News

Pwn2Own VMware Escape Earns $105,000 Prize

Annual hacking contest Pwn2Own gave us – and its victors – a real treat this year; a renowned team of hackers were able to compromise Microsoft’s Edge browser in such a way that it allowed them to escape the virtual machine they were walled within and access the host computer. The feat earned Qihoo 360 – a Chinese hacker collective that was recently responsible for hacking Google’s new Pixel phone in under sixty seconds – a $105,000 prize.

“We used a JavaScript engine bug within Microsoft Edge to achieve the code execution inside the Edge sandbox, and we used a Windows 10 kernel bug to escape from it and fully compromise the guest machine,” Zheng Zheng, Executive Director of Qihoo 360, told Ars Technica. “Then we exploited a hardware simulation bug within VMware to escape from the guest operating system to the host one. All started from and only by a controlled a website.”

A virtual machine – like, in this case, VMware – is designed to contain any piece of software run within it, preventing it from coming into contact with the host system, and is used for this purpose by security researchers to examine potentially malicious content. Qihoo 360’s achievement could potentially render this vital security measure utterly redundant.

“A virtual machine hypervisor is just another software-based isolation layer that can have vulnerabilities in it that permit attacks to break through,” Dino Dai Zovi, co-founder and CTO of security outfit Capsule8 and Pwn2Win winner himself a decade ago, said. “Isolation layers such as sandboxes, virtualization, and containerization all add more work for an attacker, but none are perfect. Defenders should always assume that they can be broken through with enough work by an attacker.”

Ashley Allen

Disqus Comments Loading...

Recent Posts

Twitch Now Banning All Content Focusing On Intimate Body Parts

As by now, I'm sure you are aware Twitch has decided to go ahead and…

15 hours ago

Seconds Patch of “Operation Medic Bag” For Payday 3 Released

I doubt many of you have been keeping up with Payday 3 which is understandable…

16 hours ago

MSI Announces SPATIUM M580 FROZR With A Huge Cooler

Today MSI has announced a new Gen 5 SSD, the SPATIUM M580 FROZR which comes…

16 hours ago

LENRUE PC Speakers, USB/USB-C Powered Computer Speakers with Loud Stereo Sound

Stereo and Noiseless - Without any noise! After multiple debugging, suppress static. Become clearer and…

17 hours ago

HP M27f Ultraslim Monitor 27 Inch

PICTURE-PERFECT IMMERSION – Work or play on a monitor that redefines high definition with its…

17 hours ago

Govee LED Light Bars, Smart WiFi RGBIC TV Backlight

Syncs With Your Music: With an internal high-sensitivity mic, Govee Flow Plus LED light bars…

17 hours ago