Last week in Canada, at the CanSecWest conference, the annual Pwn2Own 2019 contest took place, organized by Trend Micro’s Zero Day Initiative (ZDI). The event’s reward pool this year exceeded one million dollars. But the contestants won more than just money: for example, one team managed to hack the Tesla Model 3 and keep it for themselves.
During the first day of the competition, Apple Safari, Oracle VirtualBox and VMware Workstation were hacked, earning the researchers $240,000. The Fluoroacetate team achieved the best results, notably Amat Cama and Richard Zhu, who became the most productive contestant last year and earned the title of Master of Pwn.
Fluoroacetate demonstrated working exploits for Safari (a full overflow and a heap leading to a Sandbox escape), Oracle VirtualBox (privilege escalation and arbitrary code execution) and VMware Workstation (a virtual machine escape and execution on the host operating system). These earned the team $55,000, $35,000 and $70,000, respectively. Thus, after the first day of the competition, Fluoroacetate already had $160,000.
Also on the first day, STAR Labs researcher anhdaden ($35,000) presented his exploit for Oracle VirtualBox (phoenhex & qwerty) and demonstrated full control of the system by exploiting vulnerabilities in Apple Safari ($45,000).
On the second day of Pwn2Own, security experts dismantled the Mozilla Firefox and Microsoft Edge browsers. Here, the best result again went to the guys from Fluoroacetate. First, they presented an exploit for Firefox that uses a JIT (Just-in-Time) bug and an out-of-bounds write issue in the Windows kernel. As a result, code execution at the system level was demonstrated, and to carry it out, the victim simply had to visit the researchers’ malicious website using Firefox. This earned the team $50,000.
The full hack of Edge, which included a virtual machine escape, a critical race condition in the kernel and a type confusion bug in the browser itself. The combination of these vulnerabilities helped the specialists make the browser running on the virtual machine execute arbitrary code on the host operating system. This hack added $130,000 to the Fluoroacetate piggy bank.
Also on the second day of the contest, Niklas Baumstark earned $40,000 for the JIT bug and logic vulnerability in Firefox, and Arthur Gerkis of Exodus Intelligence earned $50,000 for the sandbox escape in Microsoft Edge.
The third day of the contest was devoted to car hacking. This year, participants were invited to hack the Tesla Model 3, and two teams applied to take part: Fluoroacetate and Team KunnaPwn. Unfortunately, on the morning of the third day, it was announced that Team KunnaPwn had withdrawn its application and did not want to take part in the competition. Only Zhu and Kama ultimately broke into the car.
The Fluoroacetate team demonstrated that the car’s infotainment system had been compromised. The experts executed JIT code while the browser rendered, accessed the car’s firmware and managed to display their own message through the multimedia system.
The successful compromise of the Tesla Model 3 not only earned the team an additional $35,000, but also allowed the specialists to keep the hacked car (under Pwn2Own rules, all hacked devices go to the researchers). Tesla representatives promised to fix the problems discovered by the experts in the coming days.
As a result, Pwn2Own participants earned a total of $545,000 this year, of which $375,000 went to the Fluoroacetate team. Zhu and Kama were once again awarded the title of Master of Pwn, that is, the most accomplished hackers of the year.
