Pwn2Own – Hackers earn $400K for 26 zero-day Exploits

There has been a lot of excitement surrounding Pwn2Own Miami for 2022 and it was an incredible three-day competition. Over $400,000 has been awarded for 26 unique 0-days and bug collisions.

During the contest between April 19 and April 21, the competitors targeted the ICS and SCADA products. Further, it is worth noting that many other product categories were also targeted by the cyber security researchers, and here they are:-

• Control Server
• OPC Unified Architecture Server
• Data Gateway
• Human Machine Interface (HMI)

All the security flaws that are exploited during the Pwn2Own competition have been reported to the respective vendors. ZDI requires all vendors to release patches within 120 days after ZDI publicly discloses them to the industry.

Master of Pwn

Computest Sector 7 (@sector7_nl) has been crowned Master of Pwn for the second time with the combined scores of 90 points over three days accumulated by the duo of Daan Keuper (@daankeuper) and Thijs Alkemade (@xnyhps).

Listed below are all the entries with full results and the total points for each entry:-

Winners are Rewarded $90,000

After exploring the Inductive Automation Ignition SCADA control server solution using a missing authentication vulnerability used by the master of the Pwn team (Computest Sector 7), they collected $20,000 on day one.

Computest Sector 7 exploited an uncontrolled search path vulnerability in the AVEVA Edge HMI/SCADA software in order to gain RCE, for which they were awarded once again with the amount of $20,000 on the same day.

In the second round of the competition, the Computest Sector 7 exploited an endless loop condition to trigger a Denial of Service state against the Unified Automation C++ Demo Server and made $5,000.

Pwn2Own Miami 2022 saw the class of Computest Sector 7, and make their way through day two without a hitch, bypassing the trusted application check on the native OPC Foundation OPC UA .NET Standard and earned a hefty reward of $40,000.

Here’s what ZDI stated:-

“one of the more interesting bugs we’ve ever seen at a Pwn2Own.”

In the first edition of Pwn2Own Miami, the ICS-themed contest that is held back in January 2020, they awarded $280,000 for 24 unique zero-day flaws in critical infrastructure and SCADA products.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.