Hacked in 18 seconds: PwnFest exploited Microsoft Edge to execute malicious code

On Thursday during the PwnFest 2016 event within Seoul’s Power of Community security conference, a team from vulnerability firm Qihoo 360 and South Korean security researcher JungHoon “Lokihardt” Lee demonstrated two different hacks that took advantage of vulnerabilities within Microsoft Edge, completing one in a mere 18 seconds. The internet browser was running on a 64-bit version of Windows 10 Anniversary Edition (aka Redstone 1) and enabled these teams to remotely execute code at the system level.

PwnFest is a “festival” that encourages hackers and security firms to target specific platforms as a means of demonstrating how vulnerabilities they find can be used in the wild. Participants receive a cash prize while platform developers receive information about vulnerabilities and how they are exploited. In the end, participants and general consumers are the two big winners stemming from the event.

That said, here are the targets and their cash rewards:

As for the participating teams, there appear to be six. Here they are with their targets:

On the Microsoft Edge front, vulnerabilities discovered in the Windows 10 browser enabled system-level remote code execution. To better understand system-level access, you have to look at how device operating systems are layered in a security sense. At the top layer, consumers will see the applications they normally use. Under that are device drivers with low privileges followed by device drivers with high privileges further underneath. The final bottom layer consists of the operating system’s central core, aka the kernel, that controls everything. Running a malicious program below the “user” layer grants a hacker special privileges that can go undetected by the device owner.

According to The Register, Lokihardt managed to successfully exploit Microsoft Edge’s security hole(s) in 18 seconds, whereas the length of time it took Qihoo 360’s team to hack Microsoft Edge was not provided. In fact, the Qihoo 360 team reportedly worked on developing its trio of attacks for a period of six months prior to this week’s event.

However, despite all that preparation, the Qihoo 360 team was forced to rework their Edge browser attack within a span of 30 hours. That is because Microsoft plugged three of the four available vulnerabilities in a patch on Tuesday released prior to this week’s hacking event.

Microsoft’s Edge browser was not the only piece of software to be exploited. Qihoo 360, a security firm located in China, pocketed $520,000 in total for their efforts, including exploiting Flash in four seconds to win $120,000. It also used an undisclosed vulnerability to hack the Google Pixel to allow remote code execution, which won them another $120,000. The following video shows the Pixel exploit as it happened.

Other exploits included the use of a root privilege escalation bug to win $80,000 for hacking Apple’s Safari browser. Edge was broken for prize money totaling $140,000. The prize money is sponsored by many of the same companies that publish software that is commonly the target of an attack and it is money well-spent — the companies can use the results of events like PwnFest to close security holes and avoid much more costly exploits down the road.

The details surrounding vulnerabilities exploited during PwnFest won’t be released to the public right away, but rather provided directly to the vendors so they can issue an immediate fix.

Updated on 11-14-2016 by Mark Coppock: Added information on further exploits achieved during PwnFest 2016.