Pwn2Own Tokyo 2020: ZDI Announces Hacking Competition

guest · Jul 29, 2020

ZDI Announces Rules, Prizes for Pwn2Own Tokyo 2020
...which invites white hat hackers to demonstrate their smartphone and IoT device exploits
July 29, 2020
https://www.securityweek.com/zdi-announces-rules-prizes-pwn2own-tokyo-2020

Pwn2Own Tokyo 2020 will take place on November 3-5 and it will coincide with the PacSec conference, which typically takes place in Tokyo that time of year. However, due to the coronavirus pandemic, PacSec has been turned into a virtual event.

In the case of Pwn2Own Tokyo, the event will actually be held in Toronto, Canada, but interested researchers have been given the option to participate remotely. Participants will need to submit a whitepaper detailing their exploit chain and instructions for running the exploit, which will be run by a ZDI staff member in Toronto.

Pwn2Own Tokyo 2020 focuses on exploits aimed at smartphones, including the Google Pixel 4, Samsung Galaxy S20, Huawei P40, Apple’s iPhone 11, and the Xiaomi Mi 10.
Click to expand...

Participants can earn up to $160,000 for hacking the iPhone 11 or Pixel 4 via a web browser, if their exploits are executed with kernel privileges and the payload can survive a reboot of the device.

Pwn2Own Tokyo 2020 also covers wearables. Hackers can earn $60,000 for achieving remote code execution on Facebook’s Oculus Quest VR headset and $80,000 for remote code execution on the 5th series Apple Watch.
Click to expand...

Additional details and the complete rules for Pwn2Own Tokyo 2020 are available on ZDI's website.
Click to expand...

Announcing Pwn2Own Tokyo 2020 – Live from Toronto!

Rasheed187 · Aug 1, 2020

So boring, why no software hacks? I would like to see browser sandbox escapes.

guest · Nov 6, 2020

Pwn2Own Tokyo Day one: NETGEAR Router, WD NAS Device hacked
November 6, 2020
https://securityaffairs.co/wordpress/110509/hacking/pwn2own-tokyo-2020-day1.html

The popular Pwn2Own Tokyo hacking competition is started and due to the COVID-19 pandemic, the competition has been arranged as a virtual event.
The Pwn2Own Tokyo is actually coordinated by Zero Day Initiative from Toronto, Canada, and white hat hackers taking part in the competition have to demonstrate their ability to find and exploit vulnerabilities in a broad range of devices.

On the day one of the competition, bug bounty hunters have successfully hacked a vulnerability in the NETGEAR Nighthawk R7800 router. The participants were the Team Black Coffee, Team Flashback, and teams from cybersecurity firms Starlabs and Trapa Security, and the Team Flashback earned $20,000 for a remote code execution exploit that resulting from the chaining of two bugs in the WAN interface.

“The team combined an auth bypass bug and a command injection bug to gain root on the system. They win $20,000 and 2 points towards Master of Pwn.” reads the post on the official site of the Pwn2Own Tokyo 2020.
Click to expand...

The Western Digital My Cloud Pro series PR4100 NSA device was targeted by The Trapa Security team also earned $20,000 for a working exploit for the Western Digital My Cloud Pro series PR4100 NSA device.
The 84c0 Team obtained partial success demonstrating a remote code execution exploit that leveraged a previously known issue.

In the afternoon, the Viettel Cyber Security team targeted a Samsung smart TV, the Samsung Q60T television, obtaining partial success due to the use of a known vulnerability.
“The Viettel Team was able to get a reverse shell on a fully patched Samsung TV, but it was done using a known bug. This counts as a partial win, but it does net them 1 point towards Master of Pwn.” continues the post.
Click to expand...

Zero Day Initiative:
Pwn2Own Tokyo (Live from Toronto) - Day One Results

Pwn2Own Tokyo (Live from Toronto) - Schedule and Live Results

guest · Nov 7, 2020

Pwn2Own Tokyo Day two: TP-Link router and Synology NAS hacked
November 7, 2020
https://securityaffairs.co/wordpress/110537/hacking/pwn2own-tokyo-day-two.html

On day one of the competition, bug bounty hunters have successfully hacked a vulnerability a NETGEAR router and a Western Digital NAS devices.

On Day 2, the Flashback team successfully chained three bugs to get code execution through the WAN interface on the TP-Link AC1750 Smart WiFi router. The group of bug bounty hunters won another $20,000 and 2 more Master of Pwn points.
The Syacktiv team successfully hacked the TP-Link AC1750 Smart WiFi router targeting the LAN interface with an exploit triggering three unique bugs to get code execution. The team earned $5,000 and 1 point towards Master of Pwn for this exploit.

The DEVCORE team hacked a Synology DiskStation DS418Play NAS exploiting a heap overflow to get arbitrary code execution. The team earned him $20,000 and 2 points twowards Master of Pwn.
Click to expand...

In Day 2 there were also the following partial success:

Team Bugscale targeting the Western Digital My Cloud Pro Series PR4100

84c0 targeting the LAN interface on the NETGEAR Nighthawk R7800 router

F-Secure Labs targeting the Samsung Q60T television

Sam Thomas of Pentest Ltd targeting the Western Digital My Cloud Pro Series PR4100

Click to expand...

