Hacks at Pwn2Own Vancouver 2023

An impressive array of hacks were demonstrated at the first day of the Pwn2Own conference in Vancouver:

On the first day of Pwn2Own Vancouver 2023, security researchers successfully demoed Tesla Model 3, Windows 11, and macOS zero-day exploits and exploit chains to win $375,000 and a Tesla Model 3.

The first to fall was Adobe Reader in the enterprise applications category after Haboob SA’s Abdul Aziz Hariri (@abdhariri) used an exploit chain targeting a 6-bug logic chain abusing multiple failed patches which escaped the sandbox and bypassed a banned API list on macOS to earn $50,000.

The STAR Labs team (@starlabs_sg) demoed a zero-day exploit chain targeting Microsoft’s SharePoint team collaboration platform that brought them a $100,000 reward and successfully hacked Ubuntu Desktop with a previously known exploit for $15,000.

Synacktiv (@Synacktiv) took home $100,000 and a Tesla Model 3 after successfully executing a TOCTOU (time-of-check to time-of-use) attack against the Tesla-Gateway in the Automotive category. They also used a TOCTOU zero-day vulnerability to escalate privileges on Apple macOS and earned $40,000.

Oracle VirtualBox was hacked using an OOB Read and a stacked-based buffer overflow exploit chain (worth $40,000) by Qrious Security’s Bien Pham (@bienpnn).

Last but not least, Marcin Wiązowski elevated privileges on Windows 11 using an improper input validation zero-day that came with a $30,000 prize.

The con’s second and third days were equally impressive.

Tags: Adobe, cars, hacking, Windows, zero-day

Posted on March 27, 2023 at 7:03 AM • 12 Comments

Comments

modem phonemes • March 27, 2023 9:11 AM

How instructive these tour-de-force are ! They inspire hope that security engineering principles may one day be really used routinely in software and hardware design.

Plumbing the big tinkertoy box and seeing around the corner next after this.

Clive Robinson • March 27, 2023 12:51 PM

@ Bruce,

“The con’s second and third days were equally impressive.”

Which raises all sorts of questions…

Firstly the “reward” for these financially are very low compared to what we know can be obtained from spurces that do not have public disclosure.

Which begs the question,

“Are there more impressive attacks out there, being ‘locked and loaded’ if not launched at those considered ‘inconvenient people’?”

But it also raises, along with the rapidly rising CVE count,

“Just how bad is the ICT Industry?”

Followed by,

“Why is it this bad?”

And I don’t mean just on the technical level…

We all have a part to play in what could best be described as the “ICTsec Disaster” especially as we know much if not most of it can be avoided, by relatively simple measures.

Developing high quality code is not just possible, surprisingly to many it is not done by some impossibly difficult methods.

Which begs the question,

“Why some half century or more since the fundementals of these attacks were found and starkly described are they still happening?”

Take that “Time-Of-Check to Time-Of-Use”(TOCTOU)[1] attack. Despite the fancy name it’s been widely known with file systems for a third of q century.

But it is more general. As I explained with a way to get code siging to fail, all you need to find is,

1, A serial process where,
2, Authentication is done before the transaction.

With the solution being “make authentication and transaction atomic throughout the transaction”.

But as always, but still rarely done properly, handle “errors and exceptions” where they need to be handled. Not push them as far to the left as you can effectively outside the business logic where they are actually needed when dealing with an “active adversary”.

If the system environment you have to work in does not support atomic operations of the form you need. Then have a look at how “multiple phase commits”[2] on databases or “eXtended Architecture”(XA) Protocol works on transactions[3]. As they should tell you how to “shrink the hole” (though actually closing it may need a few other skills not so well known).

[1] https://en.m.wikipedia.org/wiki/Time-of-check_to_time-of-use

[2] See Jim Gray’s book,

“Transaction Processing : Concepts and Techniques”

ISBN:1558601902

Published in 1992 by Morgan Kaufmann as part of their “Series in Data Management Systems”.

Or similar work that deecribes “the reasoning” for the method, rather than just the method.

[3] The “eXtended Architecture”(XA) Protocol is an extention to “Two Phase Commit”(2PC) and is used not just for replicated databases but distributed transaction systems. You can get an indicator “overview” of method from,

https://blog.sofwancoder.com/two-phased-commit-and-extended-architecture-the-basics

Confused • March 27, 2023 1:45 PM

Is this conference special? There are lots of conferences where zero days are presented (after responsible disclosure), is this one different?

Less confused • March 28, 2023 6:04 AM

@Confused

It’s not normal conference, it’s a hacking contest.

Gert-Jan • March 28, 2023 7:05 AM

Very good that these events are held. It offers white hat hackers (“security researchers”) legit payment for successful work. The argument that they could get more money by selling them to “security companies” is only relevant to hackers with a corrupt moral compass.

And because of the mandatory fix without 90 days, any exploitable vulnerability they find will soon get removed from the toolbox of all the evil regimes and cybercriminals.
We’ll have to accept that there is increased risk of abuse after the demonstration, before a patch is available.

