The security researchers developed an undisclosed attack on the iPhone's mobile Safari browser to get access to a phone and then run a program that sent the phone's SMS messages to a Web server.
It is the first fully functioning attack on an iPhone since Apple released version 2 of the device in 2008, said Charlie Miller, the hacker who is set to follow the iPhone attack with an exploit he hopes will hack into the contest's MacBook Pro (his takeaway, should he succeed: the laptop and $10,000).
Apple introduced a number of advanced security measures with iPhone 2.0, including a "sandbox" in the device's kernel that restricts what hackers can do on a compromised machine, and a cryptographic code-signing requirement that makes it harder for them to run their initial malicious payload.
"When iPhone 2.0 came out, it became a lot harder" to hack the device, said Miller, who earned fame three years ago as the first person to hack the iPhone.
In fact, Weinmann said he had been set to compete in last year's Pwn2Own contest but had to abandon his plans at the last minute when he discovered his attack only worked on jail-broken phones, which have been hacked to run unapproved applications. Jail-breaking circumvents the iPhone's memory protections, but the Pwn2Own rules force contestants to use unmodified phones.
The Pwn2Own contest pays contestants for their exploit code, which leverages software flaws to give the attacker a foothold on the machine being attacked. But because of the iPhone's sandbox architecture, Weinmann and Iozzo actually spent much more time working on their payload software.
To make their attack work, they used a technique called "return-oriented programming," in which they essentially cobble together instructions from different parts of the iPhone's memory. But even with this technique, the iPhone's sandbox restricted what they could do once they had hacked into the machine.
Return-oriented programming has been around for more than a decade, but this attack is the first public demonstration of this technique on the Arm microprocessor, contest organizers say.
Iozzo and Weinmann were selected by lot to be the first to try out their attack at the three-day hacking contest. But Iozzo wasn't actually at the conference when his slot came up. A delayed flight caused him to to Vancouver, but a co-worker, Thomas Dullien (better known as Halvar Flake), stood in for him at the contest.
Even though they tested the hack before the contest, Dullien and Weinmann ran into some trouble. "The first try gave us an empty database, but that was probably due to a bug in our database," Weinmann said after winning the prize. A second attempt was successful.
In last year's contest, the iPhone did not get hacked.
After Miller tries to hack the MacBook Pro, another hacker is set to take on Internet Explorer. Contest winners will take home the device they hack, in addition to $10,000 in prize money for a Web browser attack and $15,000 for a mobile-device attack.
Google's Chrome browser, Firefox, the BlackBerry, a Nexus One and a Nokia E72 are also included in the contest.
Run in conjunction with the CanSecWest security conference, Pwn2Own has become a closely watched test of exploit-writing skills, where professional hackers routinely show up and demonstrate how easy it would be to break into a computer running the latest software.
The contest provides a high-profile demonstration of just how common exploitable software bugs really are, despite concerted efforts by companies such as Microsoft, Mozilla and Apple to lock down their code.
TippingPoint, a security company that sponsors the contest, runs a program that pays hackers for working exploit code. According to Aaron Portnoy, Tipping Point's security research team lead, software makers have introduced techniques that make it harder to hack their products, but there are still plenty of bugs out there.
CanSecWest and the Pwn2Own contest run through Friday.