During the first day of Pwn2Own Vancouver 2022, participants won $800,000 after successfully exploiting 16 zero-day bugs to hack into multiple products, including Microsoft’s Windows 11 operating system and the Teams communications platform.
The first to fall was Microsoft Teams in the corporate communications category after Hector Peralta took advantage of a misconfiguration error.
The STAR Labs team (Daniel Lim Wee Soong† Poh Jia Hao† Li Jiantaoand Ngo Wei Lin) also demonstrated a Teams zero-click exploit chain of 2 bugs (injection and file random writing).
Microsoft Teams was hacked for the third time by Masato Kinugawa, who exploited a 3 bug chain of injection, misconfiguration and sandbox escape.
Each of them earned $150,000 for successfully demonstrating their Microsoft Teams zero-days.
STAR Labs also made an additional $40,000 after increasing privileges on a system running Windows 11 using a Use-After-Free weakness and an additional $40,000 by achieving privilege escalation on Oracle Virtualbox.
Manfred Paul (@_manfp) also successfully demonstrated 2 bugs (prototype fouling and incorrect input validation) to hack Mozilla Firefox and write an out-of-band on Apple Safari to earn $150,000.
Other highlights from the first day of Pwn2Own include Marcin Wiązowski, Team Orca from Sea Security and Keith Yeo demonstrating more zero-days in Windows 11 and Ubuntu Desktop,
On the second day, Pwn2Own competitors will attempt to leverage zero-days in the Tesla Model 3 Infotainment System (with Sandbox Escape) and Diagnostic Ethernet (with Root Persistence), Windows 11 and Ubuntu Desktop.
After the vulnerabilities have been identified and disclosed at Pwn2Own, software and hardware vendors have 90 days to develop and release security solutions for all reported vulnerabilities.
During the Pwn2Own Vancouver 2022 competition, security researchers will focus on products in the categories of web browser, virtualization, Local Escalation of Privilege, servers, enterprise communications and automotive.
Between May 18 and May 20, they can earn over $1,000,000 in cash and prizes, including a Tesla Model 3 and a Tesla Model S. The top prize for hacking a Tesla is now $600,000 (and maybe the car itself). .
Team Fluoroacetate was the first to take home a Tesla Model 3 at Pwn2Own Vancouver 2019 after hacking into the car’s Chromium-based infotainment system.
Update: Added STAR Labs team members behind Teams zero-click exploit chain.
#Microsoft #Teams #Windows #Hacked #Day #Pwn2Own
Comments
Post a Comment