Trend Micro’s Zero Day Initiative (ZDI) on Wednesday announced the prizes, rules and targets for Pwn2Own Tokyo 2019, which is set to take place on November 6-7 alongside the PacSec conference in Tokyo, Japan.
This year’s event targets 17 devices and over $750,000 in cash and prizes are being offered to researchers who can hack them.
The list of targets has been expanded and Pwn2Own Tokyo 2019 invites white hat hackers to exploit vulnerabilities they found in two devices from Facebook, the Portal smart display and the Oculus Quest virtual reality headset.
A remote code execution vulnerability in Oculus Quest or Portal can earn participants up to $60,000, while a local privilege escalation or non-invasive physical attack is worth up to $40,000.
The smartphones targeted this year are Xiaomi Mi 9, Samsung Galaxy S10, Huawei P30, Google Pixel 3 XL, Apple iPhone XS Max, and Oppo F11 Pro. Unsurprisingly, the highest rewards are offered for vulnerabilities in Google and Apple devices, including $60,000 for flaws in web browsers and short-distance communications (Wi-Fi, Bluetooth, NFC), $75,000 for weaknesses in messaging systems, and $150,000 for baseband attacks.
In the baseband category, which involves devices communicating with a rogue base station, participants who hack the iPhone or Pixel can earn bonuses of up to $150,000, which means they could get $300,000 for an attack.
Pwn2Own Tokyo 2019 also covers wearables, home automation devices, routers, and even TVs.
Vulnerabilities in Apple Watch Series 4, Amazon Echo Show, and Google Nest Hub Max can earn white hat hackers up to $60,000, while flaws in Amazon Cloud Cam, and Nest Cam IQ Indoor are worth up to $40,000.
Security holes affecting Sony X800G and Samsung Q60 TVs will be rewarded with up to $15,000, and vulnerabilities in TP-Link AC1750 Smart WiFi routers and NETGEAR Nighthawk Smart WiFi routers are worth up to $20,000 and $25,000, respectively.
Bug hunters interested in the competition must register by November 4. The complete Pwn2Own Tokyo 2019 rules are available on ZDI’s website.
Related: Samsung Galaxy S9, iPhone X Hacked at Pwn2Own Tokyo
Related: IoT Category Added to Pwn2Own Hacking Contest
Related: Pwn2Own 2019: Researchers Win Tesla After Hacking Its Browser
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- VMware ESXi Servers Targeted in Ransomware Attack via Old Vulnerability
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- GoAnywhere MFT Users Warned of Zero-Day Exploit
- UK Car Retailer Arnold Clark Hit by Ransomware
- EV Charging Management System Vulnerabilities Allow Disruption, Energy Theft
- Unpatched Econolite Traffic Controller Vulnerabilities Allow Remote Hacking
Latest News
- Comcast Wants a Slice of the Enterprise Cybersecurity Business
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- New York Attorney General Fines Vendor for Illegally Promoting Spyware
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- 20 Million Users Impacted by Data Breach at Instant Checkmate, TruthFinder
- Cyber Insights 2023 | Zero Trust and Identity and Access Management
- Cyber Insights 2023 | The Coming of Web3
- European Police Arrest 42 After Cracking Covert App
