SoylentNews

All Four Major Browsers Take a Stomping at Pwn2Own Hacking Competition

posted by janrinok on Saturday March 21 2015, @11:02PM   
from the lynx-FTW dept.

AnonTechie writes:

The annual Pwn2Own hacking competition wrapped up its 2015 event in Vancouver with another banner year, paying $442,000 for 21 critical bugs in all four major browsers, as well as Windows, Adobe Flash, and Adobe Reader.

The crowning achievement came Thursday as contestant Jung Hoon Lee, aka lokihardt, demonstrated an exploit that felled both the stable and beta versions of Chrome, the Google-developed browser that's famously hard to compromise. His hack started with a buffer overflow race condition in Chrome. To allow that attack to break past anti-exploit mechanisms such as the sandbox and address space layout randomization, it also targeted an information leak and a race condition in two Windows kernel drivers, an impressive feat that allowed the exploit to achieve full System access.

[Related]: http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2015-Day-Two-results/ba-p/6722884#.VQwyVuF7S_Y

• Re:Javascript Re:Javascript (Score: 1, Insightful) by Anonymous Coward on Sunday March 22 2015, @06:24AM

  by Anonymous Coward on Sunday March 22 2015, @06:24AM (#161007)

  It's also harder to steal your car if you take off one of the wheels.

  Parent

  Starting Score:	0		points
  Moderation		+1
  Insightful=1, Total=1
  Extra 'Insightful' Modifier		0
  Total Score:		1

• Re:Javascript (Score: -1, Redundant) by Anonymous Coward on Sunday March 22 2015, @09:58AM

  by Anonymous Coward on Sunday March 22 2015, @09:58AM (#161037)

  Or if you pull the fuses when you park... something I used to do in my student days.

  I also disable JavaScript and consider sites that require it broken.

  Parent