Safari, Virtualbox, VMware Get Hacked During First Day of Pwn2Own 2019

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/safari-virtualbox-vmware-get-hacked-during-first-day-of-pwn2own-2019/

During the first day of Pwn2Own Vancouver 2019, contestants were able to successfully hack into the Apple Safari web browser, Oracle's VirtualBox, and VMware Workstation, earning a total of $240,000 in cash awards.

The Fluoroacetate team targeted all three apps during the first day of Pwn2Own, successfully exploiting all of them and making $160,00 in the process.
First to go down was Apple's Safari which they managed to hack using a bug in JIT with a heap overflow to escape the sandbox according to the Pwn2Own Vancouver 2019 results.

Next, they used "an integer underflow and a race condition to escape the virtual machine and pop calc on the underlying OS" when targeting Oracle VirtualBox, in the contest's virtualization category.

The last program they exploited was VMware Workstation, the one who also brought them a $70,000 award after "leveraging a race condition leading to an out-of-bounds write in the VMware client to execute their code on the host OS."

 

[ForgottenSeer 69673]

who uses these vm's besides geeks? does the gov, big business or the military use them?

 

[bribon77]

who uses these vm's besides geeks? does the gov, big business or the military use them?

And in Malware Hub, they also use those programs

 

[Dave Russo]

Ok ,no one is safe, paranoia seems to be the result of reading this report,never the less ,there was some big cash involved,so I guess,there is a effort of these test, to improve there security,when loopholes are found??? Anyone know Thanks

 

[Kubla]

who uses these vm's besides geeks? does the gov, big business or the military use them?

A lot of people use VirtualBox to run Whonix in order to have a Linux based OS accessible from Windows 10 that is supposed to be very secure.

 

[bribon77]

Ok ,no one is safe, paranoia seems to be the result of reading this report,never the less ,there was some big cash involved,so I guess,there is a effort of these test, to improve there security,when loopholes are found??? Anyone know Thanks

Well said, now the developers of these programs take action as a result of this test and improve their programs.

 

[LDogg]

With these reports, paranoia would be the worst emotion to have. Least the bug bounty programs work, these guys probably get a decent living.

~LDogg