after finding an iPhone exploit, according to a blog post on the Zero Day Initiative website.


The duo used a Safari weakness on an iPhone X running iOS 12.1 to retrieve a photo that had recently been deleted from the device. The hackers used a malicious Wi-Fi access point to exploit a just-in-time (JIT) compiler vulnerability.


The exploit the two hackers discovered can also be used to access additional files beyond deleted photos; the deleted photo just happened to be the first file the two came across and so it was used as a demonstration.

Next up, Amat and Richard returned to the Short Distance category. This time, they were targeting the iPhone X over Wi-Fi. They used a pair of bugs – a JIT vulnerability in the web browser followed by an Out-Of-Bounds write for the sandbox escape and escalation. The successful demonstration earned them $60,000 USD more and 10 additional Master of Pwn points. This ends their first day of competition with $140,000 USD and a commanding lead for the Master of Pwn with 31 points.

With the prize money and points awarded from the iPhone vulnerability along with other exploits shown off at the event, Zhu and Cama won the "Master of Pwn" title.


Apple has been informed of the vulnerability and will likely address it in an upcoming iOS update.

Top Rated Comments

(View all)
Avatar
23 months ago
Hopefully Apple will snap them up so their talents can strengthen Apple's security
Score: 5 Votes (Like | Disagree)
Avatar
23 months ago
This is an annual competition and while it seems bad on the surface, its actually good - all these exploits (which are out there and probably being used by others) will now get closed.

The more of this the better. The picture of the two heroes are awesome....so young, gotta be college or just out.

I'd love to see Apple put serious money out there for prizes to entice folks who might sell such things to bad actors or governments instead (there is such a market with big money involved).
Score: 5 Votes (Like | Disagree)
Avatar
23 months ago
Love the white hats, congratulations to some serious and extremely young hackers. Great careers ahead for both!! Completely agree that Apple should participate in the bug bounty system to encourage the good guys!!!
Score: 2 Votes (Like | Disagree)
Avatar
23 months ago

Hopefully Apple will snap them up so their talents can strengthen Apple's security

Why would they? pwn2own is an annual contest. there were vulnerabilities last year, there are vulnerabilities this year, and there will be vulnerabilities next year. Hiring the researchers who find them (vulns) is no guarantee they'll strengthen their security. They'd end up with a boatload of researchers and still have the systems exploited every year. Security is an ongoing exercise.
Score: 1 Votes (Like | Disagree)
Avatar
23 months ago

The 3-letter agencies can not access our data. Ohh, wait...

0 days will always exist, the differences is that agencies keep them for themselves.
What you should expect from a company is to do their best to protect their customers. The bigger issues in today it world is that a chunk of companies found out that personal data is an extremely lucrative business, offering free service in exchange as trojan horses, now that is really concerning.
Score: 1 Votes (Like | Disagree)
Avatar
23 months ago
Congrats to the White Hat hackers. A win for all involved.
Score: 1 Votes (Like | Disagree)

Top Stories

Apple Takes Legal Action Against Small Company With Pear Logo

Saturday August 8, 2020 11:09 am PDT by
Apple is taking legal action against the developers of the app "Prepear" due to its logo, according to iPhone in Canada. Prepear is an app that helps users discover recipes, plan meals, make lists, and arrange grocery deliveries. The app is a spinoff of "Super Healthy Kids," and the founders claim that they are facing litigation from Apple. Apple reportedly takes issue with Prepear's logo, ...

Kuo: Global iPhone Shipments Could Decline Up to 30% If Apple Forced to Remove WeChat From App Store [Updated x2]

Sunday August 9, 2020 10:17 pm PDT by
In a worst-case scenario, Apple's annual global iPhone shipments could decline by 25–30% if it is forced to remove WeChat from its App Stores around the world, according to a new research note from analyst Ming-Chi Kuo viewed by MacRumors. The removal could occur due to a recent executive order aiming to ban U.S. transactions with WeChat and its parent company Tencent. Kuo lays out...

Google Maps Debuts New Apple Watch App and CarPlay Features

Monday August 10, 2020 9:16 am PDT by
Google today announced the launch of several features for Google Maps on Apple products, including new CarPlay functionality and a new Google Maps app that works on Apple Watch. The new Google Maps app for Apple Watch works similarly to the iOS app, allowing Apple Watch owners to get directions for a car, bike, public transit, or on foot. The app supports estimated arrival times and...

Foxconn Reportedly Begins Seasonal Hiring Spree for iPhone 12 Production

Monday August 10, 2020 7:03 am PDT by
Apple's largest manufacturing partner Foxconn has begun its seasonal hiring spree to assist with iPhone 12 production, offering employees who recruit qualified applicants up to a 9,000 yuan bonus, according to Chinese media reports. As usual, Foxconn needs as many hands on deck as possible at its factory in Zhengzhou, China to assist with mass production of the upcoming iPhones. Apple is...

Apple May Release 4G-Only iPhone 12 in Early 2021

Tuesday August 11, 2020 5:28 am PDT by
In a research note shared by Business Insider, Wedbush Securities analysts said that Apple may release a cheaper iPhone 12 in early 2021 with no 5G connectivity. Wedbush initially believed Apple would launch a mix of 4G and 5G iPhone 12 models this fall. Following re-examination of Asian supply chains, analysts Daniel Ives, Strecker Backe, and Ahmad Khalil revised the predictions,...

2020 iMac Teardown Reveals Internal Changes and Similarities

Saturday August 8, 2020 12:44 pm PDT by
A teardown video, shared by OWC, reveals the internal changes in the new 2020 27-inch iMac. The 2020 27-inch iMac was announced earlier this week with 10th-generation Intel Core processors, AMD Radeon Pro 5000 series graphics, up to 128GB of RAM, up to 8TB of storage, a 1080p front-facing FaceTime camera, a True Tone display with a nano-texture glass option, higher fidelity speakers, and...

Apple Believes This German Cycling Path Logo Infringes on Its Own Logo

Wednesday May 1, 2019 9:51 am PDT by
Apple recently objected to the logo of a new German cycling path in an appeal filed with the German Patent and Trademark Office, according to German outlets General-Anzeiger Bonn and Westdeutscher Rundfunk. Apple reportedly takes issue with the logo's green leaf and supposed "bitten" right side, attributes the company believes are too similar to its own logo. The logo, registered with the ...

Apple Seeds First Public Beta of watchOS 7 to Public Beta Testers

Monday August 10, 2020 10:33 am PDT by
Apple today seeded the first public beta of an upcoming watchOS 7 update to public beta testers, one week after seeding the fourth beta to developers and a month and a half after the Worldwide Developers Conference. The update can be downloaded after installing the proper profile from Apple's Public Beta website. watchOS 7 should not be installed on a primary device as it is still an early...

Apple Watch Likely to Adopt MicroLED Display Technology in 3-4 Years

Monday August 10, 2020 2:55 am PDT by
This year's Apple Watch Series 6 is expected to feature an OLED screen like previous models, but a future model is likely to be the first Apple product to adopt MicroLED display technology, albeit not for another three to four years. That's the main takeaway reading between the lines of comments made by the chairman of Epistar, Taiwan's top LED producer, which is reportedly working on a...

Apple Seeds iOS 14 and iPadOS 14 Public Beta 4 to Testers

Thursday August 6, 2020 10:05 am PDT by
Apple today seeded new public betas of upcoming iOS 14 and iPadOS 14 updates to its public beta testing group. Today's software releases, which Apple labels as fourth betas to keep them in line with developer betas, are actually the third betas that Apple has provided and they come two weeks after the prior beta releases. Public beta testers who have signed up for Apple's beta testing...