Hacked iPhone 4S on Pwn2Own using Safari

In the latest Pwn2Own competition , a German team exploited a vulnerability in Safari's WebKit to compromise the iPhone 4S . This hack allowed them to access data such as contacts, photos, videos, and browsing history. The annual Pwn2Own event brings together hackers and developers to find and exploit new vulnerabilities in various operating systems and devices, exposing weaknesses in the process. Previous years' main target was Charlie Miller , who was recently hired by Twitter specifically to improve the social network's security.

This time, the protagonists are two Germans, Joost Pol and Keuper Daan , who showcased their attack method at Pwn2Own Amsterdam. It took them three weeks to pull off this hack, and the team won a $30.000 prize. Here are Joost Pol's words :

 

We wanted to see how long it would take to launch an attack against a completely clean iPhone. For me, that was the motivation. The easy part was dealing with WebKit on a zero-day exploit.

The two guys also said that this hack works perfectly with iOS 6 and all previous versions of the device. However, as mentioned earlier, using this method, it's possible to access some sensitive data, but things like email and SMS messages are inaccessible.

 

Fortunately, the two boys managed to destroy the hack they used, as it was designed solely for the contest, preventing it from falling into the wrong hands. Of course, Apple will be watching, and the bug will likely be fixed in a future update.