On the first day of the Pwn2Own Ireland hacking competition , participants discovered and demonstrated 52 zero-day vulnerabilities in popular devices, winning a total of $486,250 (in prize money).
Let's take a look at the top efforts of the participants:
Vietnamese company Viettel Cyber Security received 13 points in the pursuit of the “Master of Pwn” title. Team phudq and nammp exploited a Lorex 2K WiFi camera via a stack-based buffer overflow vulnerability and won $30,000 and 3 points.
See also: Fortinet: Vulnerability in FortiManager used in attacks
Also, Viettel Cyber Security researchers combined four new bugs to gain access to the TrueNAS Mini X, via a QNAP QHora-322 router, earning another $50,000 and 10 points.
Sina Kheirkhah from Summoning Team discovered and exploited a chain of nine vulnerabilities to switch from the QNAP QHora-322 router to the TrueNAS Mini X device. In doing so, he managed to earn $100,000 and 10 Master of Pwn points.
Jack Dates of RET2 Systems used an out-of-bounds (OOB) write exploit on the Sonos Era 300 smart speaker , securing $60,000 and 6 points . Through the exploit , he was able to gain full control of the device.
Pwn2Own Ireland: Other notable efforts
The Neodyme team used a stack-based buffer overflow vulnerability to target the HP Color LaserJet Pro MFP 3301fdw printer and won $20,000 and 2 points .
See also: Hackers exploit Samsung's Zero-Day vulnerability
PHP Hooligans / Midnight Blue won $20,000 for exploiting a Canon imageCLASS MF656Cdw , and ANHTUD's ExLuck used four new vulnerabilitiesto exploit a QNAP TS-464 NAS. His reward was $40,000 and 4 Master of Pwn points.
Ryan Emmons and Stephen Fewer of Rapid7 successfully exploited the Synology DiskStation DS1823xs+ through a single bug, earning $40,000 and 4 points.
However, the first day of Pwn2Own Ireland had a few setbacks. The Summoning Team struggled to execute exploits for the QNAP TS-464 and Synology BeeStation BST150-4T in time, while Synacktiv encountered a collision bug in their exploit for the Lorex 2K camera, earning a reduced payout of $11,250.
Overall, though, the first day was quite successful with significant vulnerabilities, hacks, and rewards.
Over the next few days of the competition, participants will discover new vulnerabilities in fully patched SOHO devices, including printers, NAS systems, WiFi, routers, smart speakers, mobile phones (Samsung Galaxy S24).
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Vulnerabilities in VMware vCenter Server allow code execution
Pwn2Own Ireland 2024
The reaction from the hacker community and the public is always enthusiastic about these competitions. Everyone recognizes the importance of the competition in promoting the security of products and systems.
At the same time, such competitions give hackers themselves the opportunity to learn and be inspired by the techniques and strategies used by their other colleagues.
The Pwn2Own Ireland 2024 event strengthens the ethical hacking, offering a platform for dialogue, idea exchange and collaboration.
Source: www.bleepingcomputer.com
