Skip to main content

Hackers take over Touch Bar at this year’s Pwn2Own contest

A pair of hackers at this year’s Pwn2Own hacking contest have managed to infiltrate a MacBook Pro’s Touch Bar with a message of their own, after finding an exploit for the Safari browser. Although only considered a partial success, the hack did let them gain access to the Touch Bar, earning them $28,000 for their trouble.

The Pwn2Own security conference and competition sees many impressive exploits discovered every year and 2017 is no different. We’ve seen a number of successes (via MacRumors) that have cracked open the Linux Kernel, Adobe Reader, and Microsoft’s Edge browser. A few hacks managed to breach Apple security, too, which is what let one team post their message to the Touch Bar.

Welcome to Pwn2Own 2017

Samuel Groß and Niklas Baumstark used a number of logic bugs to exploit the Safari browser and eventually take root control of the MacOS on a MacBook Pro. While that itself granted them their monetary prize and nine points in the Pwn2Own competition, they impressed onlookers even more by adding a custom message to the Touch Bar which read: “pwned by niklasb and saelo.”

Baumstark later explained on Twitter why the hack was only considered a partial success, despite its efficacy.

@LiveOverflow @_tsuro @5aelo we had sep. exploits for 10.0.3 and 10.1. the 10.0.3 one is fixed upstream, so it counts as a duplicate

— Niklas Baumstark (@_niklasb) March 15, 2017

The contest, which is offering over a million dollars in prizes this year, has seen another group utilize an exploit in Safari to earn some points and funds for themselves. The Chaitin Security Research Lab successfully breached Safari to gain root access on MacOS. Because its goal was seen as a full, rather than a partial success, it earned $35,000 and 11 points for its trouble — though there were no props given for Touch Bar takeover in this case.

Although other teams also attempted to breach Safari with an escalation to root on MacOS, they couldn’t manage it within their allotted time.

As impressive as the first day of Pwn2Own 2017 has been though, there is still much more to come. The schedule for day two is now live and shows a lot of people and teams getting ready to try to crack open many pieces of commercial software, including the MacOS. We’ll no doubt learn more about their efforts when the results are posted later today.

Thanks to Trend Micro for sending through the header video.

Jon Martindale
Jon Martindale is the Evergreen Coordinator for Computing, overseeing a team of writers addressing all the latest how to…
This Dell XPS 16 deal cuts the laptop’s price by $500
Dell XPS 16 rear view showing lid and logo.

We love saving money on laptop purchases as much as the next guy, which is why we get so excited about Dell laptop deals. As one of the most popular Windows 11 PC brands, there’s a Dell computer for just about every want, need, and budget. But what about those of us who need one of the fastest and most powerful laptops that money can buy? Look no further than this terrific deal.

While the sale lasts, you can get the Dell XPS 16 Laptop for $2,500 when you purchase through Dell. Normally, this top-shelf laptop sells for $3,050. That’s $500 you’ll be able to keep in the bank, or perhaps invest toward one of the best monitor deals we found this week!

Read more
Asus ROG Ally X vs. Steam Deck OLED: Has the champion been dethroned?
The Asus ROG Ally X console.

It's not much of an overstatement to say that when Valve released the original Steam Deck, it started a real handheld PC revolution. Launching the Steam Deck OLED only emphasized that while there may be other, more powerful consoles on the market now, Valve's offering still stands strong against the competition. But can it hold its ground against the Asus ROG Ally X?

The two handhelds have more in common than it might seem at first glance. While both are refreshes, neither is a full-blown version 2.0. How do they stack up against each other, though? We've reviewed both ourselves, so we now know the answer to that question. Read our comparison to find out which device wins in a battle between the Asus ROG Ally X and the Steam Deck OLED.

Read more