Vulnerabilities

Hackers Earn $200,000 for VM Escapes at Pwn2Own 2017

White hat hackers earned more than $250,000 for the vulnerabilities they disclosed on the third day of the Pwn2Own 2017 competition, including a couple of exploits that involved escaping VMware virtual machines.

Eduard Kovacs

March 20, 2017

Due to the unprecedented number of contestants and entries, Pwn2Own was extended to three days this year. On the third day, participants targeted the Microsoft Edge browser and VMware Workstation.

First, the 360 Security team earned $105,000 for hacking Edge and achieving a virtual machine (VM) escape. Experts leveraged a heap overflow in Edge, a type confusion in the Windows kernel and an uninitialized buffer flaw in VMware to complete the task.

Tencent Security’s Team Sniper earned $100,000 for a VMware Workstation exploit that can be used to escape VMs. The group leveraged a use-after-free in Windows, and information disclosure and uninitialized buffer flaws in VMware.

The Zero Day Initiative (ZDI) pointed out that a complete exploit was not easy to pull off in this category due to the fact that VMware Tools was not installed in the guest operating system.

Richard Zhu, aka fluorescence, also targeted Edge, but he only earned $55,000 as his exploit chain did not result in a VM escape. The researcher leveraged two use-after-free vulnerabilities in Edge and a buffer overflow in the Windows kernel to escalate privileges to SYSTEM.

ZDI paid out a total of $833,000 for the 51 vulnerabilities disclosed at Pwn2Own 2017. In comparison, participants only earned $460,000 at last year’s event for 21 new flaws.

360 Security obtained the highest number of Master of Pwn points this year, earning them 65,000 ZDI points worth $25,000.

On the first day of Pwn2Own 2017, white hat hackers received $233,000 for hacking Edge, Safari, Ubuntu and Adobe Reader. On the second day of the competition, experts took home $340,000 for exploits targeting Windows, macOS, Firefox, Edge, Safari and Flash Player.

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Latest News

Click to comment

Dealing With the Carcinization of Security

Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies.

Marc Solomon

Stop, Collaborate and Listen: Disrupting Cybercrime Networks Requires Private-Public Cooperation and Information Sharing

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Derek Manky

How the Atomized Network Changed Enterprise Protection

Our networks have become atomized which, for starters, means they’re highly dispersed. Not just in terms of the infrastructure – legacy, on-premises, hybrid, multi-cloud, and edge.

Matt Wilson

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George