There has been a lot of excitement surrounding Pwn2Own Miami for 2022 and it was an incredible three-day competition. Over $400,000 has been awarded for 26 unique 0-days and bug collisions.
During the contest between April 19 and April 21, the competitors targeted the ICS and SCADA products. Further, it is worth noting that many other product categories were also targeted by the cyber security researchers, and here they are:-
All the security flaws that are exploited during the Pwn2Own competition have been reported to the respective vendors. ZDI requires all vendors to release patches within 120 days after ZDI publicly discloses them to the industry.
Computest Sector 7 (@sector7_nl) has been crowned Master of Pwn for the second time with the combined scores of 90 points over three days accumulated by the duo of Daan Keuper (@daankeuper) and Thijs Alkemade (@xnyhps).
Listed below are all the entries with full results and the total points for each entry:-
After exploring the Inductive Automation Ignition SCADA control server solution using a missing authentication vulnerability used by the master of the Pwn team (Computest Sector 7), they collected $20,000 on day one.
Computest Sector 7 exploited an uncontrolled search path vulnerability in the AVEVA Edge HMI/SCADA software in order to gain RCE, for which they were awarded once again with the amount of $20,000 on the same day.
In the second round of the competition, the Computest Sector 7 exploited an endless loop condition to trigger a Denial of Service state against the Unified Automation C++ Demo Server and made $5,000.
Pwn2Own Miami 2022 saw the class of Computest Sector 7, and make their way through day two without a hitch, bypassing the trusted application check on the native OPC Foundation OPC UA .NET Standard and earned a hefty reward of $40,000.
Here’s what ZDI stated:-
“one of the more interesting bugs we’ve ever seen at a Pwn2Own.”
In the first edition of Pwn2Own Miami, the ICS-themed contest that is held back in January 2020, they awarded $280,000 for 24 unique zero-day flaws in critical infrastructure and SCADA products.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…