Pwn2Own hacking competition expands to industrial control systems

guest · Oct 28, 2019

Pwn2Own hacking competition expands to industrial control systems
October 28, 2019
https://www.cyberscoop.com/pwn2own-miami-industrial-control-systems/

For years, Pwn2Own, a competition that rewards researchers for finding previously unknown software flaws, has focused on code used in enterprise IT networks rather than programs that support critical infrastructure operations.
That is all going to change in January, when the contest heads to Miami and exposes white-hat hackers to popular software and protocols used in industrial control systems (ICS).

Contestants will have a matter of minutes to demonstrate zero-day exploits that they’ve developed beforehand. Cash and other prizes worth a total of $250,000 will be available to winners, Zero Day Initiative (ZDI), the organization that runs Pwn2Own, said Monday.

“We do anticipate seeing some old and some new faces,” said Brian Gorenc, the director of ZDI, which is backed by cybersecurity company Trend Micro. “There’s not a lot of overlap between security researchers in the ICS sector and other sectors, but those people do exist.”
Click to expand...

Pwn2Own Miami – Bringing ICS into the Pwn2Own World

Starting next January, Pwn2Own grows again by adding a third competition at the S4 conference in Miami South Beach on January 21 – 23, 2020. This contest focuses on Industrial Control Systems (ICS) and associated protocols.
Click to expand...

guest · Jan 22, 2020

Pwn2Own Miami Contestants Haul in $180K for Hacking ICS Equipment
The competition targets the systems that run critical infrastructure and more
January 22, 2020
https://threatpost.com/pwn2own-miami-ics-equipment/152122/

The very first Pwn2Own hacking competition that exclusively focuses on the industrial control systems (ICS) has kicked off in Miami. So far, a total of $180,000 has been awarded for pwning five different products.

So far, two teams are the big winners. The Horst Goertz for IT-Security team (Tobias Scharnowski, Niklas Breitfeld and Ali Abbasi) and the Flashback team (Pedro Ribeiro and Radek Domanski) both have $75,000 in winnings going into Day Three.
On Day One, overall, there were six successful hacking attempts and two partially successful attempts against eight hacking targets, according to ZDI. On Day Two, there were three successful hacks and two partials against four total targets.
Prizes and Categories
The categories include Control Servers, which covers server solutions that provide connectivity, monitoring and control across disparate programmable logic controllers (PLCs) and other field systems. The specific targets in this category include control servers from Iconics and Inductive Automation. [...]

“[...] we worked with multiple people and companies within the ICS industry to ensure we have the right products and categories to create a meaningful test of the security of these products and protocols. As with our other contests, Pwn2Own Miami seeks to harden these platforms by revealing vulnerabilities and providing that research to the vendors. [...]”
Click to expand...

guest · Jan 24, 2020

Inside the World's Highest-Stakes Industrial Hacking Contest
January 23, 2020
https://www.wired.com/story/pwn2own-industrial-hacking-contest/

Digital Flaws, Physical Havoc
The goal of Pwn2Own has always been to make its hacking targets more secure. The secret vulnerabilities that contestants exploit are discreetly reported to on-sight product vendors, and kept under wraps until the company can release a patch. In this case, the competition aims to highlight a set of targets with more devastating potential consequences than ever before.
[...]
Still, pointing out the flaws in critical software—and even creating fixes for them—doesn't necessarily solve the underlying problem. Industrial facilities often don't patch, not wanting to risk any disruption to their services that introducing a software update might cause, points out Emily Crose, a penetration tester for industrial control system security firm Dragos.
Click to expand...

guest · Jun 22, 2020

Mitsubishi Patches Vulnerabilities Disclosed at ICS Hacking Contest
June 22, 2020
https://www.securityweek.com/mitsubishi-patches-vulnerabilities-disclosed-ics-hacking-contest

White hat hackers earned a total of $280,000 for the exploits they demonstrated at the Zero Day Initiative’s Pwn2Own contest in January, including $80,000 for vulnerabilities found in ICONICS’s Genesis64 HMI/SCADA product.

The researchers who successfully hacked the ICONICS product were Pedro Ribeiro and Radek Domanski of Flashback team; Tobias Scharnowski, Niklas Breitfeld and Ali Abbasi from the Horst Goertz Institute for IT-Security; Yehuda Anikster of Claroty; and Steven Seeley and Chris Anastasio of Incite team.
They reported five critical and high-severity vulnerabilities to ICONICS, including ones that allow a remote attacker to execute arbitrary code and launch denial-of-service (DoS) attacks by sending specially crafted packets to the targeted system.
Click to expand...

ZDI told SecurityWeek that it will soon publish advisories for the ICONICS vulnerabilities disclosed at Pwn2Own Miami.
Click to expand...

Log in or Sign up

Pwn2Own hacking competition expands to industrial control systems

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Pwn2Own hacking competition expands to industrial control systems

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches