Pwn2Own Miami hacking contest awarded $400,000 for 26 unique ICS exploits

Which hat hackers that participated in the Pwn2Own Miami 2022 hacking contest earned a total of $400,000 for their ICS exploits.

The Pwn2Own Miami 2022 is a hacking contest organized by Trend Micro’s Zero Day Initiative (ZDI) that focuses on demonstrating exploits for ICS systems belonging to the following categories: the OPC UA Server, Control Server, Human Machine Interface, and Data Gateway.

During the three days of competition, 11 participants made 32 attempts of demonstrating their ICS exploits against products from Unified Automation, Iconics, Inductive Automation, Prosys, Aveva, Triangle MicroWorks, OPC Foundation, Kepware, and Softing.

Participants demonstrated a total of 26 unique zero-day exploits, only two attempts failed and the other eight were classified as BUG COLLISION, which means that the white hat hackers successfully demonstrated the ICS exploits but they were using already known issues.

Each “bug collision” attempt was awarded a payout of $5,000, while remote code execution were awarded $20,000 on average. The payout for DoS ICS exploits was $5,000.

Daan Keuper (@daankeuper) and Thijs Alkemade (@xnyhps) from Computest Sector 7 (@sector7_nl) demonstrated how to bypass the trusted application check on the OPC Foundation OPC UA .NET Standard and earned $40,000 and 40 Master of Pwn points.

The Computest Sector 7 team won Master of Pwn for Pwn2Own Miami 2022 and earned a total of $90,000.

“Pwn2Own Miami for 2022 has wrapped up, and it was an amazing three days of competition. In total, we awarded $400,000 for 26 unique 0-days (plus a few bug collisions). With 90 points accumulated over three days, the team of Daan Keuper (@daankeuper) and Thijs Alkemade (@xnyhps) from Computest Sector 7 (@sector7_nl) have won Master of Pwn!” reads the post from ZDI.

Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform  

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Pwn2Own Miami 2022)

---