Chinese hacker cracks Safari, wins $62.5K, praises Apple's security

March 14, 2014: 12:07 PM ET

Some of his prize money will go to families of the missing Malaysian airline.


Keen Team's Chen, right, demos an exploit to HP's Joshua Smith

FORTUNE -- Everybody's Web software got "pwned" at the Pwn2Own hackers conference this week: Apple's (AAPL) Safari, Google's (GOOG) Chrome, Microsoft's (MSFT) Internet Explorer, Mozilla's Firefox and Adobe's (ADBE) Reader and Flash.

Chrome was hacked by a French team from Vupen Security with a use-after-free vulnerability that affects both the WebKit and Blink rendering engines.

Safari was defeated by Liang Chen, one of a pair Chinese Keen Team hackers, using a heap-overflow-and-sandbox-bypass combination that took three months to perfect.

"For Apple, the OS is regarded as very safe and has a very good security architecture," Chen told ThreatPost's Michael Mimoso. "Even if you have a vulnerability, it's very difficult to exploit. Today we demonstrated that with some advanced technology, the system is still able to be pwned. But in general, the security in OS X is higher than other operating systems."

In a separate interview with CNET, Chen said that OS X is harder to attack than iOS 7.0 because Apple issues security updates for its desktop operating system more frequently than for its mobile OS.

The two-day event, sponsored by Hewlett-Packard (HPQ) and organized by the HP-owned Zero-Day Initiative, paid out $850,000 in prize money to eight teams of competitors, plus another $82,500 in charitable donations. The event was staffed by observers from Apple and the other companies, which will presumably now start patching those holes.

"I think the Webkit fix will be relatively easy," Chen told Mimoso. "The system-level vulnerability is related to how they designed the application; it may be more difficult for them."

CORRECTION: An earlier version of this story had the prize money wrong. Keen Team won $62,500 for pwning Safari and another $75,000 for an Adobe Flash exploit for a total of $137,500. Source: Pwn2Own 2014: Rules and Unicorns 

  • The browser war is far from over

    It's just gone mobile.

    FORTUNE – There was a time when web browsers duked it out for dominance on the desktop. But with users consuming information more and more on smartphones, tablets, and newer form factors like "phablets," the battleground has shifted to mobile. Who's winning?

    As recently as June 2012, the competition was in a dead heat: Android led with nearly 22%, followed by Opera at 22%, then Safari on iOS MORE

    - May 20, 2013 11:23 AM ET
  • Chrome Crankshaft Javascript engine scores fluctuate

    How fast is fast?

    Google (GOOG) advertised its new Crankshaft Javascript rendering engine as 50% faster than the current version of its browser yesterday.  Computerworld did some testing and found out that Google was right...when tested on their own V8 testing platform.

    Chrome's "canary" build -- the least stable and most advanced version of the browser -- was 40.5% faster than the "dev" edition and 43.5% faster than the current "stable" version.

    It also MORE

    - Dec 8, 2010 6:03 PM ET
  • ChromeOS hits Microsoft hard with Citrix announcement

    ChromeOS is weaponized for business with Citrix, and encrypted storage.

    Last week, Google (GOOG) Engineer Linus Upson made a stir when he said that ChromeOS computers could replace 60% of corporate Windows desktops out there at launch.  The assertion at the time may have sounded pretty outlandish. But Google has a few secret weapons at its disposal.

    Today, Citrix (CTSX) got on board with Google's ChromeOS.  When Notebooks running ChomeOS launch in MORE

    - Dec 7, 2010 11:08 PM ET
    Posted in: , , ,
  • Chrome explodes at the expense of IE

    Microsoft's Internet Explorer dips below 50% of the browser market for the first time since the late 90s.

    Google's (GOOG) Chrome browser continues to increase its market share at an impressive rate, more than tripling from 3.69%  September 2009 to 11.54%  September  2010,  according to browser analytics firm Statcounter.

    A year ago it was a three-horse race between Apple's (AAPL) Safari, Opera and Google's Chrome for third place behind Firefox and IE. MORE

    - Oct 5, 2010 11:21 AM ET
  • Google Checkout becomes important again for Chrome Store

    Google's monetary exchange service, temporary sidelined, is poised to make a comeback as the exchange for the Chrome Web Store.

    Google's Chrome project(s) are about getting people to do things on the web in a browser (as opposed to say an app).  One of the bigger aspects of this strategy is Google's intent to create a kind of App Store for Web developers, which allows them to both make some money MORE

    - Sep 24, 2010 12:29 AM ET
  • Today in Tech: News around the Web

    A round-up of the companies, deals, and trends that made headlines.

    Every day, the Fortune staff spends hours poring over tech stories, posts, and reviews from all over the Web to keep tabs on the companies that matter. We've assembled the morning's most newsworthy bits below.

    Microsoft (MSFT) and Facebook are in talks to expand their search partnership, which could give Bing access to anonymized data from consumer usage of the social network's MORE

    - Sep 16, 2010 8:18 AM ET
  • Google: We don't do Windows

    Google is phasing out its use of Microsoft's Windows on desktops, citing security concerns stemming from the recent Chinese hacking incident

    It must be nice to be a Google employee.  You get to work with the smartest engineers out there.  You get gourmet cafeteria food and all kinds of amenities.  But best of all, you aren't given some generic, locked-down PC that you aren't familiar with.  You get to pick what platform you MORE

    - May 31, 2010 10:30 PM ET
  • Palm shows up at I/O, No Chrome for WebOS (Updated)

    Palm demonstrated some software based on HTML5 today, not that Chrome was coming to webOS, as previously speculated.

    Breakfast is being served and the show is about to begin.  Here's a quick clip of the show floor with an unlikely guest.

    Palm.  With a little Chrome Browser icon below their display.

    Though it was easy to assume that they'd be utilizing the Chrome Browser, it turns out they have a software wing and MORE

    - May 19, 2010 11:20 AM ET
    Posted in: , ,
  • Google and Verizon building iPad competitor

    Verizon Wireless Chief Executive Lowell McAdam confirmed today that they were working with Google to build a competitor to the iPad.

    McAdam, in an interview with the WSJ, said that tablets are part of the "next big wave of opportunities," and that "work on a tablet is part of a deepening relationship between the largest U.S. wireless carrier  and Google."

    It isn't certain whether the tablets would be based on Google's ChromeOS MORE

    - May 11, 2010 5:40 PM ET
    Posted in: , , ,
Current Issue
  • Give the gift of Fortune
  • Get the Fortune app
  • Subscribe
Powered by VIP.