iPhone hacked at Pwn2Own contest

An iPhone got hacked in just 20 seconds at this week's Pwn2Own hacking contest at CanSecWest 2010, reports Ryan Naraine for ZDnet. Hackers Vincenzo Iozzo and Ralf Philipp Weinmann demoed an exploit that allowed them to send a target iPhone to a web site that they'd set up online, and then copied off the entire SMS database on the iPhone (including deleted text messages) to their own server. The browser crashed during the hijack, but the hackers say that with a little tweaking, it would even be possible to nab the information without the user ever knowing that an attack had occurred. Halvar Flake also assisted with the hack, and he said that while Apple does have some protection in place for running malicious code on the iPhone, but it's not enough: "The way they implement code-signing is too lenient." You can see more technical information about the hack over on his blog.

The hackers aren't sharing exactly how they did the exploit -- as specified by the contest rules, knowledge of the hack is becoming property of the contest's sponsor, the Tipping Point Zero Day Initiative, who will pass on a report to Apple and only release details once the hole has been fixed. Safari and Internet Explorer 8 both got owned at the same conference, though details about those hacks are both forthcoming -- Tipping Point was offering up US$100,000 in prizes for exploits on these various programs, and it looks like the prize money has been well-earned.
Share