Mobile Pwn2Own Hacking Contest Claims Nexus 4 Among Victims

When it was over, the Nexus 4, Samsung Galaxy S4, and Apple iPhone could all count themselves as hacking victims.

Fortunately, it happened in the name of research at the Mobile Pwn2Own contest at the PacSec 2013 Conference this week in Tokyo. During the past two days, the contest saw researchers use application vulnerabilities to compromise each of the devices and walk away with thousands of dollars in cash prizes.

The event was sponsored by Hewlett-Packard's Zero Day Initiative (ZDI), as well as BlackBerry and the Google Android and Chrome security teams. Before the competition ended today, a researcher under the alias "Pinkie Pie" compromised Google Chrome on both a Nexus 4 and Samsung Galaxy S4, and was awarded $50,000. The researcher's exploit took advantage of two vulnerabilities -- an integer overflow issue and a full sandbox escape.

"Similar to the exploits we saw on day one of our contest, in order for the user's device to be successfully compromised, they would need to be enticed to visit a malicious site in order to be exposed to the malicious code," blogged Heather Goudley, senior security content developer at HP. "Again the attack depends on first compromising the user to get them to take an action (e.g. clicking a link in an email, or an SMS or on another web page) and then compromising the device by exploiting these vulnerabilities. The final outcome would be the remote execution of code of an attacker's choice."

This vulnerability has been disclosed to Google, one of multiple vendors that will have to deal with patching vulnerabilities uncovered in the contest.

On Wednesday, the Keen Team of Keen Cloud Tech won $27,500 for demonstrating two exploits against Safari on an iPhone 5 that allowed them to steal a photo on iOS version 6.1.4 and capture Facebook credentials on iOS version 7.0.3. Neither of the devices was jailbroken, and both exploit demonstrations took no more than five minutes. For the exploit to work, the user would need to click on a link in an email, SMS, or Web page.

"Both of the Safari exploits leveraged memory corruption vulnerabilities, which allowed them to gain access to Facebook cookies [on iOS 7.0.3] and photos stored on the device [on iOS 6.1.4]," Brian Gorenc, manager of HP's ZDI, told Dark Reading.

Also Wednesday, Japan's Team MBSD of Mitsui Bussan Secure Directions won $40,000 after demonstrating exploits against several applications installed by default on the Samsung Galaxy S4. After exploiting the apps, the researchers were able to install malware on the device and steal confidential data. For the attack to work, the user must be tricked into visiting an attacker-controlled malicious website.

[The biggest security weaknesses in most Android smartphones today are the custom apps and features that come packaged with the devices, new research shows. See Custom Features Incur Security Flaws In Popular Android Smartphones.]

"The implications for this exploit are worrisome," Goudley blogged. "While you may be reticent to click on links (heeding the commonly-given, if somewhat ridiculous advice to 'click carefully') it is unlikely that you assess risk and use caution the same way on your mobile devices as you do on your desktop. The message here, however, is clear -- mobile platforms are vulnerable to the same or very similar methods of malware distribution that plague the desktop and you would be wise to take heed.

"One of the reasons HP's Zero Day Initiative was excited to bring the competition to Tokyo was to get a firsthand look at the security research happening on this side of the globe. We were lucky enough to have teams from both China and Japan compete and win this year."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.