Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

Bug Hunters Invited to Hack Facebook Devices at Pwn2Own Tokyo 2019

Trend Micro’s Zero Day Initiative (ZDI) on Wednesday announced the prizes, rules and targets for Pwn2Own Tokyo 2019, which is set to take place on November 6-7 alongside the PacSec conference in Tokyo, Japan.

This year’s event targets 17 devices and over $750,000 in cash and prizes are being offered to researchers who can hack them.

Trend Micro’s Zero Day Initiative (ZDI) on Wednesday announced the prizes, rules and targets for Pwn2Own Tokyo 2019, which is set to take place on November 6-7 alongside the PacSec conference in Tokyo, Japan.

This year’s event targets 17 devices and over $750,000 in cash and prizes are being offered to researchers who can hack them.

The list of targets has been expanded and Pwn2Own Tokyo 2019 invites white hat hackers to exploit vulnerabilities they found in two devices from Facebook, the Portal smart display and the Oculus Quest virtual reality headset.

A remote code execution vulnerability in Oculus Quest or Portal can earn participants up to $60,000, while a local privilege escalation or non-invasive physical attack is worth up to $40,000.

The smartphones targeted this year are Xiaomi Mi 9, Samsung Galaxy S10, Huawei P30, Google Pixel 3 XL, Apple iPhone XS Max, and Oppo F11 Pro. Unsurprisingly, the highest rewards are offered for vulnerabilities in Google and Apple devices, including $60,000 for flaws in web browsers and short-distance communications (Wi-Fi, Bluetooth, NFC), $75,000 for weaknesses in messaging systems, and $150,000 for baseband attacks.

In the baseband category, which involves devices communicating with a rogue base station, participants who hack the iPhone or Pixel can earn bonuses of up to $150,000, which means they could get $300,000 for an attack.

Pwn2Own Tokyo 2019 also covers wearables, home automation devices, routers, and even TVs.

Vulnerabilities in Apple Watch Series 4, Amazon Echo Show, and Google Nest Hub Max can earn white hat hackers up to $60,000, while flaws in Amazon Cloud Cam, and Nest Cam IQ Indoor are worth up to $40,000.

Security holes affecting Sony X800G and Samsung Q60 TVs will be rewarded with up to $15,000, and vulnerabilities in TP-Link AC1750 Smart WiFi routers and NETGEAR Nighthawk Smart WiFi routers are worth up to $20,000 and $25,000, respectively.

Bug hunters interested in the competition must register by November 4. The complete Pwn2Own Tokyo 2019 rules are available on ZDI’s website.

Related: Samsung Galaxy S9, iPhone X Hacked at Pwn2Own Tokyo

Related: IoT Category Added to Pwn2Own Hacking Contest

Related: Pwn2Own 2019: Researchers Win Tesla After Hacking Its Browser

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.