Incident: Successful Hacks Demonstrated at Pwn2Own Contest at CanSecWest

Published Date: 2010-03-24

Postmortem Analysis
Timeline 1. The software failure incident happened in March 2010. [Article 1030]
System 1. Safari on MacBook Pro 2. Internet Explorer 8 3. Firefox on Windows 7 4. iPhone
Responsible Organization 1. Charlie Miller, principal security analyst at Independent Security Evaluators, responsible for hacking Safari on a MacBook Pro without physical access [1030]. 2. Peter Vreugdenhil, an independent security researcher from the Netherlands, responsible for exploiting vulnerabilities in IE 8 [1030]. 3. Nils, head of research at UK-based MWR InfoSecurity, responsible for targeting Firefox on 64-bit Windows 7 [1030]. 4. Ralf Philipp Weinmann, of the University of Luxembourg, and Vincenzo Iozzo, of German company Zynamics, responsible for hacking the iPhone [1030].
Impacted Organization 1. Safari on a MacBook Pro 2. Internet Explorer 8 3. Firefox on Windows 7 4. iPhone 5. SMS database on an iPhone [Cited from Article 1030]
Software Causes 1. Exploiting vulnerabilities in Safari, Internet Explorer 8, and Firefox on various operating systems such as Windows 7 and Snow Leopard [1030]. 2. Memory corruption vulnerability in Firefox on 64-bit Windows 7 [1030]. 3. Bypassing Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) in the attacks on Internet Explorer 8 and Firefox [1030]. 4. Bypassing digital code signatures on the iPhone to verify code authenticity [1030].
Non-software Causes 1. The failure incident was caused by researchers successfully hacking various software systems and devices during the Pwn2Own contest at the CanSecWest security show [1030].
Impacts 1. The impacts of the software failure incident included successful hacks on various platforms such as Safari on a MacBook Pro, Internet Explorer 8, Firefox on Windows 7, and non-jailbroken iPhones, leading to the compromise of targeted systems and the demonstration of running arbitrary commands on the compromised machines [1030]. 2. The exploit on the iPhone allowed the theft of SMS data from the device, showcasing the vulnerability of the iPhone to such attacks and the potential risk of unauthorized access to sensitive information stored on the device [1030].
Preventions 1. Regular security updates and patches for Safari, Internet Explorer, Firefox, and iPhone operating systems could have prevented the software failure incident by addressing known vulnerabilities [1030]. 2. Implementing stronger security features such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) in browsers like IE 8 could have made it more difficult for attackers to exploit vulnerabilities [1030]. 3. Conducting thorough security testing and code reviews during the development process to identify and fix potential weaknesses before they can be exploited by hackers [1030].
Fixes 1. Patching the vulnerabilities exploited by the hackers in Safari, Internet Explorer 8, and Firefox on Windows 7 [1030]. 2. Addressing the memory corruption vulnerability and weaknesses in Mozilla's implementation in Firefox [1030]. 3. Investigating and fixing the vulnerabilities that allowed the hackers to bypass ASLR and DEP in Internet Explorer 8 [1030]. 4. Implementing measures to prevent code signing bypasses on devices like the iPhone to enhance security [1030].
References 1. Charlie Miller, principal security analyst at Independent Security Evaluators [Article 1030] 2. Peter Vreugdenhil, an independent security researcher from the Netherlands [Article 1030] 3. Nils, head of research at UK-based MWR InfoSecurity [Article 1030] 4. Ralf Philipp Weinmann, of the University of Luxembourg [Article 1030] 5. Vincenzo Iozzo, of German company Zynamics [Article 1030] 6. TippingPoint's Zero Day Initiative [Article 1030]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - Charlie Miller, a security analyst, won prizes in multiple years at the Pwn2Own contest by exploiting vulnerabilities in Safari on Apple devices. He won $10,000 by hacking Safari on a MacBook Pro without physical access to the machine [1030]. - Nils, a researcher from MWR InfoSecurity, won $10,000 for targeting Firefox on Windows 7 at the Pwn2Own contest. He had previously won $15,000 for exploits demonstrated in IE 8, Safari, and Firefox [1030]. (b) The software failure incident having happened again at multiple_organization: - The Pwn2Own contest at CanSecWest security show featured researchers hacking various software including Safari, Internet Explorer, and Firefox, indicating vulnerabilities in multiple organizations' products [1030].
