Internet Explorer 9 was the second browser to succumb to white-hat hackers during the Pwn2Own contest at the CanSecWest security conference in Vancouver.
A team of vulnerability researchers from French security firm VUPEN Security exploited a pair of previously unknown vulnerabilities in the latest version of Microsoft's browser on Thursday.
The attack was demonstrated on a fully patched 64-bit Windows 7 with Service Pack 1 system and earned the VUPEN team 32 points in the annual Pwn2Own competition sponsored by TippingPoint's Zero Day Initiative (ZDI) program.
The rules have changed for this year's Pwn2Own contest, its focus shifting from who can hack a browser faster, as it was in previous editions, to who can write the highest number of reliable exploits. Researchers earn 32 points for exploiting previously unknown browser vulnerabilities, also known as zero-days, and 10 points for exploiting patched vulnerabilities selected by the organizers.
VUPEN is currently in the lead with 124 points, 64 of which were earned for a zero-day exploit against Google Chrome on Wednesday and a similar one against Internet Explorer 9 on Thursday. The team claims to have similar exploits for Apple's Safari and Mozilla Firefox.
VUPEN's Internet Explorer 9 exploit leveraged two vulnerabilities -- a remote code execution (RCE) that bypassed the browser's anti-exploitation mechanisms like DEP (Data Execution Prevention) or ASLR (address space layout randomization) and one that bypassed its post-exploitation defense, commonly known as the sandbox, or Protected Mode in Internet Explorer's case.
The Internet Explorer 9 Protected Mode limits what attackers can do on the OS once they exploit a RCE vulnerability inside the browser. However, according to security researchers, IE's Protected Mode is less restrictive than Google Chrome's sandbox. This is expected to improve with Internet Explorer 10 on Windows 8.
Read more : http://www.pcworld.com/article/251572/researchers_hack_ie9_during_second_day_at_pwn2own.html
