Welcome back to Mobile Pwn2Own 2016, from the PacSecWest security conference in Tokyo, Japan! This year’s contest featured two competitor teams; Tencent Keen Security Lab and MWR Labs. Ultimately, Keen swept the contest and became “Master of Pwn” achieving two fully operational exploits and one partial exploit against Android and IOS.
DVLabs was onsite with ZDI again and spent quality time with the researchers discussing methods of exploitation, reviewing the multiple vulnerabilities, and ultimately writing detection logic for the Digital Vaccine filters which will be published in the upcoming DV package.
The following vulnerabilities will be addressed:
Google Chrome installing a rogue application as demonstrated on the Nexus 6p (ZDI-CAN-4179, ZDI-CAN-4180) Keen
Apple Safari installing a rogue application as demonstrated on the iPhone 6 (ZDI-CAN-4182) Keen
Google Chrome installing a rogue application as demonstrated on the Nexus 6p (ZDI-CAN-4185) MWR
Apple Safari information disclosure to leak photos as demonstrated on the iPhone 6 (ZDI-CAN-4187) Keen
Trend Micro TippingPoint is the sole vendor providing filter coverage for these zero-day vulnerabilities, allowing customers to apply “virtual patches” until the software vendors release true software patches.
For more details on the contest itself, please refer to the Trend Micro ZDI blog.