Zero Day Initiative: Pwn2Own Tokyo (Live from Toronto) - Day Two Results

guest · Nov 8, 2020

Pwn2Own Tokyo Day 3: Team Flashback crowned Master of Pwn
November 8, 2020
https://securityaffairs.co/wordpress/110580/hacking/pwn2own-tokyo-day-3.html

Let’s start with the only success of day 3 obtained by the STARLabs team targeting the Synology DiskStation DS418Play NAS.
The team of experts exploited a race condition and an OOB Read to get a root shell on the NAS. They earned $20,000 and 2 points towards Master of Pwn.

Congrats to Team Flashback (@pedrib1337 and @RabbitPro) for being crowned Master of Pwn for the 2020 edition of #Pwn2Own Tokyo (Live from Toronto)! This amazing trophy and the hazmat suits will be headed your way soon. pic.twitter.com/nbIpLmwm5p
— Zero Day Initiative (@thezdi) November 7, 2020
Click to expand...

Day three has seen multiple partial successes, below the details of the attempts:

DEVCORE team targeting the Western Digital My Cloud Pro Series PR4100 – The team chained 6 bugs to gain code execution, but 2 flaws had previously been reported. They won $17,500 and 1.5 Master of Pwn points.

Gaurav Baruah targeting the Western Digital My Cloud Pro Series PR4100 – The expert was able to successfully get a root shell on the device exploiting a flaw that had been previously submitted. He earned 1 point towards Master of Pwn.

The Viettel Cyber Security team targeting the Sony X800 television – The team got a partial win because he was able to read sensitive files from a fully patched Sony X800 smart TV by using a bug that was publicly known. The team only earned 1 point towards Master of Pwn.

Click to expand...

guest · Nov 8, 2020

Windows 10, iOS, Chrome, and many others fall at China's top hacking contest
Winning hacker team pockets $744,500 at the Tianfu Cup, China's top hacking contest
November 8, 2020
https://www.zdnet.com/article/windo...ny-others-fall-at-chinas-top-hacking-contest/

Many of today's top software programs have been hacked using new and never-before-seen exploits at this year's edition of the Tianfu Cup — China's largest and most prestigious hacking competition.
Held in the city of Chengdu, in central China, the third edition of the Tianfu Cup ended earlier today.

"Many mature and hard targets have been pwned on this year's contest," organizers said today. Successful exploits were confirmed against:
Patches for all the bugs demonstrated over the weekend will be provided in the coming days and weeks, as it usually happens after every TianfuCup and Pwn2Own contest.
Click to expand...

Just like last year, the winning team came from Chinese tech giant Qihoo 360. Named the "360 Enterprise Security and Government and (ESG) Vulnerability Research Institute," the winners accounted for almost two-thirds of the entire prize pool, going home with $744,500 of the total $1,210,000 awarded this year.

Ranking second and third were the AntFinancial Lightyear Security Lab and security researcher Pang.
Click to expand...

Zero Day Initiative: Pwn2Own Tokyo (Live from Toronto) – Day Three Results and Master of Pwn

guest · Nov 11, 2020

Google and Mozilla fixed issues exploited at 2020 Tianfu Cup hacking contest
November 11, 2020
https://securityaffairs.co/wordpress/110773/security/google-mozilla-2020-tianfu-cup.html

Mozilla and Google have already addressed the critical Firefox and Chrome vulnerabilities that were recently exploited by white hat hackers at the 2020 Tianfu Cup hacking contest.

The vulnerability in Chrome exploited by hackers at the 2020 Tianfu Cup, tracked as CVE-2020-16016, is an inappropriate implementation issue that resided in the base component. Google addressed the flaw with the release of Chrome 86.
The CVE-2020-16016 flaw, along with the CVE-2020-26950 issue, was exploited by a team named “360 Enterprise Security and Government and (ESG) Vulnerability Research Institute,” [...]
Click to expand...

The Firefox vulnerability, tracked as CVE-2020-26950, is related to write side effects in MCallGetProperty opcode not being accounted for.

“In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition,” reads the advisory published by Mozilla.
Click to expand...

Rasheed187 · Nov 15, 2020

mood said: ↑

Google and Mozilla fixed issues exploited at 2020 Tianfu Cup hacking contest
November 11, 2020
https://securityaffairs.co/wordpress/110773/security/google-mozilla-2020-tianfu-cup.html
Click to expand...

Finally some interesting stuff! It's been quite a while since the built-in sandboxes of Chrome and Firefox were succesfully hacked.

guest · Nov 20, 2020

VMware addresses flaws exploited at recent Tianfu Cup
November 20, 2020
https://securityaffairs.co/wordpress/111214/hacking/vmware-fixed-tianfu-bugs.html

VMware has released patches for two serious ESXi vulnerabilities that were disclosed during the 2020 Tianfu Cup International PWN Contest.
The Tianfu Cup is the most important hacking contest held in China, the total bonus of the contest this year was up to 1 million US dollars.

Experts from VMware who were viewing the hacking contest immediately started working on patches to address the flaws. The company released the first set of patches on Thursday that fixed two vulnerabilities that were exploited by the bug hunters at the hacking competition.
Click to expand...

The first vulnerability, tracked as CVE-2020-4004, is a use-after-free vulnerability in XHCI USB controller.

“VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3.” reads the advisory.
The second flaw, tracked as CVE-2020-4005, is a VMX elevation-of-privilege vulnerability that was caused by the way certain system calls are managed.

“VMware ESXi contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.8.” continues the advisory.
Click to expand...

Log in or Sign up

Pwn2Own Tokyo 2020: ZDI Announces Hacking Competition

guest Guest

Rasheed187 Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

Log in or Sign up

Pwn2Own Tokyo 2020: ZDI Announces Hacking Competition

guest Guest

Rasheed187 Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

Useful Searches