Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

Bug Hunters Invited to Hack Facebook Devices at Pwn2Own Tokyo 2019

Trend Micro’s Zero Day Initiative (ZDI) on Wednesday announced the prizes, rules and targets for Pwn2Own Tokyo 2019, which is set to take place on November 6-7 alongside the PacSec conference in Tokyo, Japan.

This year’s event targets 17 devices and over $750,000 in cash and prizes are being offered to researchers who can hack them.

Trend Micro’s Zero Day Initiative (ZDI) on Wednesday announced the prizes, rules and targets for Pwn2Own Tokyo 2019, which is set to take place on November 6-7 alongside the PacSec conference in Tokyo, Japan.

This year’s event targets 17 devices and over $750,000 in cash and prizes are being offered to researchers who can hack them.

The list of targets has been expanded and Pwn2Own Tokyo 2019 invites white hat hackers to exploit vulnerabilities they found in two devices from Facebook, the Portal smart display and the Oculus Quest virtual reality headset.

A remote code execution vulnerability in Oculus Quest or Portal can earn participants up to $60,000, while a local privilege escalation or non-invasive physical attack is worth up to $40,000.

The smartphones targeted this year are Xiaomi Mi 9, Samsung Galaxy S10, Huawei P30, Google Pixel 3 XL, Apple iPhone XS Max, and Oppo F11 Pro. Unsurprisingly, the highest rewards are offered for vulnerabilities in Google and Apple devices, including $60,000 for flaws in web browsers and short-distance communications (Wi-Fi, Bluetooth, NFC), $75,000 for weaknesses in messaging systems, and $150,000 for baseband attacks.

In the baseband category, which involves devices communicating with a rogue base station, participants who hack the iPhone or Pixel can earn bonuses of up to $150,000, which means they could get $300,000 for an attack.

Pwn2Own Tokyo 2019 also covers wearables, home automation devices, routers, and even TVs.

Vulnerabilities in Apple Watch Series 4, Amazon Echo Show, and Google Nest Hub Max can earn white hat hackers up to $60,000, while flaws in Amazon Cloud Cam, and Nest Cam IQ Indoor are worth up to $40,000.

Advertisement. Scroll to continue reading.

Security holes affecting Sony X800G and Samsung Q60 TVs will be rewarded with up to $15,000, and vulnerabilities in TP-Link AC1750 Smart WiFi routers and NETGEAR Nighthawk Smart WiFi routers are worth up to $20,000 and $25,000, respectively.

Bug hunters interested in the competition must register by November 4. The complete Pwn2Own Tokyo 2019 rules are available on ZDI’s website.

Related: Samsung Galaxy S9, iPhone X Hacked at Pwn2Own Tokyo

Related: IoT Category Added to Pwn2Own Hacking Contest

Related: Pwn2Own 2019: Researchers Win Tesla After Hacking Its Browser

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.