Pierluigi Paganini
October 24, 2024
On day two of Pwn2Own Ireland 2024, hackers demonstrated attacks against 51 zero-day vulnerabilities, earning a total of $358,625, prizes that we have sum to the $516,250 earned by participants on the first day of the event.
With the $516,250 earned by participants on the first day of the event, the total payout at the hacking contest organized by Trend Micro’s Zero Day Initiative (ZDI) has already reached nearly $850,000, and there are two more days left.
“Today, we awarded $358,625 – which brings the event total to $847,875. The Viettel Cyber Security team has a commanding lead for Master of Pwn, but with two days left, there still could be changes.” reads the announcement published by ZDI.
The exploit of the day was demonstrated by Ken Gannon of NCC Group who chained five vulnerabilities to hack a Samsung Galaxy S24 device and get a shell and the installation of an app.
CONFIRMED!! Ken Gannon (@yogehi) of NCC Group (@NCCGroupInfosec) used 5 different bugs, including a path traversal, to get a shell & install an app on the #Samsung Galaxy S24. He earns $50,000 and 5 Master of Pwn points. #Pwn2Own #P2OIreland pic.twitter.com/2Mt5Jc0P2t
— Zero Day Initiative (@thezdi) October 23, 2024
He earned $50,000 for an exploit chain that involved five vulnerabilities and achieved a shell and 5 Master of Pwn points.
PHP Hooligans / Midnight Blue (@midnightbluelab) used a command injection bug to get code execution on the Synology BeeStation BST150-4T. The team earned $40,000 and four Master of Pwn points.
Confirmed! PHP Hooligans / Midnight Blue (@midnightbluelab) used a command injection bug to get code execution on the Synology BeeStation BST150-4T. They earn $40,000 and 4 Master of Pwn points. #Pwn2Own #P2OIreland pic.twitter.com/tRW8f20NU8
— Zero Day Initiative (@thezdi) October 23, 2024
Corentin BAYET (@OnlyTheDuck) of @Reverse_Tactics chained three bugs to exploit the QNAP QHora-322 to QNAP TS-464, earning $41,750 and 8.5 Master of Pwn points, though one bug had been used before.
NiNi (@terrynini38514) of DEVCORE Research Team demonstrated an exploit an Improper Verification of Cryptographic Signature bug against the AeoTec Smart Home Hub. They earn $40,000 and 4 Master of Pwn points.
Other exploits demonstrated during day two of Pwn2Own Ireland 2024 targeted Sonos Era 300 smart speaker, Canon and HP printers, Lorex and Ubiquiti cameras, and QNAP and Synology NAS devices.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Pwn2Own Ireland 2024)
