Trend Micro’s Zero Day Initiative (ZDI) on Wednesday announced the prizes, rules and targets for Pwn2Own Tokyo 2019, which is set to take place on November 6-7 alongside the PacSec conference in Tokyo, Japan.
This year’s event targets 17 devices and over $750,000 in cash and prizes are being offered to researchers who can hack them.
The list of targets has been expanded and Pwn2Own Tokyo 2019 invites white hat hackers to exploit vulnerabilities they found in two devices from Facebook, the Portal smart display and the Oculus Quest virtual reality headset.
A remote code execution vulnerability in Oculus Quest or Portal can earn participants up to $60,000, while a local privilege escalation or non-invasive physical attack is worth up to $40,000.
The smartphones targeted this year are Xiaomi Mi 9, Samsung Galaxy S10, Huawei P30, Google Pixel 3 XL, Apple iPhone XS Max, and Oppo F11 Pro. Unsurprisingly, the highest rewards are offered for vulnerabilities in Google and Apple devices, including $60,000 for flaws in web browsers and short-distance communications (Wi-Fi, Bluetooth, NFC), $75,000 for weaknesses in messaging systems, and $150,000 for baseband attacks.
In the baseband category, which involves devices communicating with a rogue base station, participants who hack the iPhone or Pixel can earn bonuses of up to $150,000, which means they could get $300,000 for an attack.
Pwn2Own Tokyo 2019 also covers wearables, home automation devices, routers, and even TVs.
Vulnerabilities in Apple Watch Series 4, Amazon Echo Show, and Google Nest Hub Max can earn white hat hackers up to $60,000, while flaws in Amazon Cloud Cam, and Nest Cam IQ Indoor are worth up to $40,000.
Security holes affecting Sony X800G and Samsung Q60 TVs will be rewarded with up to $15,000, and vulnerabilities in TP-Link AC1750 Smart WiFi routers and NETGEAR Nighthawk Smart WiFi routers are worth up to $20,000 and $25,000, respectively.
Bug hunters interested in the competition must register by November 4. The complete Pwn2Own Tokyo 2019 rules are available on ZDI’s website.
Related: Samsung Galaxy S9, iPhone X Hacked at Pwn2Own Tokyo
Related: IoT Category Added to Pwn2Own Hacking Contest
Related: Pwn2Own 2019: Researchers Win Tesla After Hacking Its Browser