14 DAY TRIAL // The second day of Pwn2Own has ended and the challenges to bypass the defenses of the four major web browsers proved to be no match for the participant hackers, one of them receiving a total of $225,000/ €211,000 in rewards.
Mozilla Firefox was already broken in the first day of the contest but the deed was repeated on Thursday by researcher ilxu1a, who received $15,000 / €14,000 for the successful bug exploit chain demonstrated.
lokihardt breaks Chrome, IE 11 and Safari
However, the largest rewards this time were for leveraging zero-days in Internet Explorer 11, Google Chrome and Safari, with contestant JungHoon Lee (lokihardt) from South Korea managing to slip past the security checks of all three of them in three sessions, 30 minutes each.
For a bug in Chrome he was awarded $75,000 / €70,500, to which another $25,000 / €23,500 was added for getting system privileges on the targeted computer. On top of this, he received an additional $10,000 / €9,500 for demonstrating the vulnerability in a beta version of the browser.
In an earlier session, Lee’s effort focused on Microsoft’s Internet Explorer 11, which was also brought down, earning him an extra $65,000 / €61,100.
During the third session, which started at 15:00 (PDT), 30 minutes later than originally scheduled, Lee got by the protection mechanisms in Apple’s Safari, a success that was fit for a $50,000 / €47,000 reward.
Adobe Reader and Flash Player hacked in the first day
Held at CanSecWest security conference in Vanvouver, the competition is sponsored by HP and Google Project Zero.
Its first day at this year's edition saw hackers combine 13 zero-day bugs in Adobe Reader and Flash Player, Windows operating system, Internet Explorer 11 and Mozilla Firefox, to gain complete control over the targeted machine.
The rewards summed $317,500 / €298,000, most of the money being taken by security researcher Nicolas Jolly ($90,000 / €84,500), and KeenTeam and Jun Mao from Tencent PCMgr ($130,000 / €122,000).