May 18, 2017 By Shane Schick 2 min read

Two months after security researchers uncovered five major vulnerabilities in Apple products at the Pwn2Own contest, the technology giant released patches to address more than 100 bugs across MacOS, Safari and other affected products.

According to SecurityWeek, the Apple patch update released on May 17 addressed 37 vulnerabilities, four of which were uncovered by Pwn2Own contestants. These discoveries included vulnerabilities that could have allowed cybercriminals to break into a computer running Mac OS Sierra 10.12.5. Once inside, attackers could potentially visit websites, execute code, steal credentials and more.

The patches fixed scores of other bugs as well, including some specific to Safari 10.1.1.

Bobbing for Bad Apples

This year’s Pwn2Own, a hacking contest that takes place every year at the CanSecWest security conference in Vancouver, awarded cash prizes for discovering security issues on major platforms. As MacRumors reported at the time, contestants were able to interfere with the touch bar on a Mac and scroll through messages by exploiting a vulnerability Apple’s Safari browser. Apple was notified of the discovery immediately following the contest.

The Pwn2Own contest is run as part of the Zero Day Initiative, which advised Apple users to apply the patches quickly to help avoid security attacks such as the WannaCry outbreak that recently made international headlines. In total, the contest identified 35 percent of the vulnerabilities Apple patched, according to the Zero Day Initiative.

Inside the Apple Patch Update

A more recent bug addressed through Apple’s security update, identified by a researcher at Synack, could have been considered a zero-day issue, Threatpost reported. If a computer had file access auditing turned on, cybercriminals could have used an info kernel leak to read restricted memory.

As extensive as the patches appear, though, Apple actually addressed 233 vulnerabilities across MacOS, Safari and iOS in its previous update.

Of course, Apple is also covering bugs that didn’t come up at Pwn2Own. Infosecurity Magazine noted that patches are available for potential problems with iOS 10.3.2, including sandbox escapes related to the kernel, numerous WebKit vulnerabilities in watchOS and tvOS, and more.

Although Apple hasn’t disclosed whether any of these bugs are being exploited in the wild, it’s probably best to make sure the patches are deployed as quickly as possible.

More from

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

State Department releases International Cyberspace and Digital Policy Strategy

3 min read - U.S. Secretary of State Antony Blinken announced the new U.S. International Cyberspace and Digital Policy Strategy during the recent RSA Conference in San Francisco. The strategy emphasizes the role of technology in diplomacy and the urgent need to build international coalitions.“Security, stability, prosperity — they are no longer solely analog matters,” Blinken said at the conference.The new strategy focuses on “digital solidarity” not “digital sovereignty,” Blinken said, emphasizing the importance of collaboration with like-minded nations. Also mentioned was the need…

DHS establishes Artificial Intelligence Safety and Security Board

3 min read - As part of its commitment to addressing the rapid growth and adoption of AI technology across all industries and sectors, the Department of Homeland Security (DHS) announced the establishment of the Artificial Intelligence Safety and Security Board in late April. The Board’s first meeting is planned for early May when they will begin the task of focusing on how to develop and deploy AI technology within the United States’ critical infrastructure safely and securely. Based on the DHS Homeland Threat…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today