Phase (Design/Operation) design, operation (a) The software failure incident related to the development phase of design can be seen in the articles. The incident involved researchers demonstrating successful hacks on various browsers and devices during the Pwn2Own contest at the CanSecWest security show. Charlie Miller hacked Safari on a MacBook Pro without physical access to the machine by exploiting a hole in Safari [1030]. Peter Vreugdenhil bypassed security features in IE 8 by exploiting vulnerabilities in a four-part attack that involved bypassing ASLR and evading DEP [1030]. Nils targeted Firefox on 64-bit Windows 7 by exploiting a memory corruption vulnerability and bypassing ASLR and DEP due to a weakness in Mozilla's implementation [1030]. (b) The software failure incident related to the development phase of operation can be observed in the articles as well. The system compromises occurred when the browsers visited a website hosting the attack code, leading to the successful hacks. For example, Charlie Miller compromised the target computer after visiting a website hosting malicious code, gaining an interactive shell on the machine [1030]. Similarly, Vreugdenhil compromised the system when the browser visited a website hosting the attack code, giving him user rights on the targeted computer [1030]. Nils also exploited the system by visiting a website hosting the exploit code, allowing him to run the Windows calculator for the demo [1030].
Boundary (Internal/External) within_system (a) within_system: - The software failure incidents reported in the articles were primarily due to vulnerabilities and exploits within the systems themselves. For example, researchers were able to hack into various systems like Safari, Internet Explorer, Firefox, and iPhone by exploiting vulnerabilities within these systems [1030]. - The exploits involved bypassing security features like ASLR (Address Space Layout Randomization) and DEP (Data Execution Prevention) within the browsers to compromise the systems when visiting malicious websites [1030]. - The researchers demonstrated their ability to run arbitrary commands on the compromised systems, showcasing the extent of the vulnerabilities within the software [1030].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incidents in the articles were primarily due to vulnerabilities and weaknesses in the software systems themselves, such as memory corruption vulnerabilities, bypassing ASLR and DEP (Address Space Layout Randomization and Data Execution Prevention), and exploiting digital code signatures on the iPhone [1030]. (b) The software failure incident occurring due to human actions: - The software failure incidents in the articles were also influenced by human actions, such as researchers actively exploiting the vulnerabilities in the software systems during the Pwn2Own contest at the CanSecWest security show [1030].
Dimension (Hardware/Software) software (a) The software failure incident occurring due to hardware: - The software failure incidents reported in the articles were not attributed to hardware issues but rather to vulnerabilities and exploits in software applications such as Safari, Internet Explorer, Firefox, and the iPhone operating system [1030]. (b) The software failure incident occurring due to software: - The software failure incidents reported in the articles were primarily due to vulnerabilities and exploits in software applications like Safari, Internet Explorer, Firefox, and the iPhone operating system. These incidents involved hackers exploiting weaknesses in the software to gain unauthorized access and control over the targeted systems [1030].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in the articles is malicious in nature. The incident involved researchers demonstrating their ability to hack various systems and browsers, such as Safari, Internet Explorer, Firefox, and the iPhone, during the Pwn2Own contest at the CanSecWest security show. The hacks were conducted by exploiting vulnerabilities in the systems and browsers, with the objective of demonstrating the ability to compromise the targeted devices and systems. The researchers were awarded prizes for successfully bypassing security features and gaining unauthorized access to the systems and browsers [1030].
Intent (Poor/Accidental Decisions) unknown (a) The intent of the software failure incident related to poor_decisions: - The software failure incidents described in the articles were not due to poor decisions but rather intentional actions by researchers participating in the Pwn2Own contest to demonstrate vulnerabilities in various software systems like Safari, Internet Explorer, and Firefox [1030].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident occurring due to development incompetence: - The incident at the Pwn2Own contest showcased various successful hacks on different browsers and devices, highlighting vulnerabilities in Safari, Internet Explorer, and Firefox [1030]. - Researchers demonstrated their ability to exploit vulnerabilities in these software systems, indicating potential weaknesses in their development and security measures. - The successful hacks on Safari, Internet Explorer, and Firefox suggest that there were gaps in the development and testing processes of these software products, leading to the exploitation of security flaws by the researchers. (b) The software failure incident occurring accidentally: - The hacks demonstrated at the Pwn2Own contest were not accidental but rather intentional efforts by security researchers to exploit known vulnerabilities in the targeted software systems [1030]. - The researchers actively developed exploits to bypass security features and gain unauthorized access to the target systems, indicating a deliberate and planned approach rather than accidental actions. - The targeted attacks on Safari, Internet Explorer, and Firefox were purposeful and aimed at showcasing the vulnerabilities present in these software products, rather than being accidental incidents.
