White hat hackers have managed to compromise Windows 11 three times in a single day during a recently held hacking contest, raising questions on the software's security.
The third and final day of the 2022 Pwn2Own Vancouver hacking contest saw three separate participants used zero-day vulnerabilities to crack open Microsoft’s latest operating system.
The first contestant was nghiadt12 from Viettel Cyber Security, who abused a Windows 11 escalation of privilege exploit, via Integer Overflow. The second and the third ones were Bruno Pujos and vnhthp1712 from REverse Tactics, who used Use-After-Free and Improper Access Control vulnerabilities to escalate privileges on the target endpoint.
Hacking a car
Besides three successful attempts, there was also an unsuccessful attempt by Team DoubleDragon, which failed to demo the exploit within the deadline.
Ubuntu Desktop was also successfully hacked once, by STAR Labs' Billy Jheng Bing-Jhong it was added. Use-After-Free exploit was used in this attack, as well.
During the entire Pwn2Own 2022, a total of 17 competitors hacked Windows 11 multiple times, but also Ubuntu Desktop, Apple Safari, Oracle Virtualbox and Mozilla Firefox.
Since 2019, the competition has added a brand new category – automotive infotainment systems. This year, such a system in the Tesla 3 car was hacked. According to the media, a group called Sznactiv demonstrated a sandbox escape exploit in the infotainment system, allowing the attacker to assume control over the built-in computing device.
The group was awarded $75,000 for the bug, but said that it could also be used to launch stage-two attacks with malware that could be a lot more destructive, and could even allow for full device takeover. Completely hacking a Tesla Model 3 earns the participant $600,000 and the car itself, Kurritu.org reported.
More than a million dollars was paid out in rewards for the successful hacks, with vendors now having 90 days to fix the issues. Should they fail to meet the deadline, Trend Micro’s Zero Day Initiative will publicly disclose the flaws.
Via: BleepingComputer
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba