Friday, April 19, 2024

Pwn2Own – Hackers earn $400K for 26 zero-day Exploits

There has been a lot of excitement surrounding Pwn2Own Miami for 2022 and it was an incredible three-day competition. Over $400,000 has been awarded for 26 unique 0-days and bug collisions.

During the contest between April 19 and April 21, the competitors targeted the ICS and SCADA products. Further, it is worth noting that many other product categories were also targeted by the cyber security researchers, and here they are:-

  • Control Server
  • OPC Unified Architecture Server
  • Data Gateway
  • Human Machine Interface (HMI)

All the security flaws that are exploited during the Pwn2Own competition have been reported to the respective vendors. ZDI requires all vendors to release patches within 120 days after ZDI publicly discloses them to the industry.

Master of Pwn

Computest Sector 7 (@sector7_nl) has been crowned Master of Pwn for the second time with the combined scores of 90 points over three days accumulated by the duo of Daan Keuper (@daankeuper) and Thijs Alkemade (@xnyhps).

Listed below are all the entries with full results and the total points for each entry:-

Winners are Rewarded $90,000

After exploring the Inductive Automation Ignition SCADA control server solution using a missing authentication vulnerability used by the master of the Pwn team (Computest Sector 7), they collected $20,000 on day one.

Computest Sector 7 exploited an uncontrolled search path vulnerability in the AVEVA Edge HMI/SCADA software in order to gain RCE, for which they were awarded once again with the amount of $20,000 on the same day.

In the second round of the competition, the Computest Sector 7 exploited an endless loop condition to trigger a Denial of Service state against the Unified Automation C++ Demo Server and made $5,000.

Pwn2Own Miami 2022 saw the class of Computest Sector 7, and make their way through day two without a hitch, bypassing the trusted application check on the native OPC Foundation OPC UA .NET Standard and earned a hefty reward of $40,000.

Here’s what ZDI stated:-

“one of the more interesting bugs we’ve ever seen at a Pwn2Own.”

In the first edition of Pwn2Own Miami, the ICS-themed contest that is held back in January 2020, they awarded $280,000 for 24 unique zero-day flaws in critical infrastructure and SCADA products.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Alert! Windows LPE Zero-day Exploit Advertised on Hacker Forums

A new zero-day Local Privilege Escalation (LPE) exploit has been put up for sale...

Palo Alto ZeroDay Exploited in The Wild Following PoC Release

Palo Alto Networks has disclosed a critical vulnerability within its PAN-OS operating system, identified...

FIN7 Hackers Attacking IT Employees Of Automotive Industry

IT employees in the automotive industry are often targeted by hackers because they have...

Russian APT44 – The Most Notorious Cyber Sabotage Group Globally

As Russia's invasion of Ukraine enters its third year, the formidable Sandworm (aka FROZENBARENTS,...

SoumniBot Exploiting Android Manifest Flaws to Evade Detection

A new banker, SoumniBot, has recently been identified. It targets Korean users and is...

LeSlipFrancais Data Breach: Customers’ Personal Information Exposed

LeSlipFrancais, the renowned French underwear brand, has confirmed a data breach impacting its customer...

Cisco Hypershield: AI-Powered Hyper-Distributed Security for Data Center

Cisco has unveiled its latest innovation, Cisco Hypershield, marking a milestone in cybersecurity.This groundbreaking...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles