IE9 not affected by Pwn2Own hacks
updated 05:30 am EST, Fri March 11, 2011
IE9 set for official release on Monday
Microsoft used a tweet to confirm that its Internet Explorer 9 Release Candidate is not affected by the browser vulnerabilities used in the Pwn2Own contest to hack IE8. IE8 was hacked using an exploit devised by Stephen Fewer of Harmony Security. Fewer's code circumvented IE8's Protected Mode which is actually supposed to isolate the browser from the OS to stop such attacks.
While previous versions of Internet Explorer have been particularly vulnerable to hacking exploits, IE9 is a major overhaul of the browser and is said to be much more secure. It is also much more compliant with internet standards including HTML5. To boost rendering speed, it uses hardware acceleration and a much more efficient JavaScript engine for rendering webpages much more quickly.
A research team using an exploit that took several weeks to compile won the contest. Using the exploit, the researchers from the French company Vupen were able to hack a Macbook using Apple’s Safari browser to remotely launch the calculator app and write a file to the hard drive.
Microsoft also used its tweet to confirm that IE9 will be officially available for download on Monday. Its launch has been a long time coming and sees it arrive with Microsoft’s share of the browser market dipping from a one-time high of 90 percent, to around 60 percent. In particular, Mozilla’s Firefox has taken much of its lost share, with Google’s Chrome and Apple’s Safari also gaining in popularity.
