At last HP’s Pwn2Own 2013 contest hacking teams from Japan and China compromised iPhone 5 running iOS 6 and iOS 7 and a Samsung Galaxy S4.
During the last HP’s Pwn2Own 2013 contest at Information Security Conference PacSec 2013 in Tokyo, two teams of Chinese and Japanese hackers demonstrated the exploitation of zero-day vulnerability in Apple’s Safari browser for the iPhone 5 running iOS 6 and iOS 7 and the Samsung Galaxy S4.
The Pwn2Own contest is organized is to attract hackers into legitimate circles trying to keep them out of the black market.
During the Pwn2Own 2013 contest the Japanese Team MBSD, of Mitsui Bussan Secure Directions, Inc. won $40,000 reward for zero day exploit demonstrating also several exploits against default applications on the Samsung Galaxy S4.
The zero-day allows the attacker to compromise the mobile device in several ways, for example using a drive-by download to install malware on the Smartphone.
“This team exploited multiple apps, installed by default on the Samsung Galaxy S4 to install malware and steal confidential data. In order for the exploit to be successful, the affected user must first be lured to an attacker-controlled malicious website. However, from there, no more user interaction is required and an attacker can install arbitrary applications of their choice with system-level privileges on the user’s device. In this case, the payload was the capture and exfiltration of sensitive data including the affected user’s contacts, bookmarks, browsing history, screen shots, SMS messages, etc.”
(Security Affairs – Pwn2Own 2013 Contest, hacking mobile)
