May 18, 2017 By Shane Schick 2 min read

Two months after security researchers uncovered five major vulnerabilities in Apple products at the Pwn2Own contest, the technology giant released patches to address more than 100 bugs across MacOS, Safari and other affected products.

According to SecurityWeek, the Apple patch update released on May 17 addressed 37 vulnerabilities, four of which were uncovered by Pwn2Own contestants. These discoveries included vulnerabilities that could have allowed cybercriminals to break into a computer running Mac OS Sierra 10.12.5. Once inside, attackers could potentially visit websites, execute code, steal credentials and more.

The patches fixed scores of other bugs as well, including some specific to Safari 10.1.1.

Bobbing for Bad Apples

This year’s Pwn2Own, a hacking contest that takes place every year at the CanSecWest security conference in Vancouver, awarded cash prizes for discovering security issues on major platforms. As MacRumors reported at the time, contestants were able to interfere with the touch bar on a Mac and scroll through messages by exploiting a vulnerability Apple’s Safari browser. Apple was notified of the discovery immediately following the contest.

The Pwn2Own contest is run as part of the Zero Day Initiative, which advised Apple users to apply the patches quickly to help avoid security attacks such as the WannaCry outbreak that recently made international headlines. In total, the contest identified 35 percent of the vulnerabilities Apple patched, according to the Zero Day Initiative.

Inside the Apple Patch Update

A more recent bug addressed through Apple’s security update, identified by a researcher at Synack, could have been considered a zero-day issue, Threatpost reported. If a computer had file access auditing turned on, cybercriminals could have used an info kernel leak to read restricted memory.

As extensive as the patches appear, though, Apple actually addressed 233 vulnerabilities across MacOS, Safari and iOS in its previous update.

Of course, Apple is also covering bugs that didn’t come up at Pwn2Own. Infosecurity Magazine noted that patches are available for potential problems with iOS 10.3.2, including sandbox escapes related to the kernel, numerous WebKit vulnerabilities in watchOS and tvOS, and more.

Although Apple hasn’t disclosed whether any of these bugs are being exploited in the wild, it’s probably best to make sure the patches are deployed as quickly as possible.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today