Windows, Ubuntu, and VMWare Workstation hacked on last day of Pwn2Own

On the third day of the Pwn2Own hacking contest, security researchers were awarded $185,000 after demonstrating 5 zero-day exploits targeting Windows 11, Ubuntu Desktop, and the VMware Workstation virtualization software.

The highlight of the day was the Ubuntu Desktop operating system getting hacked three times by three different teams, although one of them was a collision with the exploit being previously known.

The three working Ubuntu zero-day were demoed by Kyle Zeng of ASU SEFCOM (a double free bug), Mingi Cho of Theori (a Use-After-Free vulnerability), and Bien Pham (@bienpnn) of Qrious Security.

While the first two were each awarded $30,000 for their zero-day exploits, Pham only earned $15,000 due to a bug collision.

A fully patched Windows 11 system was hacked again at Pwn2Own, with Thomas Imbert (@masthoon) from Synacktiv (@Synacktiv) earning $30,000 for a Use-After-Free (UAF) bug.

Last but not least, the STAR Labs (@starlabs_sg) team used an uninitialized variable and UAF exploit chain against VMWare Workstation for an $80,000 award.

On the first day, Pwn2Own Vancouver 2023 contestants earned $375,000 and a Tesla Model 3 after demoing 12 zero-days in the Tesla Model 3, Windows 11, Microsoft SharePoint, Oracle VirtualBox, and macOS.

During the second day, competitors were awarded $475,000 after exploiting 10 zero-days in multiple products, including Windows 11, Tesla, Ubuntu, and macOS.

This brings the total to $1,035,000 and a car awarded for 27 zero-day exploits demoed during the three days of this year's Pwn2Own Vancouver 2023 contest.

The winners of the competition are Synacktiv, who earned $530,000 and a Tesla Model 3 car for their exploits.

That’s a wrap for #P2OVancouver! Contestants disclosed 27 unique 0-days and won a combined $1,035,000 (and a car)! Congratulations to the Masters of Pwn, @Synacktiv, for their huge success and hard work! They earned 53 points, $530,000, and a Tesla Model 3. #Pwn2Own pic.twitter.com/xtd0cdjGC3

At Pwn2Own Vancouver 2023, security researchers targeted software from multiple categories, including automotive, enterprise applications and communications, servers, virtualization, and local escalation of privilege (EoP).

"For this year’s event, every round will pay full price, which means if all exploits succeed, we’ll award over $1,000,000 USD," said.

Vendors have 90 days to patch the zero-day bugs demoed and disclosed during Pwn2Own before Trend Micro's Zero Day Initiative will publicly release technical details.

At last year's Pwn2Own Vancouver hacking competition, researchers were awarded $1,155,000 after hacking the Tesla Model 3 Infotainment System and taking down Windows 11, Microsoft Teams, and Ubuntu Desktop using multiple zero-day bugs and exploit chains.