Experts hacked a fully patched iOS 15 running on iPhone 13 at China’s Tianfu Cup hacking contest

White hat hackers earned $1.88 million at the Tianfu Cup hacking contest by finding vulnerabilities in popular software.

The Tianfu Cup is the most important hacking contest held in China, this year white hat hackers earned $1.88 Million demonstrating vulnerabilities in popular software.

The edition of this year took place on October 16 and 17 in the city of Chengdu, participants had three attempts of 5 minutes to demonstrate their exploits.

The winner is the security firm Kunlun Lab who earned $654,500, below the tweet of the amazing expert @mj0011 CEO of Cyber-Kunlun & Kunlun Lab and former CTO of Qihoo 360 and founder of team 360Vulcan.

This year’s edition included a list of 16 possible targets, participants successfully demonstrated exploits against 13 of them:

• Windows 10 – hacked 5 times
• Adobe PDF Reader – 4 times
• Ubuntu 20 – 4 times
• Parallels VM – 3 times
• iOS 15 – 3 times
• Apple Safari – 2 times
• Google Chrome – 2 times
• ASUS AX56U router – 2 times
• Docker CE – 1 time
• VMWare ESXi – 1 time
• VMWare Workstation – 1 time
• qemu VM – 1 time
• Microsoft Exchange – 1 time

One of the exploits demonstrated at the contest immediately attracted the attention of the media, it is a zero-click remote code execution exploit against a fully patched iOS 15 running on the latest iPhone 13. The Chian Pangu won the highest single bonus in the history of this competition for this exploit, $300000.

The participants also demonstrated a remote code execution exploit chain against Google Chrome, this is the first time that this kind of exploit was demonstrated at the Tianfu Cup.

No exploit was demonstrated against Synology DS220j NAS, Xiaomi Mi 11 smartphone, and an unnamed domestic electric vehicle.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Tianfu Cup 2021)

[adrotate banner=”5″]

[adrotate banner=”13″]