Trend Micro’s Zero Day Initiative (ZDI) announced that security researchers earned $1,132,500 on the Pwn2Own Vancouver 2024 hacking competition for uncovering 29 unique zero-day vulnerabilities.
Throughout the event, the researchers targeted software and products in the web browser, cloud-native/container, virtualization, enterprise applications, server, local escalation of privilege (EoP), enterprise communications, and automotive categories, all up-to-date and in their default configuration.
The total prize pool was over $1,300,000 in cash prizes and a Tesla Model 3, which was won by Team Synacktiv on the first day.
Competitors successfully gained code execution and escalated privileges on fully patched systems after hacking Windows 11, Ubuntu Desktop, VMware Workstation, Oracle VirtualBox, three web browsers (Apple Safari, Google Chrome, and Microsoft Edge), and the Tesla Model 3.
Manfred Paul has been granted the title of Pwn Master and $202,500 earned throughout the two-day competition after hacking the Apple Safari, Google Chrome, and Microsoft Edge web browsers.
On the first day of Pwn2Own, he gained remote code execution (RCE) in Safari via an integer underflow bug and a PAC bypass zero-day combo. He then used a double-tap RCE exploit targeting an Improper Validation of Specified Quantity in Input weakness to take down Chrome and Edge.
Synacktiv also made Pwn2Own Vancouver 2024’s Day 1 highlight reel after winning a Tesla Model 3 car and $200,000 after hacking the Tesla ECU with Vehicle (VEH) CAN BUS Control in under 30 seconds using an integer overflow exploit.
On the second day, Manfred Paul also exploited an out-of-bounds (OOB) write zero-day vulnerability to gain RCE and escaped Mozilla Firefox’s sandbox using an exposed dangerous function weakness.
Vendors have 90 days to release security fixes for zero-day vulnerabilities reported during Pwn2Own contests before TrendMicro’s Zero Day Initiative discloses them publicly.
Comments