Pwn2Own 2019 Day 3 – Hackers focused their efforts on car hacking, two teams participated in the competitions but only one of them reached the goal.
The security experts Amat Cama and Richard Zhu of team Fluoroacetate, earned $35,000 for their exploit, along with the Tesla they hacked. The white hat hackers managed to display a message on the car’s web browser by exploiting a just-in-time (JIT) issue in the renderer component.
This was the first time that the competition had an automotive hacking session. The organizations offered the highest rewards for exploits for modem or tuner, Wi-Fi or Bluetooth, key fobs, and the autopilot.
There was a reward, up to $250,000, for hacking the gateway, autopilot or security system.
Cama and Zhu won a total of $375,000 in cash in the three days for exploits against Safari, Oracle VirtualBox, VMware Workstation, Firefox, and Microsoft Edge.
“After a few minutes of setup, and with many cameras rolling, they successfully demonstrated their research on the Model 3 internet browser. They used a JIT bug in the renderer to display their message and earn $35,000. Of course, this is Pwn2Own so they also get the car.” reads the post published by ZDI.
The Pwn2Own Vancouver 2019 awarded a total of $545,000 for 19 unique bugs in Apple Safari, Microsoft Edge and Windows, VMware Workstation, Mozilla Firefox, and the Tesla infotainment system.
All the vulnerabilities exploited at Pwn2Own 2019 have been already reported to vendors, the organization will give them 90 days before their public disclosure.
If you are interested in news about the other days of the competition give a look here:
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Pwn2Own 2019, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
U.S. CISA added the Windows Print Spooler flaw CVE-2022-38028 to its Known Exploited Vulnerabilities catalog.…
The U.S. Department of Justice (DoJ) announced the arrest of two co-founders of a cryptocurrency mixer…
Google addressed a critical Chrome vulnerability, tracked as CVE-2024-4058, that resides in the ANGLE graphics…
Nation-state actor UAT4356 has been exploiting two zero-days in ASA and FTD firewalls since November…
A malware campaign has been exploiting the updating mechanism of the eScan antivirus to distribute…
The Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned four Iranian nationals for their…
This website uses cookies.