The third day of Pwn2Own Eire 2024 continued to showcase the experience of white hat hackers as they uncovered 11 zero-day vulnerabilities, including $124,750 to the whole prize pool, which now stands at $874,875.
Pwn2Own, a worldwide hacking competitors, challenges high safety researchers to use a variety of software program and {hardware} units, with the final word objective of incomes the celebrated “Master of Pwn” title and claiming as much as $1 million in rewards.
On Day 1, contributors uncovered 52 zero-day vulnerabilities, and on Day 2, one other 51 zero-days had been added.
Yesterday, the competitors noticed spectacular performances from groups representing Viettel Cyber Security, DEVCORE, and PHP Hooligans/Midnight Blue, amongst others.
The day kicked off with success for Ha The Lengthy and Ha Anh Hoang from Viettel Cyber Security, who exploited the QNAP TS-464 NAS utilizing a single command injection vulnerability. This profitable assault earned them $10,000 and 4 Grasp of Pwn factors.
Pumpkin Chang and Orange Tsai from the DEVCORE Analysis Staff mixed three exploits—a CRLF injection, an authentication bypass, and a SQL injection—to take management of the Synology BeeStation. Their complicated exploit rewarded them with $20,000 and 4 factors.
PHP Hooligans / Midnight Blue used an out-of-bounds write and a reminiscence corruption bug to carry out a “SOHO Smashup.” They managed to go from the QNAP QHora-322 router to a Lexmark printer, in the end printing their very own “banknotes,” incomes the crew $25,000 and 10 Grasp of Pwn factors.
Supply: Zero Day Initiative
Later within the day, Viettel Cyber Security delivered one other success, exploiting the Lexmark CX331adwe printer utilizing a kind confusion vulnerability, including $20,000 and a pair of extra factors to their tally.
Collisions and failed makes an attempt
Nonetheless, not all exploit makes an attempt went easily, and the third day had its share of collisions, the place a number of groups used the identical vulnerabilities to compromise units.
STEALIEN Inc. efficiently compromised a Lorex digital camera, however the bug they leveraged had already been used, decreasing their payout to $3,750 and awarding only one.5 factors.
Viettel Cyber Security additionally encountered a collision after they exploited a Canon printer utilizing a stack-based buffer overflow, which had been beforehand demonstrated. This earned them $5,000 and 1 level.
Viettel Cyber Security and ANHTUD confronted challenges when time ran out earlier than they may full their exploits, each whereas making an attempt to breach the Ubiquiti AI Bullet throughout the allotted time.
With simply 15 makes an attempt remaining within the schedule for Day 4, contributors have practically exhausted the prize pool, however there are nonetheless over $125,000 in awards up for grabs.
As the competition enters its ultimate part, Viettel Cyber Security is comfortably main within the standings, having over twice the quantity of factors contenders DEVCORE, Neodyme, Summoning Staff, and Ret2 Techniques have gathered so far.
On the finish of Day 3, the occasion revealed 114 zero-day vulnerabilities, showcasing the important function of such competitions in strengthening the safety of client units.
