March 18th, 2009

Pwn2Own trifecta: Hacker exploits IE8, Firefox, Safari

Posted by Ryan Naraine @ 5:40 pm

Categories: Apple, Arbitrary Code Execution, Browsers, Complex Attacks, Data theft, Denial of Service (DoS), Firefox, Malware, Mozilla, Open source, Patch Watch, Research, Responsible disclosure, Vulnerability research, Zero-day attacks

Tags: Nil, Mozilla Firefox, Apple Safari, Hacker, Hacking, Web Browsers, Security, Internet, Ryan Naraine

VANCOUVER, BC — It took a while longer but Microsoft’s Internet Explorer 8 did not survive the hacker onslaught at this year’s CanSecWest Pwn2Own contest.

[ ALSO SEE: Pwn2Own 2009: Safari/MacBook falls in seconds ]

A security researcher named “Nils” (he declined to provide his full name) performed a clean drive-by download attack against the world’s most widely used browser to take full control of a Sony Vaio machine running Windows 7.

He won a cash prize and got to keep the hardware.  Details of the vulnerability, which was described by contest sponsor TippingPoint ZDI as a “brilliant IE8 bug!” are being kept under wraps.

Several members of Microsoft’s security response team were on hand to witness the successful exploit.

“Nils” also scored a clean hit against Apple’s Safari (he was the second hacker to exploit Safari) and, later in the afternoon, he exploited a Firefox zero-day flaw to claim the trifecta.

More to come…