Richard Zhu and Amat Cama, two white hat hackers, recently teamed up at the Mobile Pwn2Own contest in Tokyo and ended up earning a $60,000 prize after finding an iPhone exploit, according to a blog post on the Zero Day Initiative website.
The duo used a Safari weakness on an iPhone X running iOS 12.1 to retrieve a photo that had recently been deleted from the device. The hackers used a malicious Wi-Fi access point to exploit a just-in-time (JIT) compiler vulnerability.
The exploit the two hackers discovered can also be used to access additional files beyond deleted photos; the deleted photo just happened to be the first file the two came across and so it was used as a demonstration.
Apple has been informed of the vulnerability and will likely address it in an upcoming iOS update.
The duo used a Safari weakness on an iPhone X running iOS 12.1 to retrieve a photo that had recently been deleted from the device. The hackers used a malicious Wi-Fi access point to exploit a just-in-time (JIT) compiler vulnerability.
The exploit the two hackers discovered can also be used to access additional files beyond deleted photos; the deleted photo just happened to be the first file the two came across and so it was used as a demonstration.
Next up, Amat and Richard returned to the Short Distance category. This time, they were targeting the iPhone X over Wi-Fi. They used a pair of bugs – a JIT vulnerability in the web browser followed by an Out-Of-Bounds write for the sandbox escape and escalation. The successful demonstration earned them $60,000 USD more and 10 additional Master of Pwn points. This ends their first day of competition with $140,000 USD and a commanding lead for the Master of Pwn with 31 points.With the prize money and points awarded from the iPhone vulnerability along with other exploits shown off at the event, Zhu and Cama won the "Master of Pwn" title.
Apple has been informed of the vulnerability and will likely address it in an upcoming iOS update.
14 comments
Disney's annual D23 Expo kicked off in Anaheim on Friday, and the company has revealed more details about its upcoming streaming service, Disney+.
According to CNET, Disney+ will cost...
Apple has suspended the grading program that used contractors to listen to Siri recordings for quality control purposes, but in a new report, The Irish Examiner (via The Verge) gives some additional...
Samsung recently released its latest flagship smartphones, the Galaxy Note 10 and the Galaxy Note 10+, which will be two of Apple's main competitors for the upcoming 2019 iPhones.
The new...
Apple added new features and new functionality to most of its built-in apps, including Health and Activity, both of which have either changed significantly or have major new features worth noting.
...
Dutch brand ZENS today unveiled a wireless charging mat with 16 overlapping coils, allowing two devices to be charged anywhere on the mat.
The ZENS Liberty will be able to charge any...
Update: On schedule, the HomePod has now launched in Japan and Taiwan.
Original story follows.
Apple's HomePod is set to launch in Japan and Taiwan next week, on Friday, August 23,...
Ahead of the launch of iOS 13, iPadOS, and macOS Catalina, Apple has updated its iCloud.com beta site with a fresh look and a new Reminders app (via Federico Vittici).
The beta version of...
Bose today announced the launch of a new speaker, the Bose Portable Home Speaker, which is designed to work with Apple's AirPlay 2 protocol.
The Bluetooth-enabled Portable Home Speaker is...
