Pierluigi Paganini December 07, 2022

The Pwn2Own Toronto 2022 hacking competition has begun, this is the 10th anniversary of the consumer-focused version of the contest.

The news of the Samsung Galaxy S22 hack on the first day of Pwn2Own Toronto 2022 made the headlines. White hat hackers that participated in the competition hacked the Samsung Galaxy S22 smartphone twice during the first day of the hacking competition, the 10th edition of the consumer-focused event.

This year’s event has seven different categories for contestants and more than $1,000,000 in prizes available:

– Mobile Phones
– Wireless Routers
– Home Automation Hubs
– Printers
– Smart Speakers
– NAS Devices
– The SOHO Smashup

The team STAR Labs successfully executed an improper input validation attack on their 3rd try against the Samsung Galaxy S22. They earned $50K and 5 Master of Pwn points.

The device was running the latest version of the Android OS with all available updates installed.

Another participant, Chim, demonstrated how to execute their improper input validation attack against the Samsung Galaxy S22. They earn $25K (round 2) and 5 Master of Pwn points.

The first winner on each target, in this case STAR Labs, received the full cash award and the devices under test. For the second and subsequent rounds on each target, all other winners will receive 50% of the prize package, however, they will still earn the full Master of Pwn points.

DEVCORE becomes the first team ever to successfully exploit two different stack-based buffer overflow attacks against a Mikrotik router and a Canon printer as part of the new “SOHO SMASHUP” category. The team earned $100K cash and 10 Master of Pwn points.

The Claroty Research team chained 3 bugs (2x Missing Auth for Critical Function and an Auth Bypass) attack against the Synology DiskStation DS920+ in the NAS category. They earned $40K and 4 Master of Pwn points.

In the “Printers” category, Horizon3 AI executed their command injection attack by serenading the crowd with a little tune from a popular classic against the Lexmark MC3224i in the Printer category. They earn $20K and 2 Master of Pwn points. Interrupt Labs researchers executed their stack-based buffer overflow attack on the 3rd and final try against the HP Color LaserJet Pro M479fdw in the Printer category. They earn $20K and 2 Master of Pwn points.

During this first day of the competition, white hat hackers also successfully demonstrated their exploits against routers from multiple vendors, including Mikrotik, NETGEAR, TP-Link, and Synology.

For further details give a look at the “PWN2OWN TORONTO 2022 – DAY ONE RESULTS“

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Pwn2Own Toronto 2022)

[adrotate banner=”5″]

[adrotate banner=”13″]