Pwn2Own 2020 – Participants hacked Adobe Reader, Oracle VirtualBox, and Windows

Pwn2Own 2020 Day 2 -Participants earned a total of $90,000 for exploits targeting Oracle VirtualBox, Adobe Reader and Windows.

The Coronavirus outbreak hasn’t stopped the Pwn2Own hacking conference, for the first time its organizer, the Zero Day Initiative (ZDI), has decided to arrange the event allowing the participants to remotely demonstrate their exploits.

Day 2 begun with Phi Phạm Hồng of STAR Labs that demonstrated a working VirtualBox exploit that resulted in a guest OS escape and arbitrary code execution on the host. The exploit involved out-of-bounds read and uninitialized variable bugs.

“Phi Phạm Hồng (@4nhdaden) of STAR Labs (@starlabs_sg) targeting Oracle VirtualBox in the Virtualization category.” reads the page of the event.

SUCCESS – Day Two kicks off with 4nhdaden using an OOB Read for an info leak and an unitialized variable for code execution on the hypervisor. He earns himself $40,000 and 4 Master of Pwn points.

Later the popular duo Amat Cama and Richard Zhu of team Fluoroacetate earned $50,000 for hijacking a system by exploiting use-after-free vulnerabilities in Adobe Reader and the Windows kernel.

The white hat hackers used a pair of UAFs – one in Acrobat and one in the Windows kernel – to elevate privilieges and to over the system. They also received 5 points towards Master of Pwn.

On Day 2 of the Pwn2Own there ware also some failures, the Synacktiv team attempted to hack VMware Workstation without success.

At the end of the day, Lucas Leong of the Zero Day Initiative (ZDI) demonstrated a guest-to-host escape on VirtualBox.

During the first day of the Pwn2Own 2020 hacking competition, participants earned a total of $180,000 for exploits targeting Windows 10, Ubuntu Desktop and macOS.

The total amount paid out this year is half of what the participants received last year. Cama and Zhu won a total of $375,000 in cash in the three days for exploits against Safari, Oracle VirtualBox, VMware Workstation, Firefox, and Microsoft Edge.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Hacking, Pwn2Own 2020)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.