At this year’s hacking competition Pwn2Own, interesting and previously unseen vulnerabilities of various web browsers were showcased. A reward of 15 thousand US dollars is given to anyone who manages to compromise a web browser or handheld device.
Hackers demonstrated how it is possible to bypass the security measures that large companies have developed over the years. This includes DEP (Data Execution Prevention) used by Microsoft, ASLR (Address Space Layout Randomization) which is also used by *NIX operating systems, and Apple’s code signing. These measures were bypassed in interesting ways, with Halvar Flake circumventing Apple’s protection by reorganizing the executable code of a legitimate program to achieve a malicious result. Peter Vreugdenhil bypassed Microsoft’s protection measures in IE8 by exploiting an information leakage vulnerability, successfully revealing the memory locations of the modules he attacked. This competition is particularly interesting as it reveals weaknesses in programs that are rarely targeted by hackers. (www.cert.hr)
