White hat hackers received a total of $180,000 at the Pwn2Own Miami 2023 hacking contest this week for exploits targeting widely used industrial control system (ICS) products.
At the ICS edition of Pwn2Own, hackers have been invited to demonstrate exploits against OPC UA, data gateway and edge products made by Aveva, Inductive Automation, ProSys, PTC, Softing Industrial Automation, Triangle MicroWorks, and Unified Automation.
Prizes ranged between $5,000 and $40,000 per exploit chain, but none of the participants has earned more than $20,000 for a single exploit.
Researchers received $20,000 for remote code execution exploits targeting Triangle Microworks SCADA Data Gateway, Inductive Automation Ignition, and Softing EdgeAggregator Siemens. A majority of entries demonstrated DoS attacks and earned participants $5,000.
The team from industrial cybersecurity firm Claroty was declared the winner, earning $98,500 for its exploits and an additional $25,000 representing the winner’s bonus.
The exploits — excluding the winner’s bonus — earned participants nearly $155,000. In comparison, at last year’s ICS Pwn2Own, white hat hackers took home a total of $400,000 for more than two dozen unique exploits.
Vulnerabilities demonstrated at Pwn2Own are reported to the vendors whose products they impact.
Related: Details Disclosed for OPC UA Vulnerabilities Exploited at ICS Hacking Competition
Related: Tesla Returns as Pwn2Own Hacker Takeover Target
Related: Device Exploits Earn Hackers Nearly $1 Million at Pwn2Own Toronto 2022
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- New York Man Arrested for Running BreachForums Cybercrime Website
- Exploitation of Recent Fortinet Zero-Day Linked to Chinese Cyberspies
- Mozilla Patches High-Severity Vulnerabilities With Release of Firefox 111
- Microsoft: 17 European Nations Targeted by Russia in 2023 as Espionage Ramping Up
Latest News
- Ransomware Gang Publishes Data Allegedly Stolen From Maritime Firm Royal Dirkzwager
- Zoom Paid Out $3.9 Million in Bug Bounties in 2022
- Oleria Scores $8M Seed Funding for ID Authentication Technology
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- News Analysis: UK Commits $3 Billion to Support National Quantum Strategy
- Malicious NuGet Packages Used to Target .NET Developers
- Google Pixel Vulnerability Allows Recovery of Cropped Screenshots
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