It might be worthwhile for governments to sponsor such events (if they aren’t doing that already). E.g. by doubling the prize money, or making it as easy as possible to compete in such competition.

Clive Robinson • March 28, 2023 10:18 AM

@ Gert-Jan,

Re : Morals are what you have inflicted on you…

“The argument that they could get more money by selling them to “security companies” is only relevant to hackers with a corrupt moral compass.”

Err no, the hackers do not “create the market” others do that.

Without the market which ultimately are run for “governments” as they are the ones that actually fund the markets, then we would not be talking about this.

The moral compass is thus that of despots, dictators, tyrants, Presidents, Prime Ministers and all other “Heads of State” and their alleged underlings in government.

It is they that create the demand, and if the money is right irrespective of morals then the work will done to supply that need. As basic neo-con market ethics say “supply gives rise to demand” (where it’s actually the other way around). Because at the end of the day those you say have “corrupt moral compases” actually have to put food on the table, a roof over their head, and in some cases pay outrageous fees for their childrens education, their health care, pension etc…

And those Despots, Dictators, Tyrants know this, so with near unlimited funding will pay what it takes, to get what they want.

I’ve previously mentioned the economics behind why a lot of people who forfill these market demands appear to come from places like Argentina and other South American countries, and the reason again is Governments treating individuals way worse than they do corporates…

So if you want to stop such markets, you’ve a lot of work on your plate, and way way to many people in power will happily arrange it so you don’t upset their cosy little arrangments…

Clive Robinson • March 28, 2023 12:16 PM

@ ALL,

Anyone else notice that most of the exploits on the leader board were “Use After Free”(UAF) or similar malloc()/free() misuse?

I suspect if looked at with a critical eye, in nearly all cases the use of malloc()/free() or equivalent was actually not required, so could have been fairly easily avoided as security flaws, with a little more thought…

bobthebuilder • March 28, 2023 7:35 PM

@Gert-Jan
I don’t find moralizing to be a particularly fruitful endeavor, circumstance is a far better predictor of real world behavior than any sort of morals.
You just don’t have the luxury of right and wrong when you’re doing what’s necessary. For you hacking might just be an intellectual pursuit but for others it’s do or die, put food on the table or starve. Choices like this focus the mind far better than a simplistic white-hat / black-hat world view.

Roy Rush • March 28, 2023 7:48 PM

@ Clive Robinson,

in nearly all cases the use of malloc()/free() or equivalent was actually not required, so could have been fairly easily avoided as security flaws, with a little more thought…

Doesn’t “could have been fairly easily avoided … with a little more thought” describe almost every flaw found in the history of computer security? Thoughts like “can the data change between these two points?”, “what if the buffer’s not big enough to hold it?”, “what if someone types an apostrophe?”, or “is it practical to avoid ever reusing memory addresses in my program?”

Attacks seem to require more and more effort as time goes on, but I’m not seeing many that require much more cleverness. I thought Sudhakar and Appel attacking Java with a 50-watt lamp was clever. Spectre and Meltdown might have been, but then again, I recall seeing some reference to a decades-old CPU paper saying something like “of course one must be careful when speculating across security domains”, which means it’s also something anyone could’ve stumbled upon by chance. This, though, is just work: disassemble the code if it’s not open; look for the same old flaws we’ve known since forever; then get the exploit past the multitude of half-assed mitigations such as randomisation.

Why has nobody at Microsoft gone through every instance in which user input is processed, and proven that the handling is well-defined over the entire input space? That seems like a no-brainer, right? How about using ChatGPT or whatever’s trendy to look over the MSDN forums and the entire Bing and Github datasets, to find instances of people using or suggesting non-atomic operations when atomic ones exist or ought to exist? Well, “nobody” has stopped using their products because of this stuff, “nobody” is really doing it better, and I guess it’s just cheaper to pay out the occasional $30,000 bounty.

Gert-Jan • March 29, 2023 10:02 AM

if the money is right irrespective of morals then the work will done to supply that need

Looks like I struck a nerve.

When you sell an exploit to a security company, you know that it will be used to subvert security, not increase it. If the security company is a front for your favorite government, then I can imagine that you are perfectly happy with your dealings. Of course there are other security companies too…

Contrary to selling to the market, these competitions result in better defense.

I don’t find moralizing to be a particularly fruitful endeavor, circumstance is a far better predictor of real world behavior than any sort of morals.

If you are offended by my opinion, so be it.

Talking about circumstances, competitions like this increase the ability for people to make money in security research, while at the same time improving security. That’s why I am a proponent of them.

h a v o c • March 29, 2023 1:46 PM

@confused

hitf r u on this page and not know what pwn2own is?!?!? honest question and not an attack on your intelligene or skills

Name • April 3, 2023 8:22 AM

@Gert-Jan

‘…while at the same time improving security.’

Do you really believe that at the current rate of sh*t hitting the fan these once a year competitions even put a dent in the cesspool?

Hacks at Pwn2Own Vancouver 2023

Comments

Leave a comment Cancel reply