Pwn2Own Austin 2021: Phones, Printers, NAS, and more!

guest · Aug 14, 2021

Pwn2Own Austin 2021: Phones, Printers, NAS, and more!
August 12, 2021
https://www.zerodayinitiative.com/blog/2021/8/11/pwn2own-austin-2021-phones-printers-nas-and-more

This year, we’ll be hosting Pwn2Own for our headquarters in Austin, Texas on November 2-4, 2021. For this year’s event, we’re growing again to reflect the home-office environment many currently find themselves in by expanding the router category and implementing the printer category. In all, we’ll have 22 devices available as targets and be offering more than $500,000 USD in prize money.

Similar to how we’ve conducted our last few Pwn2Own events, we will allow remote participation in this inaugural Pwn2Own Austin. As of now, we are planning on having contestants in person if possible.
Click to expand...

The Target Handsets
At its heart, Pwn2Own Austin (once known as Pwn2Own Mobile) looks at mobile phones, and our move to Texas doesn’t change this fact. Here are the target handsets for Pwn2Own Austin 2021: [...]
Printers, Network Attached Storage, Smart Speakers, Televisions, and More
Over the past few years, we’ve been expanding the targets to include more than just mobile phones.
This year, we’re including printers as a target.
Click to expand...

guest · Nov 3, 2021

Sonos, HP, and Canon devices hacked at Pwn2Own Austin 2021
November 3, 2021
https://www.bleepingcomputer.com/ne...-canon-devices-hacked-at-pwn2own-austin-2021/

During the first day of Pwn2Own Austin 2021, contestants won $362,500 after exploiting previously unknown security flaws to hack printers, routers, NAS devices, and speakers from Canon, HP, Western Digital, Cisco, Sonos, TP-Link, and NETGEAR.

Researchers can win the highest rewards in the mobile phone category, where they can get cash prizes of up to $150,000, with a $50,000 bonus if their iPhone or Pixel browser exploits execute with kernel-level privilege, bringing the maximum award for a single challenge to a total of $200,000.
Pwn2Own Austin's consumer-focused event was extended to four days after 22 different contestants registered for 58 total entries. The complete schedule contest can be found here.
Click to expand...

The DEVCORE and THEORI teams were the ones who earned the highest rewards during the first day of Pwn2Own in Austin.

DEVCORE's Orange Tsai (@orange_8361), Angelboy (@scwuaptx), and Meh Chang (@mehqq_) won a total of $100,000 after taking over the Sonos One Speaker and the Canon ImageCLASS MF644Cdw and HP Color LaserJet Pro MFP M283fdw printers.
The THEORI Team (@theori_io) earned another $80,000 after hacking Western Digital's My Cloud Pro Series PR4100 and 3TB My Cloud Home Personal Cloud NAS devices.
Click to expand...

guest · Nov 4, 2021

Samsung Galaxy S21 hacked on second day of Pwn2Own Austin
November 4, 2021
https://www.bleepingcomputer.com/ne...y-s21-hacked-on-second-day-of-pwn2own-austin/

Contestants hacked the Samsung Galaxy S21 smartphone during the second day of the Pwn2Own Austin 2021 competition, as well as routers, NAS devices, speakers, and printers from Cisco, TP-Link, Western Digital, Sonos, Canon, Lexmark, and HP.

So far, Trend Micro's Zero Day Initiative has awarded $777,500 over the first two days of Pwn2Own Austin, with $415,000 awarded during the second day and $362,500 won during the first day.
The Synacktiv team maintains a slight lead in the Master of Pwn standings with 15 Master of Pwn points and $150,000 won so far, one point ahead of the DEVCORE team that has 14 points and has earned $140,000.
Click to expand...

Yesterday, Mr L and Nguyễn Hoàng Thạch (@hi_im_d4rkn3ss) of STARLabs were able to get code execution on the Samsung Galaxy S21 running the latest Android 11 security updates.

However, despite successfully exploiting a zero-day flaw, the attempt was tagged as a "collision" after it was revealed in the disclosure room that they used a bug known to the vendor.
They still earned $25,000 and 2.5 Master of Pwn points, reaching a total of $75,000 in awards after the first two days of competition.
Click to expand...

Samsung Galaxy S21 was also the only device that wasn't compromised on the first day after F-Secure Labs' Ken Gannon couldn't get his zero-day exploit to work within the allotted time.
Click to expand...

guest · Nov 5, 2021

Pwn2Own: Printer plays AC/DC, Samsung Galaxy S21 hacked twice
November 5, 2021
https://www.bleepingcomputer.com/ne...-plays-ac-dc-samsung-galaxy-s21-hacked-twice/

Trend Micro's ZDI has awarded $1,081,250 for 61 zero-days exploited at Pwn2Own Austin 2021, with competitors successfully pwning the Samsung Galaxy S21 again and hacking an HP LaserJet printer to play AC/DC's Thunderstruck on the contest's third day.

Contestants earned $70,000 during the fourth day, $238,750 on the third day, $415,000 on the second, and $362,500 during the first day.
The Synacktiv team won the contest after getting $197,000 in cash for their zero-days and 20 Master of Pwn points, with a six-point lead over the DEVCORE team, which finished with 14 points and earned a total of $140,000.
Click to expand...

Over the four days of competition, the contestants compromised printers, routers, NAS devices, and speakers from Canon, HP, Western Digital, Cisco, Sonos, TP-Link, and NETGEAR after exploiting 61 previously unknown security flaws known as zero-day vulnerabilities.

The full Pwn2Own Austin 2021 schedule and the results following each challenge are available here.
Click to expand...

Sam Thomas (@_s_n_t) from team Pentest Limited (@pentestltd) was the one who compromised the Samsung Galaxy S21 running the latest Android 11 security updates on the third day using a unique three-bug chain and earning $50,000.

The third day of Pwn2Own also saw the F-Secure Labs team turning an HP LaserJet printer into a jukebox using a stack-based buffer overflow to play AC/DC's Thunderstruck.

(Sound On) Confirmed! The team from @FSecureLabs used a stack-based buffer overflow to take over an HP LaserJet and turn it into a jukebox. Their efforts earn them $20,000 and 2 Master of Pwn points. #Pwn2Own https://t.co/3kqn5Cr7Y4
— Zero Day Initiative (@thezdi) November 4, 2021
Click to expand...

Log in or Sign up

Pwn2Own Austin 2021: Phones, Printers, NAS, and more!

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Pwn2Own Austin 2021: Phones, Printers, NAS, and more!

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches