Team Fluoroacetate Dominated Pwn2Own, Found Zero-Days in Apple iPhone X, Samsung Galaxy S9, and Xiaomi Mi6 Phones

The Silicon Review
16 November, 2018

Another day, another flaw! Recently at Pwn2Own 2018, a computer hacking contest held in Tokyo, security researchers have once again demonstrated that even that fully patched mobile devices from popular smartphone manufacturers are at risk from zero-day vulnerabilities.

Pwn2Own 2018 was a two days event (13 Nov and 14 Nov) and many teams of hackers from different parts of the world participated. Across these two days, more than 16 new vulnerabilities were reported and the three major phones that are found to be at risk are Apple iPhone X, Samsung Galaxy S9,and Xiaomi Mi6 phones. Furthermore, the sponsor of the event Trend Micro's Zero Day Initiative (ZDI) awarded the security researchers a total amount of $325,000.

Twosecurity researchers, Richard Zhu and Amat Cama who named their team as Fluoroacetate, won the overall event by demonstrating multiple vulnerabilities. Fluoroacetate managed to demonstrate the first bug in the Xiaomi Mi6 handset and it was an NFC (near-field communications) issue, and that bug earned Fluoroacetate $30,000. Next, the duo found2 vulnerabilities in a fully patched iPhone X over Wi-Fi and earned $60,000 in prize money. Fluoroacetate later targeted another android device and it was the Samsung Galaxy S9. The duo succeeded in this too — they exploited the Samsung Galaxy S9 via a vulnerability in the baseband component of the phone and got awarded $50,000.

That is not all, Richard and Amat on the 2nd day of the event continued to assault the iPhone X and finally demonstrated another pair of bugs that enabled them to exfiltrate data from the iPhone and this earned them an additional $50,000.

Rounding out the success of Richard and Amat was a flaw the duo discovered in the JavaScript engine of the Xiaomi web browser and that attack earned them $25,000. However, Fluoroacetate didn’t succeed on its final attempt of the contest, where the team targeted the iPhone X in the baseband category.