Duration temporary (a) The software failure incident described in the articles is temporary. The incident involved successful hacks on various software systems such as Safari, Internet Explorer, Firefox, and the iPhone during the Pwn2Own contest at the CanSecWest security show. The hacks were achieved by exploiting vulnerabilities in the systems when visiting specific websites hosting malicious code. The researchers were able to gain control over the targeted systems, demonstrating the vulnerabilities present in the software. The incident was temporary as it was caused by specific circumstances and vulnerabilities that were exploited during the contest ([1030]).
Behaviour crash (a) crash: The software failure incident related to a crash can be seen in the article where researchers demonstrated successful hacks on various browsers and devices during the Pwn2Own contest. For example, Charlie Miller was able to hack Safari on a MacBook Pro without physical access to the machine, gaining an interactive shell on the target computer [1030]. (b) omission: The software failure incident related to omission can be observed in the article where researchers exploited vulnerabilities in browsers like IE 8 and Firefox by bypassing security features and executing malicious code when the browser visited specific websites. This led to the system omitting to perform its intended functions securely [1030]. (c) timing: The software failure incident related to timing can be inferred from the article where the researchers were able to perform successful hacks during the Pwn2Own contest. The timing aspect comes into play as the system performed its intended functions (browsing the web) but at the wrong time, leading to security breaches and exploitation [1030]. (d) value: The software failure incident related to value can be identified in the article where the researchers exploited vulnerabilities in browsers like Firefox on Windows 7. Nils, a researcher, exploited a memory corruption vulnerability in Firefox, leading to the system performing its intended functions incorrectly and allowing the execution of arbitrary code [1030]. (e) byzantine: The software failure incident related to a byzantine behavior can be seen in the article where researchers hacked the iPhone by writing an exploit to steal the contents of the SMS database. The exploit bypassed digital code signatures and pieced together chunks of Apple's code to accomplish the attack, showing inconsistent responses and interactions with the iPhone's security mechanisms [1030]. (f) other: The software failure incident related to other behaviors includes the researchers' ability to bypass security features like ASLR and DEP in browsers such as IE 8 and Firefox. This behavior can be categorized as a sophisticated exploitation technique that goes beyond the typical crash, omission, timing, value, or byzantine failures [1030].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence theoretical_consequence, unknown (a) unknown (b) unknown (c) unknown (d) unknown (e) unknown (f) unknown (g) no_consequence (h) theoretical_consequence: The articles discuss potential consequences of the software failure incidents, such as the ability of the researchers to bypass security features in browsers like IE 8 and Firefox, as well as the potential for attacks on iPhones to access sensitive data like SMS messages, contacts, and photos. However, there is no specific mention of real observed consequences like death, harm, basic needs being impacted, or property loss [1030]. (i) unknown
Domain information, government (a) The failed system was related to the information industry as it involved hacking attempts on web browsers like Safari, Internet Explorer, and Firefox, as well as the iPhone to steal data and compromise systems [1030]. (b) There is no specific mention of the transportation industry in the articles. (c) There is no specific mention of the natural resources industry in the articles. (d) There is no specific mention of the sales industry in the articles. (e) There is no specific mention of the construction industry in the articles. (f) There is no specific mention of the manufacturing industry in the articles. (g) There is no specific mention of the utilities industry in the articles. (h) There is no specific mention of the finance industry in the articles. (i) There is no specific mention of the knowledge industry in the articles. (j) There is no specific mention of the health industry in the articles. (k) There is no specific mention of the entertainment industry in the articles. (l) The failed system was not directly related to the government industry, but it involved security vulnerabilities in popular web browsers and devices like the iPhone, which could have implications for government systems and data security [1030]. (m) The failed system was not related to an industry outside of the options provided.

Sources

Back to List