Pwn2Own 2013 Contest – Samsung Galaxy S4 and iPhone 5 0-day exploits

During the Pwn2Own 2013 contest the Japanese Team MBSD, of Mitsui Bussan Secure Directions, Inc. won $40,000 reward for zero day exploit demonstrating also several exploits against default applications on the Samsung Galaxy S4.

The zero-day allows the attacker to compromise the mobile device in several ways, for example using a drive-by download to install malware on the Smartphone.

“This team exploited multiple apps, installed by default on the Samsung Galaxy S4 to install malware and steal confidential data. In order for the exploit to be successful, the affected user must first be lured to an attacker-controlled malicious website. However, from there, no more user interaction is required and an attacker can install arbitrary applications of their choice with system-level privileges on the user’s device. In this case, the payload was the capture and exfiltration of sensitive data including the affected user’s contacts, bookmarks, browsing history, screen shots, SMS messages, etc.”