Pwn2Own Miami hacking contest awarded $400,000 for 26 unique ICS exploits

Which hat hackers that participated in the Pwn2Own Miami 2022 hacking contest earned a total of $400,000 for their ICS exploits.

The Pwn2Own Miami 2022 is a hacking contest organized by Trend Micro’s Zero Day Initiative (ZDI) that focuses on demonstrating exploits for ICS systems belonging to the following categories: the OPC UA Server, Control Server, Human Machine Interface, and Data Gateway.

During the three days of competition, 11 participants made 32 attempts of demonstrating their ICS exploits against products from Unified Automation, Iconics, Inductive Automation, Prosys, Aveva, Triangle MicroWorks, OPC Foundation, Kepware, and Softing.

#Pwn2Own Miami wraps up. We awarded $400,000 over the 3 days for 26 unique exploits (and a few bug collisions). We'll be on Stage 2 of #S4x22 to award the Master of Pwn trophy and jackets to @daankeuper & @xnyhps from @sector7_nl who earned 90 points (and $90K!).

— Zero Day Initiative (@thezdi) April 21, 2022

Participants demonstrated a total of 26 unique zero-day exploits, only two attempts failed and the other eight were classified as BUG COLLISION, which means that the white hat hackers successfully demonstrated the ICS exploits but they were using already known issues.

Each “bug collision” attempt was awarded a payout of $5,000, while remote code execution were awarded $20,000 on average. The payout for DoS ICS exploits was $5,000.

Daan Keuper (@daankeuper) and Thijs Alkemade (@xnyhps) from Computest Sector 7 (@sector7_nl) demonstrated how to bypass the trusted application check on the OPC Foundation OPC UA .NET Standard and earned $40,000 and 40 Master of Pwn points.

The Computest Sector 7 team won Master of Pwn for Pwn2Own Miami 2022 and earned a total of $90,000.

“Pwn2Own Miami for 2022 has wrapped up, and it was an amazing three days of competition. In total, we awarded $400,000 for 26 unique 0-days (plus a few bug collisions). With 90 points accumulated over three days, the team of Daan Keuper (@daankeuper) and Thijs Alkemade (@xnyhps) from Computest Sector 7 (@sector7_nl) have won Master of Pwn!” reads the post from ZDI.

Congratulations to @daankeuper & @xnyhps from @sector7_nl on winning Master of Pwn for #Pwn2Own Miami 2022! It was a close race to be sure, but a well deserved victory. Hope to see them in future events as well. pic.twitter.com/8BeWTF08yY

— Zero Day Initiative (@thezdi) April 21, 2022

Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform  

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Pwn2Own Miami 2022)

[adrotate banner=”5″]

[adrotate banner=”13″]