Pwn2Own is a famous contest held in CansecWest Conference. Every year there is a big reward for researchers who finds exploitable bugs in popular browser and OS and also in mobile devices like iPhone. For the past two years the Pwn2Own contest champion was Charlie Miller (0xcharlie on Twitter), one of the most famous bug hunter and security expert in the world.

Pwn2Own 2010 will will be held over the course of three days starting on March 24th, so, we decided to interview Charlie Miller (italian version here) and here are his anwers:

You won, for two years, Pwn2Own contest hacking Safari on Mac OS X. Will Safari and Mac be your targets for the Pwn2Own 2010 contest as well?

Everything is my target at this point. I’d love to hack one of the mobile devices, but will probably end up on Safari again. I was the first to hack the iPhone and an Android device in the past, so I am comfortable with those two platforms, but its harder to exploit them. This year only one person can win per target, so my biggest obstacle will be making sure nobody beats me to the punch.

Windows 7 or Snow Leopard, which of these two commercial OS will be harder to hack and why?

Windows 7 is slightly more difficult because it has full ASLR (address space layout randomization) and a smaller attack surface (for example, no Java or Flash by default). Windows used to be much harder because it had full ASLR and DEP (data execution prevention). But recently, a talk at Black Hat DC showed how to get around these protections in a browser in Windows.

Continua »

In recent days, after an article on The Register, there was a lot of buzz regarding a vulnerability that affects Mac OS X. The author of the discovery is an italian security researcher, Vincenzo Iozzo, that we decided to interview (italian version available) to obtain some more details.

At the next Black Hat Conference in February you will hold a talk entitled “Let Your Mach-O Fly“, which will explain a serious vulnerability in Mac OS X. Can you tell something more?

My attack is an implementation of a technique called userland-exec. This technique makes it possible to launch an executable on a machine without invoking the kernel and that it is present on your disk. But it can not be considered a vulnerability in the usual sense. In fact, the attack is made possible in practice because of an inherent problem of Mac OS X has long known, namely the lack of randomization dynamic linker within space processes.

It should be noted that my technique does not allow to break into a machine more easily, but makes it easier the execution of code within the system attacked. The innovation of my research is the fact you can inject into a process not just a simple shellcode but an entire executable, in the past this was not possible on OS X.

Continua »