So Black Hat is over, CanSecWest is over. Hack in the Box is coming up but in the meanwhile let’s talk about PWN2OWN.

mac_hack_

Luckily, both prizes from the PWN2OWN contest went to the right people but I am more interested to know what was it that owned Vista. After all, Vista is meant to be more secure from scratch although we know that once you fix one type of vulnerability, another will emerge and become predominant. These are the rules of Nature. We better get used to them.

Considering the experience of the winners, I thought that the vulnerability was a standard overflow issue combined with luck and an ingenious way of bypassing Vista’s protection features. Then I’ve read this:

Macaulay, who was a co-winner of last year’s hacking contest, needed a few hacking tricks courtesy of VMware researcher Alexander Sotirov to make his bug work. That’s because Macaulay hadn’t been expecting to attack the Service Pack 1 version of Vista, which comes with additional security measures…

Under contest rules, Macaulay and Miller aren’t allowed to divulge specific details about their bugs until they are patched, but Macaulay said the flaw that he exploited was a cross-platform bug that took advantage of Java to circumvent Vista’s security.

The flaw is in something else, but the inherent nature of Java allowed us to get around the protections that Microsoft had in place, he (Macaulay) said in an interview shortly after he claimed his prize Friday. This could affect Linux or Mac OS X.

Macaulay said he chose to work on Vista because he had done contract work for Microsoft in the past and was more familiar with its products.

I assume that it has nothing to do with overflows since the attack vector is cross-platformed. Although, there is a slight chance that an overflow has been used because Alexander Sotirov teamed with the rest and the fact that Java disables DEP because of various complications within the JVM. My bet is on a cross-platform bug that relies on Java being stupid. It could have been a URL bug or any kind of Same Origin Policy bypass variation/violation or even Cross-origin Scripting, as we’ve seen a few of them already. I’ve touched Java’s SOP in by Black Hat talk and also showed some problems with it. There you go, might be a good starting point.

The $10,000 + Laptop question is whether the bug that has been used is unique by nature and whether others can re-do it. I can tell you for a fact that SOP and XOS bugs, which are far more common today then ever, are all over the place. Just in the past couple of months, we’ve personally released a bunch of them. I have been involved with some other researchers on various SOPs and XOSs which haven’t been disclosed yet. Unless the organizers of CanSecWest change the rules of the competition, I can grantee you that more and more and more winners will follow. And Just to spoil the fun we might even release one just before the next event. Why not!